AVG antivirus removed files by mistake – how to recover them?
Read this article to find out how to restore from the quarantine the files and apps removed by an antivirus. We will discover how to do it with third-party data recovery apps and how to use the integrated backup function to restore deleted files.
Most user data placed onto a storage device is important, and often confidential, which tempts all sorts of hackers to steal it secretly, or use it for some malicious purpose or illegal activities. To get their hands on the data, law-breakers use various tools one of which is malware capable of infecting user devices, directly or indirectly, and stealing important data.
To avoid infection and possible negative consequences of having malware on a computing device, different antivirus solutions are developed to create a safe environment and protect both the device and the user data. In real-time mode, antivirus programs monitor the situation and search for malicious elements, respond to virus attacks, block infiltration attempts, and move infected or suspicious objects to a protected storage for isolation and examination; if these cannot be cured, they are removed.
Yet antiviruses often remove objects which seem suspicious but are not infected, which may result in loss of user data and cause serious trouble, especially if this data was not copied elsewhere and existed in a single location. Still, the situation is not so hopeless at all, and the data can be restored. In today’s article, we will explain how to recover data from the quarantine of an antivirus and what methods can be used when such data was completely removed by an antivirus app.
Why it is important to use an antivirus
With the present-day world tendency of keeping most data in a digital format, its safety and protection against unauthorized access becomes an issue of primary importance. Any information regardless of its type and field of application may become subject to malicious activities that result in its being stolen or lost for good. Family archives and personal notes, private information, confidential financial and banking data, professional and commercial materials, registers and databases – all of them are the stuff hackers are very interested in.
Depending on the kind of malware that was involved, the consequences may vary greatly. Viruses may get the information damaged partially, stolen or lost permanently, by removing, overwriting, blocking or encrypting it.
Damage to the system integrity and the files required to ensure normal operation of a computing device and processing of data may cause errors, modify file allocation tables which are in charge of storing data, lead to failures or even crash the operating system, to say nothing of hardware issues.
Malware can copy itself elsewhere instantly, overloading the operating system and multiplying the amount of junk files, unlock access to user data, infect other devices connected to the computer, send viruses from your PC, use it for launching hacking attacks against other users, sending malicious code or hack servers with restricted access.
Using antivirus solutions will help you ensure data integrity, the highest possible level of protection for the processes involving transfer, exchange, storing and processing information, enable you to avoid damage to hardware and software of your PC, and will contribute to protecting you from other negative consequences of malware activities.
Neglecting the antivirus protection increases considerably your chance to suffer from a virus attack or infestation, and eliminating its negative consequences may require substantial efforts and financial expenses.
Restoring files deleted by the AVG antivirus
Modern antivirus programs strive to ensure complete protection for computing devices and user data against unauthorized access, damage, removal or other malicious activities that may have irreversible effects. Often, an antivirus tries to predict the extent of dangerous influence a certain process, action, file or app may have, and therefore blocks or isolates suspicious elements based on the results of its own independent analysis. This way, infected or potentially harmful objects are moved to a special protected storage (quarantine) of this antivirus, or get erased if the size of the suspicious file exceeds certain limits.
However, an antivirus may not always be correct in its estimate of the danger presented by a specific object, so due to its internal settings and in order to exclude all risks of virus infestation, the antivirus may remove an absolutely healthy file – which behaved in a way that the antivirus found to be suspicious. If such file contained important data or was an element of the system control function, removing it may generate errors or result in an irreversible loss of data. Quite seldom, you can find this removed file in the Windows Recycle Bin and restore it in an ordinary way with the integrated system tools. But if you can’t find the removed files in the standard Windows storage location (the Recycle Bin), you can use other well-tested methods you are going to read about in this article.
Show hidden files
One of the possible methods to restore the lost data when it is no longer shown in its original location is to enable showing hidden files. Sometimes, an antivirus may just hide suspicious files instead of removing them. There are a few ways to make them visible. Here’s the easiest one involving Windows Explorer. It lets you make the hidden files visible and see them immediately.
Open the Windows Explorer in any way you prefer, for example, by double-clicking on This PC desktop shortcut, or by using the context menu appearing when you right-click of that shortcut and choosing Open, and then browse to the required folder.
In the Explorer’s window, switch to the tab View, and in the main ribbon click on Show/Hide. In the menu that appears, check the box for Hidden items. The changes will apply immediately and all hidden files will become visible.
Find the files you need; if you don’t see them, try another method.
Restore from the quarantine the files and apps removed by the antivirus
Most modern antiviruses have a special protected storage (quarantine) which is used for keeping files infected with viruses or those the antivirus believes are potentially dangerous. It is a specially allocated area in the storage device (mostly in the system drive С:/) which is absolutely safe as the antivirus settings prevent the dangerous object from direct contact with the operating system and block any of their activities. Files and applications moved to the quarantine of an antivirus program are not deleted permanently. The main idea of the quarantine is safekeeping the files which have been deleted by the AVG antivirus for some time so that the user can think and decide whether they need the isolated files. If they find out that the missing files are required for normal operation of the computer, were removed by mistake of contain the necessary information which cannot be obtained elsewhere, they can always restore such files to their original location.
For illustration, we’ll be using a free antivirus program AVG AntiVirus FREE, But the sequence of steps works with all versions of AVG. antiviral solutions.
Open the AVG in any way you prefer, for example, by double-clicking on the desktop shortcut AVG AntiVirus FREE, or right-click on it and select Open from the menu.
In the upper right corner of the antivirus window click on the Menu button to open the control panel.
From the options, select Quarantine.
The quarantine page will show you all files and apps placed into the storage as they seem to contain hidden threats for the operating system, or those labeled as potentially dangerous. Find the file or group of files you need to restore by checking the corresponding boxes. Otherwise, check the box for Select all viruses if you want all elements selected.
Depending on the actions you’re going to take, the antivirus offers five variants:
Delete – remove selected objects from the protected storage immediately;
Send for analysis – submit selected objects for analysis by AVG specialists;
Restore – move selected objects to their original location where they used to be stored before the quarantine;
Restore and add exception – selected objects will be restored and added to the exceptions list to prevent their removal in the future;
Restore as – save selected objects to a new location according to user’s directions.
To restore selected files, open the context menu of the Delete button, located in the lower right corner of the antivirus window, and choose one of the three tabs for restoring elements according to user preferences.
If you can’t find the files in the quarantine of your antivirus, and displaying hidden files couldn’t help you either, you need to use specialized data recovery software, and you can find the detailed algorithm to use in the next part of the article.
Recover the files removed by the antivirus with the help of third-party data recovery software
Modern antiviruses apply a complex of various protective mechanisms to help them combat a virus infestation of separate files or the entire operating system, and a set of preventive measures to detect possible virus attacks by analyzing how applications, network packages and specific processes behave. Following the safety criteria set up by their developers and trying to exclude the slightest chance of virus infestation, antiviruses may perform forced removal of suspicious objects which do not necessarily include only potentially dangerous objects. When recovering data lost after antivirus activities, the options offered by the protective application itself may be insufficient, and you may also need to use specialized software able to restore the lost user data in full.
On the Internet, anyone can find a data recovery program to their taste, as there are lots of offers ranging from free apps to commercial solutions. However, with the list of useful features offered and the successful recovery rate in mind, clearly the solution worth your attention is Hetman Partition Recovery, the flagship product by Hetman Software.
This program can be used in a wide range of scenarios as it has a number of integrated tools that always recover user data after all kinds of issues. Hetman Partition Recovery is offered as shareware, with all of the program’s functionality available to users right after the installation.
It can recover lost information regardless of how it was removed from a variety of storage devices (internal or external hard disks, memory cards of any format, flash drives and more) or various computing devices (desktop computers, laptops of all sorts, digital media players etc).
An obvious advantage of Hetman Partition Recovery is its ability to restore information after system failures related to operating system errors or crashes caused by power surges, disk firmware or driver failures. It can also bring data back after hardware issues such as damage to the logical partition or the entire drive, loss of access (when the drive is damaged, unreadable or physically damaged) and software problems (damaged or missing file allocation tables, removed partitions and accidental formatting).
A special feature of the program is recovering lost data after malware effects or virus infestation.
Download Hetman Partition Recovery from the official website of its developer, Hetman Software, and install it to your PC. Download and install the program to a partition other than the one from where you plan to search and recover files. Otherwise, the deleted files may get overwritten which makes it impossible to recover them successfully. The step-by-step wizard will help you select the optimal settings, complete the installation and get it ready to use.
When you start it, Hetman Partition Recovery will run an initial scan to detect all connected storage devices and their parameters. Select the disk or partition where you need to find and recover deleted files. If files were deleted by the antivirus tool, select the system drive C:/.
Double-click on the required disk, and it immediately starts the File Recovery Wizard that will ask you to choose the type of analysis for restoring data from the selected device. You should choose between the two options, Fast scan and Full analysis. The first option is good for recovering recently deleted files and is very quick. The second option lets the program find and recover all information available on the selected disk. It is more preferable in this specific case, as the files removed by the antivirus could be damaged by a virus or infected, and this circumstance requires all the program’s tools to be applied for the best results. Select Full analysis and click Next to start the process of searching and recovering data.
Wait for the analysis to be finished. The actual time required for that will depend on several factors: the size of the storage device, its file system, the extent of damage to the data, functional characteristics of the computing device (i.e. how powerful your PC is), the number of other processes running at the time of scanning etc. The progress bar will show you the course of the scan in real-time mode and provide an estimated time required to accomplish it.
When the analysis for the selected disk is over, Hetman Partition Recovery will display the results in the main window. You can examine contents for all files by viewing or listening to it in the Preview window, and choose what exactly you need to recover. Having selected the necessary files and placed them onto the Recovery List by dragging and dropping, click on the Recovery button.
It starts the File Recovery Wizard immediately and it offers you to choose a method to save the files. By default, you can choose from the four options to satisfy your recovery needs:
Save to hard disk – save recovered files to any storage device you prefer (a hard disk, USB drive etc);
Burn to CD/DVD – write files to an optical disk, with the option to erase the disk in advance if the disk you are using is a rewritable one;
Create ISO virtual image;
Upload by FTP – use the integrated FTP client to upload recovered files to the Internet.
Check the option you prefer and click Next to continue.
Depending on the method you have chosen, you may need to specify a few additional settings, one of them being the path to save the files. When you’ve done that, click Recovery and all the files will be saved in accordance with the settings you have selected.
Use the backup feature to restore deleted files
Backing up important data deserves a separate paragraph. The Windows operating system has a few integrated tools to back up the things you want to protect. The obligatory condition for using these is turning the backup option on in time. You can configure its settings and decide what elements should be archived regularly. In case of an emergency, if a file gets removed by an antivirus by mistake or damaged by some malware, you will be able to have the lost data back by restoring it from the archive you have created so thoughtfully.
However, the constantly growing amount of data we have to deal with, use or keep in storage devices, people often face the problem of low disk space. That is why they choose not to back up their data, or archive only a limited list of important system files. In that case, there is a high risk of not finding the required file if the original copy is missing.
Also, there are always chances that malware can damage or infect the backup file – which makes the antivirus respond and remove it in the end.
There are ore advantages if you create backups and save them online with all kinds of remote cloud storage services (for example, OneDrive). Once again, some users choose not to do it, being afraid lest their data should be leaked or fall into the hands of third parties.
Still, when you have configured a sound backup plan for your devices, it’s a good way to secure your information against unexpected loss.
For a complete overview of the possibilities offered by integrated backup tool of the Windows operating system, peculiarities of their configuration and application, watch this video tutorial: «Windows Back Up (OneDrive, File History, System Image, Recovery Disk)».
Wide usage of modern computing devices for storing, processing, transferring and sharing information increases the chances for it to be lost or damaged as a result of malware activities or virus attacks. The ability of malicious applications to disguise themselves into healthy programs or make their activities look like permitted actions increase the risk of antiviruses deleting user data if it seems suspicious enough.
That is why antiviruses tend to use integrated protected storage areas (quarantines) to keep harmful and suspicious object there and this way, exercise a better control of the situation. Users can always view the contents of the quarantine and restore required objects when they are believed to be absolutely safe, and do it in a few easy steps.
However, for a number of reasons certain elements can be removed immediately, and to have them back, users have to employ a specialized data recovery program, Hetman Partition Recovery. Or find copies of the lost files in a previously created backup.
Leave a comment if you have any questions about recovering files deleted by AVG antivirus, and we will do our best to give you a detailed answer.