Skip to main content
18 votes
Accepted

How to remove quarantined virus securely?

Although a lot depends on the anti-virus software, I'll try to answer your questions: 1) What is the best practice and secure way to deal with them? Delete from quarantine, or let them in there? ...
pri's user avatar
  • 4,446
17 votes
Accepted

How AV software makes sure quarantined files never get executed?

There are a couple ways an antivirus program might go about preventing the execution of a quarantined file: Hold it open for exclusive access. It can simply use the normal CreateFile API and pass ...
Ben N's user avatar
  • 2,501
16 votes

How to remove quarantined virus securely?

A computer virus is just a file, is not something that will be magically activated by itself and wreak havoc around. You can treat it just like a normal file: delete it and it's gone. If you ...
ThoriumBR's user avatar
  • 54.5k
6 votes

How AV software makes sure quarantined files never get executed?

The quarantine AV features mentioned in the reply before make sure that the file cannot be executed or accessed while under quarantine. So no, as long as the antivirus is working, there is no danger ...
Overmind's user avatar
  • 8,899
3 votes

As a Software Industry Editor, how to avoid my software being quarantined?

Most AV vendors have some form of a "Trusted Software Vendor List". Any binary signed by a vendor on this list automatically gets trusted, so you do not have to beg for each binary to be whitelisted. ...
schroeder's user avatar
  • 131k
3 votes
Accepted

Are there differences between McAfee quarantine and other AV quarantining mechanisms?

See here - https://kc.mcafee.com/corporate/index?page=content&id=KB72755&pmv=print Quarantined files (.BUP format) are an archive file containing two files - the quarantined file "file_0" and ...
Hector's user avatar
  • 11k
2 votes

How AV software makes sure quarantined files never get executed?

Suppose you have an important file(say, some presentation) that is flagged by your antivirus as "malicious". You do not wish to delete it(it's important after all, even if it is malicious!), but you ...
pri's user avatar
  • 4,446
2 votes

Security Tools - File Encryption vs Corruption

In the case of a false positive, you want the operation to be reversible. It may also be useful for forensics to be able to analyze the original sample if it was correctly quarantined but proved to ...
tripleee's user avatar
  • 223
2 votes
Accepted

How can I improve my sheep dipping process?

You could convert it using Linux, or FreeBSD, and OpenOffice. Install a VM with Linux or FreeBSD, or any OS that isn't Windows and have a OpenOffice release. Share a folder between the VM and the host,...
ThoriumBR's user avatar
  • 54.5k
1 vote
Accepted

Create quarantine/safe partition on external hard drive

Use an encrypted volume, like VeraCrypt. That way, you need to enter the decryption password before anything can transfer. However, your risk is low without such a measure. Viruses don't run around on ...
schroeder's user avatar
  • 131k
1 vote

User Access to Quarantined Emails

There is no standard for this. This is entirely a risk assessment by the business. Is the risk of lost emails less than the risk of malicious emails being processed by users? I agree that preventing ...
schroeder's user avatar
  • 131k
1 vote

Is it safe to copy an encrypted file from quarantine to another computer for analysis?

It becomes risky at the point where the file is decrypted to become examined. Unless the attacker knows your decryption tools, and your decryption tools have an exploitable bug. Basically, a harmless ...
gnasher729's user avatar
  • 2,459
1 vote

Bypassing Windows Defender VBA custom code

Not directly answering your request, but take a look at Defender Check (https://github.com/matterpreter/DefenderCheck) It compiles in VS2019 and allows you to scan any file, just turn Real Time ...
Mitch H's user avatar
  • 11
1 vote

Python Antivirus comparing hashes

I would suggest rethinking your approach. Hashes are not virus signatures; they only serve as a fingerprint to identify files. With most conventional hash algorithms (e.g. SHA256), modifying the ...
kwypston's user avatar
  • 111
1 vote

If a host is infected is the sandbox environment infected?

It sounds like you are looking for concrete answers, but there are none. If the host is infected, then it is possible that any program running on the host is also affected. But, just like any ...
schroeder's user avatar
  • 131k
1 vote

MalwareBytes Quarantine

To extend the answer of Can malware be dangerous even when quarantined? AV quarantine is served as : Audit zone : let user to audit to decide whether to send the potential malicious file to AV ...
mootmoot's user avatar
  • 2,407
1 vote
Accepted

Programmatically Quarantining files

Let me explain a mechanism that we used on the past on a commercial AV that I was working on: The AV engine detects the malware. We create a new file with a header with meta information (timestamp, ...
camp0's user avatar
  • 2,264
1 vote
Accepted

What is quarantine?

It is a place in your computer, which kinda acts as a prison for viruses infected your computer which were later arrested by your antivirus software. Quarantine is a function of antivirus ...
Sibidharan's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible