Jump to content

Recommended Posts

Posted

When I delete a file from the quarantine by right clicking on the file in the EIS UI for quarantine , will this file removed from my PC? Or will it only removed from my quarantine?

  • Administrators
Posted

If a file is in quarantine it means that it was detected and cleaned unless you quarantined it manually. That said, it should not exist anywhere but in quarantine in an encrypted form. There are no benefits of removing files from quarantine permanently except that you will save a few kB or MB of disk space, depending on the size of the quarantined files that you delete.

Posted
5 hours ago, Marcos said:

That said, it should not exist anywhere but in quarantine

If the file was "cleaned", will exists in 2 places  : in quarantine,( the original infected one) and in original place (the cleaned one). Both of them will have the same name.

Very difficult to figure out what happened.

  • Administrators
Posted
Quote

If the file was "cleaned", will exists in 2 places  : in quarantine,( the original infected one) and in original place (the cleaned one). Both of them will have the same name. 

Not really. Most of malware are trojans which do not contain any benign original code so they are cleaned by deletion. Cleaning such malware must remove it from its original location completely. File infecting viruses and VBA macro malware make up a very small group of cleanable malware. In such case, the malicious part of the code is removed/sanitized and a copy of the original file is placed in quarantine in an encrypted form in case one would need to restore it at a later time.

Posted
3 hours ago, Marcos said:

Not really [...] In such case, the malicious part of the code is removed/sanitized and a copy of the original file is placed in quarantine in an encrypted form in case one would need to restore it at a later time.

I do not understand "Not really". In the situation mentioned by you, the user would have 2 identical files (by name); one sanitized , in the original location and one "original"  placed in quarantine, BOTH OF THEM WITH THE SAME NAME.

So why "not really"????

  • Administrators
Posted

Of course that if a backup of the original file is created, the file will have the same name as the original file. If I get "mypersonalcv.docx" infected with a macro virus and "somerandomname.docx" would appear in quarantine, that would be a mess that would help nobody.

Since everything has been said on this topic and unclear things were explained, we'll draw this topic to a close.

  • Marcos locked this topic
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...