I understand that most antiviruses by default quarantine infected files. I have changed it to remove all infected files immediately. Would this cause more harm than good?


2 Answers 2


I choose for quarantine because of false positives: the AV software can incorrectly flag a file as maliciuous or unwanted.

If it's quarantined, you can retrieve if from the quarantine and usually tell the AV to ignore the file from then on.
You could not do that if the file has been deleted.

  • I guess in business environments false positives would be common (because of custom software) but for home users would it be better to set it to remove the infected files immediately?
    – Jay
    Aug 3, 2014 at 4:40
  • @Jay No. You have no advantage removing them immediately. They don't do any harm in quarantine. And you still have the optional disadvantage I described. 'Home user' is too broad a definition. There are e.g. utilities you may want to download that trigger the AV. Not often, but I had them.
    – user13695
    Aug 3, 2014 at 14:17
  • So when should you choose the default remove option? According to the help page for MSE (windows.microsoft.com/en-us/windows/understanding-alert-levels) it says that threats identified as high or severe should be removed immediately. What alert levels would the utilities trigger?
    – Jay
    Aug 4, 2014 at 9:25

An excellent question, from previous experience a virus rewrote my Windows bootloader and the virus was remove later by my antivirus, consequently leaving the OS unbootable. Quarantining virus/malware is more advisable in my opinion due to if the file needs to be recovered later it can.

The idea of quarantine is like ("trapping a zombie in a jail") e.g. the antivirus will store the virus in it's likely encrypted folder where ONLY the antivirus can read it. To answer your question, yes it could cause more harm removing the files immediately (The virus infections could be root/admin level).

  • 2
    If the virus rewrote the bootloader, and somehow the system couldn't boot without that virus, wouldn't moving the file with the virus have prevented the system from booting, as well? How do antiviruses deal with this, where lower-level system components rely on (possibly) infected files to function?
    – trysis
    Aug 3, 2014 at 2:01
  • Did the AV remove the virus from the bootloader or did it remove the bootloader? You also said it rewrote the bootloader so there's nothing that the AV can do to recover it.
    – Jay
    Aug 3, 2014 at 4:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .