Recover 99% of files from BoL Vpred infection

You are free to have this leak but bear in mind, it's not mine, so don't bother me if the links/program/source/whatever stop working. I take no responsibility of this, use at your own risk.
~Sozin

---

---

Since Vpred from BoL got hacked a bunch of malicious commands were launched, deleting both your programs and personal data (at least desktop, documents and standard user folders).
In the official topic is said to do a system restore to try to recover these files. In few words:
"You" deleted personal files, not only system ones, but also files like .doc, .xls, .txt etc etc. These files are not recovered by default with system restore.
DO NOT USE SYSTEM RESTORE! It will only revert windows registry and installed softwares to the given point.
Doing so not only you won't recover your personal files, but you also will write on random "free" space on your hard disk, with the risk to compromise your deleted files forever.
When you delete files with the default methods (like hitting canc, and launching these commands too) files are not really deleted, just the space they were using is marked as "free space". When you write new things/files, random space is taken, with the risk to "overwrite" your poor files, loosing your last chance to recover them.
In fact, some softwares are able to scan your free space to find old and deleted files from your hard disk, so you can just give them a try.


If you did nothing since the loss of files, you will be able to recover almost everything (99% or even 100%, it all depends on luck and how much you wrote on the HDD since commands got deployed).
Note: with this method you only recover your personal data. If you want to give a try restoring your installed software and windows registry, you can save these datas to another drive, plug your hdd back and then use the system restore option. This way you already analyzed the free space so you won't loose anything else while system restore will run.