Restoring files from quaraintine failed.

[Tio 0]

Hello, after an in-depth scan I got some files to the quarantine zone(PUA) when I tried to restore them only 1 file got restored others failed.. I tried to do it manually and it works "Restore to". It might be a silly question but why did the initial "Restore" failed and manualy works, does it have to do with the danger level of the quarantined file ? 

[Marcos 5,128]

Were you able to restore a file to its original location? If so, further investigation would be needed so I'd suggest raising a support ticket. Normally it could fail because of insufficient write permissions to the folder.

[Tio 0]

1 hour ago, Marcos said:

Were you able to restore a file to its original location? If so, further investigation would be needed so I'd suggest raising a support ticket. Normally it could fail because of insufficient write permissions to the folder.

I restored manually(restore to) one of the files that couldn't be restored to the original file just to check if it works then put it back to quarantine and then tried to restore it via the just "Restore" button and it restored it. One thing I noticed, don't know if it matters that location changed(at least the name) initially when I tried to find where the pup's were located it was under "c:\Documents and settings\user" when I tried to search it couldn't find it, googled it turns out that its ""c:\user\user"(microsoft changed it I guess). So the file I restored manually when put it back on quarantine was under the new name, which as I said can be restored w/o any issues. 

Just checked I had total of 8 files cleaned, one was restored , the other 7 failed. The one that got restored automatically is also "c:\user\user". Out of the 7 failed , tired to restore manually 1 - worked , changed location name from "c:\doc and set to c:\user\user. All of the 8 files are in the same folder. Somehow  7 had c:\documents and settings\ before it reached the final destination. 

[itman 1,703]

FYI;

Quote

In Windows 10, C:\Documents & Settings is not a real folder but a Junction point that is pointed at C:\Users. You can see that by running this command. Code: [View] dir C:\ /al. and it is normally hidden.

I just checked my Eset Quarantine file and nothing is stored there using C:\Documents & Settings path prefix.

It appears that if Win ExplorerView is set to show "hidden folders and files," you will no longer see any reference to C:\Documents & Settings.

If Eset Quarantine is not auto converting C:\Documents & Settings to C:\Users for files stored there, I would say this is a bug.

Edited May 11 by itman

[Tio 0]

2 hours ago, itman said:

FYI;

I just checked my Eset Quarantine file and nothing is stored there using C:\Documents & Settings path prefix.

It appears that if Win ExplorerView is set to show "hidden folders and files," you will no longer see any reference to C:\Documents & Settings.

If Eset Quarantine is not auto converting C:\Documents & Settings to C:\Users for files stored there, I would say this is a bug.

Well usually I have 15 pua's which I know of, this time came out 30, when I checked them they were basically the previous 15 x2. I mean I've found nothing new just the previous 15 copied.. so I guess its a bug , I hope so at least  . Anyways I restored the files manually from documents and settings to the right place. Couple of months ago i was looking for my floating files app\data something that I believe and I was messing around "Show hidden files option" 

[Tio 0]

Just now, Tio said:

If Eset Quarantine is not auto converting C:\Documents & Settings to C:\Users for files stored there, I would say this is a bug.

Btw do you reckon its a bug or some kind of malware/virus ? 

[itman 1,703]

Further analysis yields that the Documents & Settings folder in Win 10/11 is located in C:\Users\xxxxx\Appdata\Local folder. It was created for apps only compatible with older Win OS versions. It is a hidden OS folder only accessible by Windows. Hence, the inability to restore files to there via Eset Quarantine Restore option.

Why Eset would be quarantining files from Documents & Settings folder is beyond me.

[Tio 0]

6 hours ago, itman said:

Further analysis yields that the Documents & Settings folder in Win 10/11 is located in C:\Users\xxxxx\Appdata\Local folder. It was created for apps only compatible with older Win OS versions. It is a hidden OS folder only accessible by Windows. Hence, the inability to restore files to there via Eset Quarantine Restore option.

Why Eset would be quarantining files from Documents & Settings folder is beyond me.

Perhaps it has something to do with the weird copied doubled PUA's, as I mentioned from 15 to 30, literally the same file name but in different location( documents and settings). Funny the mirrored one that weren't in the doc/set location weren't cleaned just detected, but those in doc and settings were automatically cleaned even though I have the the wait for my command after scan ticked on

[Marcos 5,128]

This is an expected behavior. Files can only be restored to actual folders. Restoring to hard links, symbolic links or junction points is not allowed for security reasons.

[Tio 0]

10 hours ago, Marcos said:

This is an expected behavior. Files can only be restored to actual folders. Restoring to hard links, symbolic links or junction points is not allowed for security reasons.

I restored them to an actual folder. It was just weird that the files were in c:\documents and settings, had to google it to find out it does not exist anymore 

[Marcos 5,128]

c:\documents and settings is a hidden junction point for c:\users. Most likely you have display of hidden files disabled.

[Tio 0]

17 hours ago, Marcos said:

c:\documents and settings is a hidden junction point for c:\users. Most likely you have display of hidden files disabled.

Thanks !