Ask questions via twitter! Message any question to @answers on twitter. We'll publish the question and send you a reply each time there's a new answer.
Next Question

Answered Question

pebbles pebbles
 
M$1 December 20, 2008 03:59 AM

Why do anti-virus/spyware/malware applications quarantine bad files instead of deleting them and (see details)

what happens to those files when the program is uninstalled?
Interesting Question?  Yes (0)   No (0)   
RSS
 
 

Best Answer  Chosen by Asker

ravi ravi
 
 December 20, 2008 04:26 AM
Quarantine is done by isolating the suspicious files to:

a) Stop it from infecting other disk partitions and files.

b) Stop other applications or the operating system from using these files.

Many a times, though a infected file is detected or is wrongly classified as one, it is quarantined to check if the new updates can help to point which kind of malicious ware it is and so that the antivirus can apply a comprehensive remedy rather than simply deleting those files.

Once quarantined, those files are moved to a specific directory, which is may be either, removed on uninstalling the antivirus software or those files will be fragmented in a way not to be effective but be useful for further investigation, some antivirus softwares's uninstaller does not delete those folders.
You have to use applications like Revo Uninstaller to completely remove an installed application including those files and folders that were intended to be left undeleted.
Source(s):
1) http://forum.avira.com/wbb/index.php?page=Thread&threadID=75648

2) http://security-antivirus-software.suite101.com/article.cfm/protect_your_co...

3) http://books.google.com/books?id=nHPzTZ27a5UC&pg=PA155&lpg=PA155&am...

3) http://googlesystem.blogspot.com/2008/01/completely-uninstalling-windows.ht...



Helpful Answer?  (1)   (0)    Tip ravi for this answer
Permalink | Report
   Reply  
 
 

Other Answers (14)

Sort By
romuo romuo
 
December 20, 2008 04:07 AM
well first of all you can delete them outright without quarantining them - but they do it in case they can't remove the virus from a file. - it's effectively eliminated when in quarantine.
-----
F-PROT Antivirus quarantines all uncleanable infected/suspicious files found to avoid spreading the infection. These files will be quarantined until a new version of virus signature file is released to disinfect them.

Note: The quarantined files along with the backed up files and the settings files are removed during the uninstallation of the program. .
Source(s):
http://www.f-prot.com/support/windows/fpwin_faq/479.html


Helpful Answer?  (0)   (0)    Tip romuo for this answer
Permalink | Report
   Reply  
 
 
nadiraziz nadiraziz
 
December 20, 2008 04:07 AM
The quarantined items are encoded and placed into a location where they can't do any damage. If you uninstall the antivirus program, any fragments that are left will be harmless, but they might still take up space on your computer. Your best bet to delete these things is through the application itself.
For some software, when you delete the program using its official deletion process it should either shred the file or ask you what you want to do with any files in the folder.

Helpful Answer?  (0)   (0)    Tip nadiraziz for this answer
Permalink | Report
   Reply  
 
 
univrsltra... univrsltra...
 
December 20, 2008 04:12 AM
It probably varies by antivirus program, but typically an antivirus program will "quarantine" a file rather than just deleting it when deleting it may cause the infected component to break. Many viruses will insert themselves into system files, so deleting those files will cause your computer to stop working. Instead, the antivirus moves those files to a safe place where they can't do any damage, but can still be used by the program that needs them.

When you uninstall the program, the quarantined files should be removed.
Source(s):
http://antivirus.vt.edu/help/quarantine.asp
http://www.f-prot.com/support/windows/fpwin_faq/392.html


Helpful Answer?  (0)   (0)    Tip univrsltransl8r for this answer
Permalink | Report
   Reply  
 
 
kolimaehal kolimaehal
 
December 20, 2008 04:13 AM
A file is quarantined when a file that may be needed to help another program function, has become infected with a virus/spyware. Rather than deleting the file completely and risk preventing needed programs from being able to run or perform to their full capacity, the file is stored in Quarantine. This stops the infection from invading the computer and also lets programs that need infected files to run to their fullest extent. Once a virus/spyware definition have been updated to include the strain of virus/spyware that has attacked the system, the files will be cleaned, removed from Quarantine and moved back to their proper place, disinfected.
Source(s):
Computer Science Degree with my concentration on computer security.


Helpful Answer?  (0)   (0)    Tip kolimaehal for this answer
Permalink | Report
   Reply  
 
 
answerman answerman
 
December 20, 2008 04:14 AM
One important reason to quarantine files is because you might actually need the file. If the current anti-virus software can't clean the virus out, another program might be able to.

If the file was irreplaceable, you might want to try a few different things before just outright deleting it.

Helpful Answer?  (0)   (0)    Tip answerman for this answer
Permalink | Report
   Reply  
 
 
adamparish adamparish
 
December 20, 2008 04:14 AM
By quarantining files the software allows you, the user, to research the virus. Likewise, once you understand the problem you can hopefully prevent yourself from being impacted again.

Helpful Answer?  (0)   (0)    Tip adamparish for this answer
Permalink | Report
   Reply  
 
 
garfield garfield
 
December 20, 2008 04:24 AM
once the applications categorize the files as bad one, they quarantine them to make sure the system performs proper. if there is no issues found for a reasonable period after quarantining the bad files, they can be deleted permanently.This is done for your safety, because sometimes deleting files classified as bad might affect the performance of the system
Source(s):
personal


Helpful Answer?  (0)   (0)    Tip garfield for this answer
Permalink | Report
   Reply  
 
 
jeffs jeffs
 
December 20, 2008 04:29 AM
Because they cannot guarantee these files are bad. Mcafee occasionaly flags tools I use for work as Malware, like VNC. If it deleted these programs automatically I would be very angry.

Helpful Answer?  (1)   (0)    Tip jeffs for this answer
Permalink | Report
   Reply  
 
 
px px
 
December 20, 2008 04:36 AM
it's so they can charge you money to further analyze the newest virus that just massacred your computer network before being caught by the latest update.

the quarantine is left like a deadly toxic pit on your disk.
Source(s):
capitalism $$$


Helpful Answer?  (0)   (0)    Tip px for this answer
Permalink | Report
   Reply  
 
 
malikg malikg
 
December 20, 2008 04:36 AM
because sometimes those bad files can be that the user wants to have them they put them there them self. quarantine lets you bring back those files but when they are in quarantine they won't be able to access your computer or run with you bringing them back to life first.

Helpful Answer?  (0)   (0)    Tip malikg for this answer
Permalink | Report
   Reply  
 
 
xds xds
 
December 20, 2008 05:16 AM
The main reasoning for Anti-Virus applications quarantining "bad" (Malicious) files is so the user doesn't loose any valuable information by mistake.

If every Anti-Virus program didn't have any way of quarantining rogue files then data redundancy in the real world would surely sufer.

Even though however Anti-Virus programs have MD5 and other file fingerprint identification methods, there still exists a chance that the file is still of some form of value to its host user.

I would strongly recommend against not using quarantining if on a personal computer, A corporate or enterprise situation might be a little different as rogue worm files can spread rapidly over a network if not deleted or "hatcheted"(As i like to call it) promptly. However this is also rarely the most practical advise.
Source(s):
25 Years IT Security experience and my ISC2 certification.


Helpful Answer?  (0)   (0)    Tip xds for this answer
Permalink | Report
   Reply  
 
 
xds xds
 
December 20, 2008 05:18 AM - New Source
Just another quick note.

I would also strongly recommend against using any type of "variant submission" or "file submission" with some Anti-Virus vendor software unless you truly believe the file to be free of ANY and ALL 'per user information' or "Unique Information" identifying you(anyone that uses your computer) or your computer specifications and installed software.

Report
 
 
bucabay bucabay
 
December 20, 2008 05:25 AM
The files are kept in quarantine mainly so that you can try and clean them the next time your virus definitions is updated.

Some files may be important to your system or important to you (like an important document), so it would not be good to delete them.

Antivirus systems are also not 100% accurate. They may often see uninfected files as infected, which is why it is better to put them in quarantine rather then deleting them.

Helpful Answer?  (2)   (0)    Tip bucabay for this answer
Permalink | Report
   Reply  
 
 
faizankhan... faizankhan...
 
December 20, 2008 05:37 AM
because some virus files locked and Injected with operatiing system file like
explorer.exe and other running system exe's. It means it will need to reboot the syetem immediately

Helpful Answer?  (0)   (0)    Tip faizankhan99 for this answer
Permalink | Report
   Reply  
 
 
darkego darkego
 
December 21, 2008 01:11 AM
The file is quarantined so you can check it out, and see if the file is something that just appears to be a threat, and is actually something you need. Prevents deletion of important files.

Helpful Answer?  (0)   (0)    Tip darkego for this answer
Permalink | Report
   Reply  
 
 

Answer this Question

How tips and payments work

This question has already been resolved. You may add an answer to it but you will not be eligible to win best answer or any associated tips.

Related Questions

View All Security Questions

Ask a Question


140 characters left
Top of Page
Buy Mahalo Dollars with Credit Card or PayPal

Top Members

This Week All Time
  • cfinke
    cfinke
    2nd Degree Black Belt
    28250 Points
    M$29.75 Earned
  • bunnyphuph...
    bunnyphuph...
    2nd Degree Black Belt
    21747 Points
    M$773.74 Earned
  • opher
    opher
    Purple Belt with a Brown Tip
    6388 Points
    M$244.49 Earned
   See All
 

Most Popular Tags

mahalo(1814)
twitter(983)
music(511)
iphone(489)
google(395)
online(377)
food(347)
internet(316)
money(294)
beer(291)
movies(290)
facebook(288)
apple(260)
answers(248)
aotd(235)
free(234)
health(231)
video(230)
dog(219)
windows(209)
   See All
 

Categories

Welcome New Members


 
 
Mahalo Dollars are the currency of Mahalo Answers.

Each Mahalo Dollar costs $1.

Once you earn more than 40 Mahalo Dollars, you can request to be paid via PayPal. Each Mahalo Dollar is currently worth $0.75 when paid out via PayPal. Learn More

 
 

Please log in to use this function.

Answers Home | Ask a Question | Earn Points | How Tips Work | Widget