PDA

View Full Version : Quarantine problems


Esse
September 15th, 2011, 01:01 PM
When I try to erase all detections in version 8.0.0.7 they just keep coming back in the quarantine list.

Cheers

Esse

overangry
September 16th, 2011, 12:49 AM
-{ Quote: "When I try to erase all detections in version 8.0.0.7 they just keep coming back in the quarantine list.

Cheers

Esse" }-
Try updating to vers. 8.0.0.15 and see if the issue remains.

Triple Helix
September 16th, 2011, 05:35 AM
-{ Quote: "Try updating to vers. 8.0.0.15 and see if the issue remains." }-

Not everyone is updated to the most recent version, they will get it in due time!

TH

SweX
September 16th, 2011, 05:41 AM
-{ Quote: "Try updating to vers. 8.0.0.15 and see if the issue remains." }-
8.0.0.15 is only pushed out to those that started out in the closed beta.

Esse
September 17th, 2011, 03:35 AM
Anyone seen this "bug" in 8.0.0.15?

/Esse

pegas
September 17th, 2011, 04:15 AM
-{ Quote: "Anyone seen this "bug" in 8.0.0.15?

/Esse" }-
I had a false positive yesterday and that file was quarantined. I restored the file and the file didn't come back to quarantine. However if I am correct you are talking about deleting files from quarantine what might be different story though.

PrevxHelp
September 19th, 2011, 03:24 PM
-{ Quote: "When I try to erase all detections in version 8.0.0.7 they just keep coming back in the quarantine list.

Cheers

Esse" }-

Could you let me know if the destination folder of the file in quarantine is not able to be written to? Or, as a second guess, could you let me know what the file size is of the file in quarantine?

Thank you!

Esse
September 19th, 2011, 03:39 PM
Now when my installation upgraded to 8.0.0.15 I can see the the problem is still the same.
I also saw that after I press Erase and confirm that I want to permanently delete the files is says in the upper left corner: "Quarantine- Restoring files..."
This is a bit confusing as I am erasing them, not restoring??

As I test WSA against many thousands of malware my "quarantine" is very large, and as I can not delete the from within the GUI is there a way to delete them manually, were is the quarantine folder located?

/Esse

overangry
September 19th, 2011, 09:43 PM
-{ Quote: "Not everyone is updated to the most recent version, they will get it in due time!

TH" }-
Thanks for letting me know!!!!!!!!!!!!!!!!!

overangry
September 19th, 2011, 09:45 PM
-{ Quote: "Not everyone is updated to the most recent version, they will get it in due time!

TH" }-
And when do we know "the others" have been updated, are "we" informed?

PrevxHelp
September 19th, 2011, 09:56 PM
-{ Quote: "And when do we know "the others" have been updated, are "we" informed?" }-

We have several beta programs running at the same time - some of them are on .15 now but not all. We're in a phase of high volume development at the moment so builds come out at different speeds depending on where the user initially signed up (for example, our current internal test build is now over .25). Once we get to a period of less frequent updates, I'll make sure users here are aware of what build everyone is on at any given point :)

PrevxHelp
September 19th, 2011, 09:57 PM
-{ Quote: "Now when my installation upgraded to 8.0.0.15 I can see the the problem is still the same.
I also saw that after I press Erase and confirm that I want to permanently delete the files is says in the upper left corner: "Quarantine- Restoring files..."
This is a bit confusing as I am erasing them, not restoring??

As I test WSA against many thousands of malware my "quarantine" is very large, and as I can not delete the from within the GUI is there a way to delete them manually, were is the quarantine folder located?

/Esse" }-

You may want to delete the file dbl.db from C:\ProgramData\WRData\ or (C:\Documents and Settings\All Users\Application Data\WRData on XP) which will clear out your quarantine database.

We will have the text change of Restoring vs Erasing fixed in one of the next updates :) Thank you!

Esse
September 20th, 2011, 06:40 AM
-{ Quote: "You may want to delete the file dbl.db from C:\ProgramData\WRData\ or (C:\Documents and Settings\All Users\Application Data\WRData on XP) which will clear out your quarantine database.

We will have the text change of Restoring vs Erasing fixed in one of the next updates :) Thank you!" }-

Thx! That did the trick, the file was over 2GB, no wonder it took ages to load it.
While I was in there a saw (in my case) 265 files named "ace(a number).db, are these really necessary?

/Esse

Esse
September 20th, 2011, 09:43 AM
-{ Quote: "Could you let me know if the destination folder of the file in quarantine is not able to be written to? Or, as a second guess, could you let me know what the file size is of the file in quarantine?

Thank you!" }-

The destination folder (if by that you mean were the file came from in the first place, were it was detected) s not there anymore.

I think he problem is when the quarantine is too large the erase function stops working.
Today I quarantined maybe 40 viruses and deleted the original folder where they came from and the did the erase function inside the GI and was successful.

Hope this could help?

/Esse

PrevxHelp
September 20th, 2011, 01:57 PM
-{ Quote: "Thx! That did the trick, the file was over 2GB, no wonder it took ages to load it.
While I was in there a saw (in my case) 265 files named "ace(a number).db, are these really necessary?

/Esse" }-

You can remove those if wanted - they are a carbon copy of exactly what the cleanup engine did during cleanup. This helps us find where problems originate from in the event something didn't get cleaned correctly but they can be removed without a problem if wanted :)

And yes, a 2GB quarantine database is probably not going to run well! I'll see what we can do about improving this or messaging to the user that their quarantine is getting massively large.

Thanks!