Quarantine Failed - Cannot Restore

[krisku]

Immunet obviously found some malware in a file containing archived email messages from Outlook (archive.pst) and tried to quarantine the file. That probably failed because the file was open in Outlook, but somehow the archive.pst got quarantined anyway.

 

Now Outlook complains that archive.pst is missing, but when I look in Immunet's quarantined items, I can only find an archive.pst with event type "Quarantine Failed" and no way of restoring the file!!! Something has gone awry here..

 

In the quarantine folder I can see a large file that based on the size ought to be the missing archive.pst, but I have no way of restoring it. Can you help?

 

SDT dump is attached.

Immunet_Support_Tool_2010_08_11_09_40_36.zip

[millard@immunet.com]

Immunet obviously found some malware in a file containing archived email messages from Outlook (archive.pst) and tried to quarantine the file. That probably failed because the file was open in Outlook, but somehow the archive.pst got quarantined anyway.

 

Now Outlook complains that archive.pst is missing, but when I look in Immunet's quarantined items, I can only find an archive.pst with event type "Quarantine Failed" and no way of restoring the file!!! Something has gone awry here..

 

In the quarantine folder I can see a large file that based on the size ought to be the missing archive.pst, but I have no way of restoring it. Can you help?

 

SDT dump is attached.

 

It looks like the archive.pst is supposed to be in %userprofile%\appdata\local\microsoft\Outlook. First you'll want to see if the file exists there. If it is, then maybe it's corrupt. This is not likely the situation, but probably me hoping that we didn't screw this up. The more likely scenario is that there is a bug in which we quarantined the file, but did not write the record to the database. If you can email me (millard at immunet.com) the qrt file you see in the Quarantine folder, I can try and restore it or get the developer to do it.

 

--Millard