Jump to content


Photo

Malware: quarantine vs delete


  • Please log in to reply
3 replies to this topic

#1 Sleddog

Sleddog

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 06 July 2006 - 05:17 PM



Hi. While running the system scan for my home edition of Ad-aware, I've been advised that viruses were found, and these were identified as malware. The application recommended that I send the malware to the quarantine chest, which I did, and there does not seem to be any further problem. My question is why not just delete the malware and rid the system of it rather than keep it in quarantine? Is there a possible problem(s) associated with deleting certain types of malware? Just want to improve my understanding of this area. Thanks very much.

#2 LS CalamityJane

LS CalamityJane

    Former Lavasoft Staff

  • Members
  • PipPipPip
  • 8814 posts

Posted 07 July 2006 - 05:04 PM



Is there a possible problem(s) associated with deleting certain types of malware?

Yes. This is especially true in removal of spyware and parasites. Sometimes their removal can cause something to not work right. If it is in quarantine, it cannot run from there, but it can be restored to get the program or PC working while other methods of removal are investigated. Or maybe you removed something that later you decide you wish you had not removed. Also there might be an occasional false positive. I've seen viruses infect a system file like Explorer.exe and the AV detected the infection but instead of curing it, deleted Explorer.exe! That's just one example. Putting items in quarantine is the safest way to remove malware. If your PC and your programs are running correctly after a reasonable period of time (say, two weeks), then you can clean out the quarantine files.

This is also the reason why these days, we advise those who are disinfecting a computer to NOT turn off the System restore until after the system is clean and working properly. Disabling system restore removes all prior restore points. If something should go wrong during the removal, you have no prior working point to go back to. Sometimes, if a PC is rendered unworkable during malware removal, it would be desirable to have any working condition to go back to (even if an infected one), so that you could at least work through the problem and not be left with a machine dead in the water. So as with quarantined files, clear your system restore after the PC is clean. Turn it off, reboot and turn it right back on again to flush any infected restore backups and to create a fresh clean restore point.
Please do NOT send Private Messages to Staff or helpers to request assistance! We do not give a personal support via PM The way to request help is to post a NEW TOPIC in the appropriate forum.

Look for the *New Topic* Button near the top right when viewing the forums.

Here in the forums, replies are posted to topics only. Thank you for your understanding and cooperation!
Plus and Pro Ad-Aware users (only) may use the Support Center for personal assistance:
Support Center


Microsoft MVP/Windows - Security 2003-2009

#3 Dubb

Dubb

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 30 July 2006 - 10:56 PM

I have items quarantined clear back from March. I run the scan about 4 times a month so I have a LOT in quarantine. I don't know much about this stuff. I haven't talked to the right person I guess who can tell me what to do. Should I remove all items in quarantine from my pc up intil a couple weeks ago? My computer SEEMS to be running fine.. Thanks

#4 LS CalamityJane

LS CalamityJane

    Former Lavasoft Staff

  • Members
  • PipPipPip
  • 8814 posts

Posted 30 July 2006 - 11:26 PM

Should I remove all items in quarantine from my pc up intil a couple weeks ago? My computer SEEMS to be running fine.. Thanks

Yes, that sounds like a reasonable period of time :)
Please do NOT send Private Messages to Staff or helpers to request assistance! We do not give a personal support via PM The way to request help is to post a NEW TOPIC in the appropriate forum.

Look for the *New Topic* Button near the top right when viewing the forums.

Here in the forums, replies are posted to topics only. Thank you for your understanding and cooperation!
Plus and Pro Ad-Aware users (only) may use the Support Center for personal assistance:
Support Center


Microsoft MVP/Windows - Security 2003-2009




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users