Hello,
unfortunately I didn't find any corresponding posting in this community, so I had to set up a new one...
Recently I also got a note by NIS 2009 having problems with two Excel files which should be infected by Bloodhound.Exploit.252.
First I thought the files would be repaired by NIS, but the program only shifted the files into quarantine leaving options to restore unrepaired, to send to Symantec or to remove from history.
1. leaving them unrepaired was not satisfying at all,
2. sending private stuff to an external company I don't want,
3. removing (i.e. deleting) the files are not acceptable, since I need the data inside.
So I did restore the files knowing that they are still infected potentially. Then I made a copy of each excel file and did rename the copies.
The restored files where taken into quarantine again, the renamed copies did remain and were not marked as infected.
And now the mistake I made - again I did rename the copies to initial name. Also now NIS2009 did not suspect the copies (with initial excel file name) as infected.
Next day I was looking for the files, but they are gone now, maybe forever...
My question:
Though described by NSI2009 help the deleted elements are not to recover , still is there an opportunity to recover these deleted files somehow. Any undelete software did not find the respective excel files. I guess NIS does maybe rename(?) the files but for sure it does low level deleting.
Does anybody knows help?
Thanks and kind regards,
Mak