0

This question already has an answer here:

What is the quarantine of antivirus software? Is it just some strict user/group rights and changing file extension or is it an actual moving the file(s) to a virtual environment?

How is this software preventing a virus from executing or breaking out of such a sandbox/quarantine?

marked as duplicate by Neil Smithline, techraf, Matthew, sebastian nielsen, schroeder Jul 8 '16 at 12:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

Many AV function the same way but may have different specific mechanisms of action. In general they work like this:

When MBAM removes an item such as a file or a Registry entry and "quarantines" the item, it is removed from its original location and stored in a protected container. Both the removed item and it location are stored in the container in a way that the file is rendered inert and the location of where it was removed from is also restored. Thus if it is deemed to be a False Positive declaration, the item removed (file or Registry entry) can be restored to its original and working state. If however the item(s) are deemed to be justly removed for malicious activity, the quarantine can be "dumped" such that can not be restored and the container no longer holds any more quarantined items or you can choose to be selective on what is dumped from quarantine.

SOURCE

There is also another post on the InfoSec SE that has some additional info:

In most anti-virus programs, the quarantine files are stored in internal binary formats. Since there is no physical connection between the infector file to your system (your anti-virus program works as the storage format is also a plus point), it is not dangerous.

Not the answer you're looking for? Browse other questions tagged or ask your own question.