1

Windows Security has quarantined a text file containing important information. That happened less that 30 days ago, but I cannot see any files in the Windows Security Protection History ("no recent actions"). It seems that the file I need is in the folder C:\ProgramData\Microsoft\Windows Defender\Quarantine\ResourceData\CD and is named
CDE7887F857F55D6C99909E0D63CF26C687DCE80

I tried the procedure of restoring a file as described on docs.microsoft.com “%ProgramFiles%\Windows Defender\MpCmdRun.exe” –Restore –Name EUS:Win32/CustomEnterpriseBlock –All

The result was "no quarantined files".

But I still see the file in the folder C:\ProgramData\Microsoft\Windows Defender\Quarantine\ResourceData\CD

Is there any way to restore it?

Thank you!

Kate
  • 11
  • 2
  • 1
    Did you try to manually copy the file from that folder? – harrymc Oct 27 '20 at 18:27
  • Why on earth would Windows quarantine a non-executable file?? – Tetsujin Oct 27 '20 at 18:39
  • 1
    @Tetsujin: This happens - a virus may include non-executable files. – harrymc Oct 27 '20 at 18:51
  • it could be a bat file renamed to a text file. – Moab Oct 27 '20 at 19:32
  • See this>>>>https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts#restore-file-from-quarantine – Moab Oct 27 '20 at 19:35
  • @Moab thanks, I already tried to restore the file as described on docs.microsoft.com. It gave the result "no quarantined files". – Kate Oct 27 '20 at 19:53
  • @Moab No, it was not a bat file, just a txt from my desktop containing logins... – Kate Oct 27 '20 at 19:55
  • @harrymc Yes, I copied and renamed it as a txt file, then opened and got something like Chinese script in it... – Kate Oct 27 '20 at 19:57
  • problem solved, thanks a lot! https://superuser.com/questions/1448546/possible-to-batch-view-restore-delete-quarantined-files-from-windows-defender?rq=1 – Kate Oct 27 '20 at 22:01

0 Answers0