I still don't understand quarantine.

Discussion in 'ESET NOD32 Antivirus' started by chard2, Jul 31, 2010.

Thread Status:
Not open for further replies.
  1. chard2

    chard2 Registered Member

    Joined:
    Jul 31, 2010
    Posts:
    2
    I know there has been a lot of discussion about quarantine, but I still don't understand what's going on. Here's what I am experiencing. I did a manual scan of the disk with nod32. The log file says it found two infected files, which it cleaned and quarantined:

    ...Win32/Ramniot.A - cleaned - quarantined

    From all that that I have read, this should mean that nod32 encrypted them and rmoved them into it's quarantine folder. But when I do a directory listing, I see they are still in their original locations. If I do as "delete from quarantine," they are removed from the quarantine list, but they are again still on the disk in their original locations. I suppose I could delete them by hand, but is this the way it's supposed to work? The documentation seems to say otherwise.

    There must be a simple explaination for this, but I'm not seeing it. Please help. Thanks much.
     
  2. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
  3. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    In this case, an encrypted backup of the original infected file was put to quarantine and subsequently the infection was removed from the file at its location (ie. it's clean).
     
  4. aido

    aido Registered Member

    Joined:
    Jun 12, 2009
    Posts:
    32
    If you not sure you can test the orginal file by updload at Virustotal. It should be clean.
     
  5. chard2

    chard2 Registered Member

    Joined:
    Jul 31, 2010
    Posts:
    2
    Finally the clouds have parted. I get it. The file is cleaned means that the virus has been removed and the file has been rewritten, which makes sense since the timestamp is now current. Thanks for the clarification. Sometimes it takes me a while.
     
Thread Status:
Not open for further replies.