Ad-Aware 11 deleted all my Outlook PST files, I can't recover them

vik976 · November 16, 2013

Dear Lavasoft,

After making a full scan today, I choosed "disinfect" for my .pst file, because I don't wanted to "delete" them.

That was a huge misunderstanding, since it seems to me, that ad-aware deleted and shredded those files, instead of "disinfecting" them.

I want to recover my .pst outlook files, but I can't, even with Piriform Recuva.

I miss all my business emails, contacts, calendars, acount settings etc. from those files that were at those locations:

C:\Users\Viktor\Documents\Outlook Files\[email protected]

E:\Users\Viktor\Documents\Outlook Files\[email protected]

E:\1\Eta_archiv.pst

Those huge files are not in the quarantine nor in the wastebin, I checked many times, they are realy deleted and shredded.

Please help me on the recovery of those files or give me at least some advice.

Here is the log of today's action:

<?xml version="1.0"?>

-<Summary>

-<InfectedObjects>

</InfectedObjects>

</Summary>

.

Edited November 16, 2013 by vik976

CeciliaB · November 16, 2013

Hi vik976,

When it's impossible to disinfect a file, and since file infectors are rather rare there are few files that can be disinfected, Ad-Aware will delete it. I have complained to Lavasoft and said the file should be quarantined instead.

But Ad-Aware doesn't shred a file, it's only deleted.

Since a .pst file can be very large and therefore fragmented, it can be very hard for a file recovery program, e.g. Recuva, to collect and put together all the pieces. Note that it's important that you don't start Windows to be able to recover files on C:, since Windows will create new files all the time and they can overwrite the file you want to recover. You need to start the computer from a bootable CD or Flash drive, or connect the hard disk with C: to another computer.

You can try with other file recovery programs:

http://www.pcinspector.de/default.htm?language=1
http://www.officerecovery.com/freeundelete/
http://www.krollontrack.com/data-recovery/recovery-software/
http://www.stellarinfo.com/
http://www.lsoft.net/file_recovery.aspx

I can ask my contact person at Lavasoft for more recommendations, but not until Monday when she is back in the office.

Robsav · November 17, 2013

Hi, Cecilia

So, ... my v11 problem happened to someone else too..!

Now you see, and so does LavaSoft, that the disinfect option is a BIG problem, and should be made to Quarantine the file if disinfecting is unsuccessful. In my case, I didn't even have the logs to view.

Will I hear an "...I'm sorry..." from LSAndy, now, when he doubted my same complaint before?

How 'bout you C C? Do you believe me now?

CeciliaB · November 19, 2013

I can ask my contact person at Lavasoft for more recommendations, but not until Monday when she is back in the office.

Sorry, vik976, Lavasoft hasn't anything to add.

It's described in the manual that if a disinfect fails, e.g. because that the file is locked by another program, the file will be deleted.

eMarky · November 22, 2013

Hi Lavasoft,

This has happened to me today.

It has deleted my entire .pst files. I have tried some of the links Cecilia has posted and it hasn’t worked. Could you please find a solution for this as I have lost lots of very important business emails contacts and all my personal email and contacts?

Surely this is not the way that your software should work its causing no end of grief. I would appreciate a prompt response.

CeciliaB · November 22, 2013

Hi eMarky,

I'm a volunteer here and Lavasoft doesn't read posts.

Did you select disinfect or quarantine as an action in Ad-Aware?

For quarantined files, please see http://www.lavasoftsupport.com/index.php?/topic/33734-deejayh-splitted-topic-cannot-find-quarantined-file/ .

When Lavasoft has tested to delete the .pst file, it has been recreated by Outlook with emails, rules etc. after a restart of the computer.

eMarky · November 22, 2013

Hi Cecilia,

Thanks for replying.. I'm not sure if it was set to disinfect or quarantine.

Also just a bit worried about rebooting, as it may delete it permantly. Any advice would be grateful

CeciliaB · November 22, 2013

Hi eMarky,

Please, check the quarantine tab in Ad-Aware.

eMarky · November 22, 2013

No it’s not there. It has deleted them, But I didn't ask it to. NOT HAPPY. You can’t begin to understand the problem this has caused. I will be removing the Sh!t product. And will be telling all my friends and customer to stay away from this product

<?xml version="1.0"?>
<Summary>
<ScanInfo ScanMode="Manual" ScanType="Full" StartTime="20131120T221152.919812" EndTime="20131121T015319.919812" />
<InfectedObjects>
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\0FPLYPH0.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.Mediaplex" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\3OJY9THY.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.SmartAdServer" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\6Y6XC8EY.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.2o7" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\7924P0P3.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.Advertising" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\BUXBWX9Q.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.TribalFusion" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\FI1TIF0I.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.Rub" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\GUO22MM5.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.DoubleClick" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\I9V41J5Z.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.Rub" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\ILGQ1NJ2.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.Casalemedia" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\JMC71V0B.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.FastClick" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\LOCM1SH9.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.DealTime" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\PRRZH5S1.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.Rub" />
<InfectedObject ObjectType="Cookie" ObjectPath="C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\YJV6WWZ4.txt" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Cookie.Rub" />
<InfectedObject ObjectType="File" ObjectPath="C:\Users\Mark\Documents\Outlook DO NOT DELETE\Outlook.pst" ParentContainers="" InnerObject="" ObjectStatus="Deleted" ThreatType="Virus" ThreatName="Trojan.Jorik.L" />
</InfectedObjects>
</Summary>

CeciliaB · November 22, 2013

I understand that's terrible for you. I know what I would feel if I would loose all my emails. And I have told my contact person what I think about it :angry2: :wacko:

I recommend that you move the hard disk to another computer and run file recovery programs.

vik976 · November 25, 2013

I had my weekend spent on the recovery and I could get all my mails and .pst files back. Here is my solution:

1. Don't restart Your system, since windows with his pagefiles can overwrite Your deleted files

2. Download the recovery software from http://www.stellarinfo.com/ It was the only one who could find me the deleted .pst files

3. Pay the money for that tool (ask Lavasoft to get that money back later)

4. Search Your entire HDDs for every deleted files, it can take very long but don't worry

5. Filter the results for *.pst

6. You will likely see more than one result for the same filename, choose the one with newer version and largest size.

7. Restore those pst files in a new directory. At this point Outlook will tell You, that the file has errors and won't open, but don't worry.

8. In Your Outlook program folder, You will find a software called "scanpst.exe", use this to repair Your .pst files. This can take quite long also.

9. Now You can open Your mails again and write nice messages for whoever You want.

This is how it worked for me.

Unfortunately I also discovered another issue with the Lavasoft 11 version, that it will block Your Cisco VPN adapter to work correctly, but this is another topic.

CeciliaB · November 25, 2013

Thank you, vik976, for letting us know how you got your .pst file back.

Maybe you need to set up some firewall rules to allow the VPN adapter to work correctly.

P.S. Windows can overwrite deleted files even if you don't restart Windows, e.g. by creating a log file.

vik976 · November 25, 2013

Thank you, vik976, for letting us know how you got your .pst file back.

Maybe you need to set up some firewall rules to allow the VPN adapter to work correctly.

P.S. Windows can overwrite deleted files even if you don't restart Windows, e.g. by creating a log file.

You are right, the best is to remove the charger and battery of Your laptop at the moment when You realize that You want to recover something.

But the effort and pain to remove a HDD or SSD from a laptop and to put in another machine with right interface or to bring it to a professional recovery service is quite high.

Edited November 25, 2013 by vik976

rkellock · January 25, 2014

I too have just logged this same issue. It is perfectly acceptable that AdAware decides that deletion is the only recourse. It is not acceptable that it doesn't give the user the option to cancel this operation.

Viruses are damaging because they do unexpected and unauthorised things to your computer, I expected more from AdAware.

CeciliaB · January 25, 2014

Hi rkellock,

Please, add suggestions to the http://www.lavasoftsupport.com/index.php?/topic/33637-suggestions-ideas-what-features-would-you-like-to-see-in-ad-aware-11-or-12/ topic that is monitored by Lavasoft staff, this topic isn't.

towerbuilder12 · January 31, 2014

This happened to me today. Deleted my outlook.pst file. I call customer support at 1-888-846-9584. He said that Ad-Aware could not have deleted the file, and it may be some incompatibility in my system. I told him that I am 100% sure that it is Ad-Aware and I can give him the log. Then he told me that Lavasoft can recover my .pst file for $499. They will not only recover my .pst file but they can do this and that and make sure that my computer is optimized. What??? Why would I pay $499, for something that their software has done to my computer?

CeciliaB · January 31, 2014

This happened to me today. Deleted my outlook.pst file. I call customer support at 1-888-846-9584. He said that Ad-Aware could not have deleted the file, and it may be some incompatibility in my system. I told him that I am 100% sure that it is Ad-Aware and I can give him the log. Then he told me that Lavasoft can recover my .pst file for $499. They will not only recover my .pst file but they can do this and that and make sure that my computer is optimized. What??? Why would I pay $499, for something that their software has done to my computer?

Hi towerbuilder12,

Have you checked the quarantine folder?

Another user found that the file wasn't deleted but quarantined by Ad-Aware?

See post #11 for how to recover deleted files.

Isato · April 27, 2014

I have the same problem. Adaware deleted my outlook .pst file after finding a virus in a mail. The whole .pst file and not only the mail!!!

I had the same pb a few months ago and was so desesperate that I paid 249 euros to have a one year support. They managed to do something and I only lost a few mails. This time, same problem and they can't fix it apparently. I' ve been trying several recovery softwares such as Stellar Phoenix recommended here. But it seems that this .pst file has been deleted definitively. I really don't know how I'll to be able to work during the next months... Any idea? I'm working on Vista Business. Thanks in advance.

CeciliaB · April 28, 2014

Hi Isato,

I'm sorry that it happened to you, but unfortunately I have already replied with what can be done. Maybe it's possible that the email server still have some emails, please contact your email provider.

Ronny.resistor · January 18, 2017

This just happened to me. I lost my PST file and i do not have a backup. Why would you delete a PST file is beyond me this PST had 3 years of emails. I installed AD Aware and did a boot scan. this took 3 hours. when i was finished i started outlook and the program told be that [email protected] was not there. I found one from my backup files (2013) installed it and found that i am missing every e-mail for the past 3 years. lovely. so then i started looking where it went , today 18 hours later i found the AD-Aware full report.

"InfectedObject Threatname="Trojan.Zmutzy.803" ThreatType="Virus" ObjectStatus="deleted" InnerObject=""parentcontainers=""objectpath=" \\?\E:\files\outlook files\xxxx.rogers.com.pst" objecttype="file">/

Really you got to be kidding me one virus detection and you wiped out my entire past 3 years of e mails.

Who writes the Code at your organization a bunch of Hackers by the looks of it.

The CODE should have done the following: Quarentine or Identify the threat to the consumer allow them to store that file and then rerun the virus scan.

This is a FORM OF LEGALIZED HACKING .

i AM VERY UPSET RIGHT NOW.

CeciliaB · January 19, 2017

This just happened to me. I lost my PST file and i do not have a backup. Why would you delete a PST file is beyond me this PST had 3 years of emails. I installed AD Aware and did a boot scan. this took 3 hours. when i was finished i started outlook and the program told be that [email protected] was not there. I found one from my backup files (2013) installed it and found that i am missing every e-mail for the past 3 years. lovely. so then i started looking where it went , today 18 hours later i found the AD-Aware full report.

"InfectedObject Threatname="Trojan.Zmutzy.803" ThreatType="Virus" ObjectStatus="deleted" InnerObject=""parentcontainers=""objectpath=" \\?\E:\files\outlook files\xxxx.rogers.com.pst" objecttype="file">/

Really you got to be kidding me one virus detection and you wiped out my entire past 3 years of e mails.

Who writes the Code at your organization a bunch of Hackers by the looks of it.

The CODE should have done the following: Quarentine or Identify the threat to the consumer allow them to store that file and then rerun the virus scan.

This is a FORM OF LEGALIZED HACKING .

i AM VERY UPSET RIGHT NOW.

Hi Ronny.resistor,

I'm sorry.

There are several precautions that have been implemented in Ad-Aware.

1. I don't know what kind of scan you performed but it's necessary to select that Ad-Aware shall scan archives and emails: http://prnt.sc/dxo09j

2. When Ad-Aware detects a malicious file inside a .pst file, the following warning should be shown: http://prnt.sc/dxopdx

3. The usual behavior is to quarantine all found infected files, but that depends on what you've selected to do.

Have you checked that the .pst file isn't in the quarantine list nor in the quarantine folder?

Sometimes it's possible for Lavasoft to see what has happened in the log files. Please, collect logs by following the instructions in http://www.lavasoftsupport.com/index.php?/topic/33638-collect-logs-for-troubleshooting/ .

Ronny.resistor · January 22, 2017

I did receive a reply from Lava, I guess no one reads what is written, this was a BOOT Scan.

[ ] I have uninstalled the program and guess what not my Ubuntu V16 PhotoRec or EasUS Data recovery can find my file (it cannot even find Ad-Aware there are no traces of this program quite neat as I would have thought that those programs will at least indicate where Lavasoft WAS. It doesn't

Edited January 22, 2017 by Ronny.resistor

CeciliaB · January 22, 2017

I did receive a reply from Lava, I guess no one reads what is written, this was a BOOT Scan.

[ ] I have uninstalled the program and guess what not my Ubuntu V16 PhotoRec or EasUS Data recovery can find my file (it cannot even find Ad-Aware there are no traces of this program quite neat as I would have thought that those programs will at least indicate where Lavasoft WAS. It doesn't

I'm a volunteer here and not employed by Lavasoft.

According to my contact person at Lavasoft, Ad-Aware is designed to not scan .pst files during boot scans. There can be bugs in the program, but Lavasoft can't investigate what happened without the log files, sorry.

Since the .pst file is large, it's high probability that some pieces of it is overwritten rather fast after a deletion and then it's impossible for a file rescuing program to recreate it.

Benjamin Philipp · February 9, 2017

ARE. YOU. . KIDDING ME?!?!?!?

What the ??????

I literally just installed it.

It has already ##### my system.

I'm sorry, I usually restrain myself from swearing, but I haven't experienced such an awful case of harmful misguidedness paired with overbearing, arrogant pretentiousness, ending in reckless destruction in a LONG time.

And this from a self-proclaimed "Awesome" software that is supposed to PROTECT your files.

I'll try and dial it down now.

It began scanning my system immediately after installing, IN THE BACKGROUND, WITHOUT ASKING ME.

I immediately opened the panel and turned off real time protection. I didn't know there was a scan running in the background.

When further DELETION notices popped up, I frantically went back and saw there was a scan running, deleting all sorts of files.

THIS IS SO NOT ACCEPTABLE!!!!!

At NO POINT could I have prevented this.

There is no implicit recovery, since this piece of sheet cake software made the arrogant decision it was best not only to delete the files, but also not to ask the HUMAN BEING sitting right there, dazzled, blinded by a horror show of destruction unfolding right before their eyes.

It felt like I was moving in slow motion. This is a seconds old install, after all, I had no idea where to click to stop this. I found it rather quickly, but the damage was done.

You can NOT combine those circumstances. You absolutely can not.

I am feeling sick to the stomach with frustration, anger, lack of understanding and dismay. I can hardly think straight.

I know Lavasoft won't read this, but maybe this can be a warning for others.

I will remove the software that proved incomparably more dangerous than anything I could've hoped it to block in the first place and see if I can pick up the pieces and try to piece my system back together from backups.

My personal advice is decidedly:

Do not install Ad-Aware. It will perform a scan without warning, before you can configure it. It will delete files without warning.

It will have false positives and overzealous overreactions.

I am utterly dismayed and disappointed in humanity.

How can a security provider do such a thing?

It is beyond belief.

CeciliaB · February 9, 2017

Hi Benjamin,

Please, respect the rules of the forum and let it be family-friendly.

I'll make my contact person at Lavasoft read your post.

Before uninstalling Ad-Aware you should check if there are any files in the quarantine that can be restored.

I've noticed that many antivirus programs start scanning the computer automatically after the installation nowadays.

CeciliaB · February 10, 2017

Hi again Benjamin,

After discussing your post with Lavasoft:

It's correct that Ad-Aware, as many other antivirus programs, do a scan after installation. But it won't delete files automatically, it only displays a list of proposed actions for you and then it's up to you to decide what action you want, e.g. ignore or quarantine.

Welcome to adaware forum

Ad-Aware 11 deleted all my Outlook PST files, I can't recover them

Question

vik976 1

Share this post

Link to post

Share on other sites

25 answers to this question

Recommended Posts

CeciliaB 475

Share this post

Link to post

Share on other sites

Robsav 4

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post

Share on other sites

eMarky 0

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post

Share on other sites

eMarky 0

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post

Share on other sites

eMarky 0

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post

Share on other sites

vik976 1

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post

Share on other sites

vik976 1

Share this post

Link to post

Share on other sites

rkellock 0

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post

Share on other sites

towerbuilder12 0

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post

Share on other sites

Isato 0

Share this post

Link to post

Share on other sites

CeciliaB 475

Share this post

Link to post