Member Avatar for DaveSW

Recently one of my computers was infected with a vbs worm that spread through a backup folder adding an activeX script to my html pages. When I installed and ran AVG it deleted most of the files.Is there any way to undelete them? I can then remove the code by hand.... (all 450 files :( )

  • 3 Contributors
  • 4 Replies
  • 204 Views
  • 10 Months Discussion Span
  • Latest Post Latest Post by DaveSW

Dani AI

Generated

Quick practical addendum (builds on and ’s suggestions):

First, stop writing to the affected disk. Continued use makes file-recovery much harder. Check AVG’s quarantine/virus‑vault and the AVG scan log first — if files were quarantined you can restore them to a safe folder and re‑scan on a clean machine. If AVG permanently deleted them, recovery success depends on whether those sectors were overwritten or securely wiped.

Safe recovery workflow

  • Image the affected volume and work on the image, not the original (tools like dd/forensic imagers can do this).
  • Run file‑carving / undelete tools against the image and recover files to a separate drive.
  • Scan any recovered files on a clean, up‑to‑date system before restoring them to production.
    If recovered files are corrupted or the AV zeroed them, you may have to rely on copies from the live site or backups.

Automating cleanup of injected ActiveX/script across many HTML files

  • Always work on copies and test on a small subset first.
  • On Windows you can use PowerShell to remove a known injected block (replace the placeholder markers with the actual injection pattern):
Get-ChildItem -Path C:\webcopy -Recurse -Filter *.html |
  ForEach-Object {
    $t = Get-Content $_.FullName -Raw
    $t = $t -replace '(?s)<!--INJECTED_START-->.*?<!--INJECTED_END-->',''
    Set-Content -Path $_.FullName -Value $t -Encoding UTF8
  }
  • On Unix-like systems a tested grep + sed or a small Perl one‑liner can do the same; again, operate on copies.

Prevention and hardening
Keep backups outside the webroot (and offline), use version control for site content, disable script execution in backup directories, and scan backups before restoring. Configure antivirus to quarantine rather than auto‑delete when possible. If recovery is critical and DIY attempts fail, consult a professional data‑recovery service.

Recommended Answers

All 4 Replies

Member Avatar for DaveSW

Thanks DLH6213 I've downloaded it and I'll try it after breakfast! ;)

Member Avatar for yutao

Hello,
I suppose using Data Recovery tool - DataRecoveryWizard.
It is imho the best one among it's family. Easy to use and powerful.
It actually never failed me before. Recommended!

http://www.easeus.com/

Member Avatar for DaveSW

Actually I was looking for a simple method, rather than data recovery. I just grabbed the files off the 'live' sites to replace them, rather than mess about restoring them.
Thanks for all the suggestions anyway.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.