Printable View
maybe one of you can shed some light on why anti virus software quarantines instead of deleting?
what it does when it does this?
why can it quarantine and not delete the file?
i recently had a virus called jeefo (see other thread inthis forum), NAV could not delted the file as it said it didnt have access to the file. after doing a full system scan, i found 6 infected files which i had the option to quarantine only. NAV took about 20 mins or so to quarantine these 6 files! is that normal?
If I am correct, quarinteing removes the file and it's componets and immobilizes the virus and puts it in a quarintine folder.
"Quarantine-files are used to isolate and backup items detected during the scan, giving you an option to reinstall them at a later time.
Items moved to the quarantine folder will be encrypted and compressed, and can only be read and restored using the built in quarantine-manager. "-from Ad-Aware help file...
It will give you the option to quarantine instead of just delete so you can submit it to them, or if it really isn't a virus... etc.Quote:
maybe one of you can shed some light on why anti virus software quarantines instead of deleting?
what it does when it does this?
why can it quarantine and not delete the file?
Example: You download a security tool that your AV deems a "hack tool". You know what it does, and still want to use it because you know it won't do any harm to your computer.
You can configure your AV to automatically delete it rather than just quarantine it.
try scanning in safe mode.
If its a system file try the the "SFC" command to repair it.
Try going into NAV options, it should have an option to delete instead or quartiene.
It may be that the file is a protected system file that you cannot alter. If your not logged under your admin account you may want to try that. Also, you may try manually deleteing the file. Good luck
Im guessing NAV, read a bit more closely...lolQuote:
NAV could not delted the file as it said it didnt have access to the file. after doing a full system scan, i found 6 infected files which i had the option to quarantine only. NAV took about 20 mins or so to quarantine these 6 files! is that normal?
In my NAV you go to options-autoprotect-and its under what to do when a virus is found, you can choose to have it delet it there.
Good rule of thumb (and lately I seem to be all thumbs), exercise due caution when configuring any piece of software to automatically delete files. Even AV/security software generates false positives on the odd occasion, which can make life difficult if that false positive is a critical system file, or a unique document that you were going to back up, soon ... yeah.
Kinda reminds me of the time I had that old 40-meg mfm drive. I just found a cool backup utility and was going to take it home and back up that dang thing. Got home, drive was DOA.
It was also two days off warranty.
Go figure.
Yea, thats the purpose of the quarentiene option, if you need it you can always get it back....
Good idea to quarantine it if you have no idea if its a file that the system needs. Unless you are absolutely sure that the file is really infected and its has no use other than for the virus then go ahead and delete. if not then you need to decide if you have any need for the file. Options to consider would to replace the file with a clean version and delete the infected one. also quarantining a file will allow you to try to clean the file later when newer updates are released from the AV company. Also a someone mentioned, false positives might be generated and quaratine is better if that happens as you can decide yourself and not rely on the program to delete files that might be of use.
anyway, quaratine protects your system as the file cannot be accessed any more once quaratined. the file is isolated and prevented from infecting other files and spreading.
in your case where the fle is quarntined and cannot be deleted, it could be that the file is in use. you can try to boot in safe mode or from a boot floppy and try deleting the file from there.
NAV comes with an unsupported tool that deletes quarantined files. Our mail relays had a whole bunch of virus's on them due to the quarantine clause even though it is set to try to repair, then delete. There is something about since its an email it just quarantines and not deletes... o well...
Now the reason for my post! If you pop in your NAV CD (or have it locally like I do) go to tools, NOSUPRT, then to QUARDEL. Open this up. Simple command line deleter that does very well. Now only do this if you know that you can delete the files for sure.
This program has 6 switches
/Q Delete Quarantine
/R Delete Repaired Items
/B Delete Backup Items
/A Delete All Quarantine
/I interactive results
/D:[days] to delete files older than the given days
I actually found out about this tool searching the symantec knowledge base, and it has proved valuable to me! Hope this helps some other folks out!!
The quarentine is there so that if u want the file u can get it back, and also some files that cant be deleted will be quarentined, and another reason is that some files are infested so seriously and cant be repaired so they will be quarentined too.
:)