Read this article to find out what to do if an antivirus removed important files and how to recover them. What is a quarantine and how to configure exclusions for an antivirus? Learn more about causes of data loss and available effective methods to restore missing user files.

Introduction

The harmful effects of viruses may result in all kinds of damage to your data: erasing, encrypting, overwriting, destroying system files and file allocation tables, and other unpleasant consequences that affect the work of certain hardware elements, or the computer in general.

The antivirus activities meant to combat all kinds of malware may sometimes lead to situations when certain important user files are removed by the antivirus trying to cure the operating system or repair consequences of a virus attack. In this article, we will tell you what to do if an antivirus removed the files you need, and how they can be recovered.

Why it is necessary to use an antivirus?

Security always comes first. In the times when computing technologies and data processing are developing rapidly, safe use and storage of information requires special attention and specialized software.

Viruses pose a most widespread threat for personal computers, and they can have a devastating effect on the data they store and the hardware they are made of.

Such malware can self-replicate and infect all devices connected to a computer and therefore provoke more serious issues. Malware effects include errors in the work of your computer or devices connected to it, which may provoke interruptions in your work and even result in loss of important data. That is why it vitally important to protect computing devices from malware and ensure safety of data, including its protection against unauthorized access.

Quarantine and exclusions settings in products by Kaspersky

Most virus developers are knowledgeable about the methodology of antivirus companies who strive to ensure computer safety and protect user data from various threats, and that is why they try to disguise virus activities to make them look as typical behavior of safe applications, or embed the malicious code into ordinary files.

Being the main element in the protection of personal computers and other digital devices, Kaspersky antivirus keeps user and system files secure from hacker attacks and malware intrusions. Following its internal settings, Kaspersky removes infected or dangerous files when they are detected, and this way, it prevents undesired effects for the operating system and secures all user data against devastating consequences. That is why may users can be surprised to find out that Kaspersky antivirus removes files automatically without asking for permission.

So if users prefer, on their own responsibility, to make independent decisions what to do when malicious objects and suspicious activities are spotted, they can disable automatic deletion of files in a few simple steps. Open the window of your Kaspersky antivirus or any other product by this company, and click the gear-shaped Settings button in the lower left corner of the screen. As an example, we’ll be using Kaspersky Internet Security, but the described algorithm is good for all company products.

In the settings window that opens, find the section Interactive protection and uncheck the box next to Perform recommended actions automatically.

Now the automatic removal of harmful files which cannot be cured is disabled.

In this case, all detected harmful or suspicious files will be isolated and placed into the quarantine – a special storage for items whose activities raise doubts or which are considered to be dangerous for the computer and the data. The functionality of Kaspersky Lab products lets users recover important files from the quarantine in case they are removed by the antivirus.

To access the quarantine, open the main window and click the button More tools in the central panel.

In the new window that opens, select Quarantine from the list of available tools.

The new page will show you all backup copies of the files that have been removed or modified in the course of curing. Check the files you are looking for and click the button Restore, or right-click on the selected files and choose a corresponding option from the menu that appears.

Now the files removed by Kaspersky antivirus will be restored.

Physically, the quarantine and the files inside it can be found by following this path:

C:\ProgramData\Kaspersky Lab\AVP17.0.0\QB

Open the Windows File Explorer and follow this path, or paste it into the address bar for immediate direct access.

If you possess advanced skills in data security and are confident that certain files or apps are safe, you can add them to the Kaspersky exclusions list so the antivirus will not monitor them.

On the left panel of the settings window, go to Additional, and then click on the text link Threats and Exclusions in the right panel.

In the settings page that opens, find Exclusions and click on the text link Manage exclusions. In a similar way, you can configure the list of trusted applications by choosing the corresponding link Specify trusted applications, and the antivirus will ignore such applications when they start.

In the new pop-up window, click on the Add button.

In the next page, specify the file or folder you want to exclude from the antivirus monitoring by clicking the button Browse, set the object name or name mask according to the Virus Encyclopedia, select corresponding protection components and then click Add for the changes to take effect.

The status Active sets the exclusions list, and the antivirus won’t be checking the selected files and folders, while the status Inactive means this rule is ignored and the antivirus will check everything without missing a single file.

Find deleted files with integrated Windows tools

If you can’t find your files and think they have been removed, but they are missing from the quarantine either, don’t panic: there are other ways to help you get your data back.

First of all, you need to make sure that the missing files were really erased and not just sent to the Windows Recycle Bin which is the typical directory for temporary storage of deleted items. This idea seems so obvious, but we mean exactly what we say: always check the Windows Recycle Bin for the files you think are gone. Sometimes, they end up right there, and all your trouble can be over the very second you open the Recycle Bin.

The next step in restoring the files you need is to use integrated features of your Windows to recover the lost data from backups you may have created previously.

The essential condition for using a backup copy to recover lost or deleted data is to have the backup feature configured and enabled in advance. If files are already missing, you can’t recover anything from a backup copy - because you can’t archive what is gone. That is why turning the backup feature in advance is crucial. You can learn more about various backup options in the “Windows” operating system, their advantages and preferred settings from our video review:

YouTube:

Some applications in Windows may synchronize their data with the cloud storage service OneDrive, which is also a good choice for keeping backup copies of certain documents. Do not exclude this opportunity and check the cloud storage too. You may find copies of the missing files there, and there will be no need to search for them elsewhere.

If the backup feature has been enabled in advance, recovering files won’t take too long, and there are several ways to do it.

Recovering files from a backup to the current directory

You can start recovering files with the tool named Backup and Restore (Windows 7) in one of the following ways: from the Settings app (in Windows, it combines all of the most essential settings and controls) or from the Control Panel. For example, open the Settings app by pressing the key shortcut Windows + I. Scroll down to the section Update and Security below.

In the left panel of the new window, find the line Backup, look to the right to find Looking for an older backup? and click on the hyperlink Go to Backup and Restore (Windows 7).

The backup and restore window will open, and you'll be able to start the recovery process by clicking on the button Restore my files in the Restore section.

The operating system will launch the data recovery process; in the new window Restore Files it will suggest you to select files and folders from available backups for further restoration using the following control buttons: Search, Browse for files or Browse for folders.

Use any of the buttons to find the files or folders that you need and add them to the recovery list which you will see in the central panel. After that, click Next to continue.

In the following window, select location for saving the recovered files. You can either choose the original directory where the files used to be stored before deletion, or specify another directory where they should be saved using the Browse button. Finally, click on the Restore button to complete the operation.