Where are Quarantined files stored ?

Discussion in 'ESET NOD32 Antivirus' started by kevin009, Apr 26, 2008.

Thread Status:
Not open for further replies.
  1. kevin009

    kevin009 Registered Member

    Joined:
    Sep 11, 2007
    Posts:
    32
    Two queries here:

    1. When a malicious file is quarantined by NOD32, then it is stored in the path as an encrypted NQF file: C:\Documents and Settings\Administrator\Local Settings\Application Data\ESET\ESET NOD32 Antivirus\Quarantine.

    But when we add a file manually to quarantine, (Right Click a file > Advanced Options > Quarantine file). It does not appear in this path. Then where is the file kept ?

    2. (Right Click a file > Advanced Options > Quarantine file)
    Once, by mistake, I clicked that option on a file larger than 1 GB, and it resulted in a big slow-down and took a long time to quarantine. So I would like to disable/deactivate the “Quarantine File” in the context menu so that it cannot be selected accidentally. Is this possible ?

    If yes, let me know the details. Thanks.
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    On my system when I "Right Click a file > Advanced Options > Quarantine", those files are saved in Documents and Settings\ASPNET\Local Settings\Application Data\ESET\ESET NOD32 Antivirus\Quarantine.

    If yours are not found there, send a file to quarantine and then do a search in Windows explorer for any .ndf or .nqf files created today.

    Bubba
     
  3. kevin009

    kevin009 Registered Member

    Joined:
    Sep 11, 2007
    Posts:
    32
    I would like to suggest that NOD32 / Smart Security have some new additions to the context menu settings in the “Advanced Setup > User Interface > Context menu.

    To get an idea of what I mean, Look at the screenshot (which I have edited with Photoshop)

    http://img33.picoodle.com/img/img33/4/5/14/f_Advancedm_bfeec92.jpg

    - Here, if the “Quarantine files” Checkbox is unchecked, the option “quarantine file” will be removed from the context menu’s advanced options, so that it cannot be selected accidentally.

    “Do not quarantine files larger than _ MB” If the 2 MB size is specified, when a user tries to quarantine a file (via right-click context menu) larger than the specified size, NOD32 should display a dialog saying that the file is larger than the specified size and should ask the user to open the NOD32 control center > quarantine > add file (manually)
    This option should be automatically “deactivated/grayed out” when the “Quarantine files” checkbox (mentioned above) is unchecked.

    This will be useful, because suppose if the user accidentally selected the “Quarantine file” from the context menu on a very large file (say: 1 GB), it would take a rather long time to quarantine and would slow down the system.

    It also happened to me and when I rebooted the system (out of frustration) while NOD32 was still taking time to quarantine a 1 GB file, after the reboot, I lost this file (damaged/corrupt/missing from the quarantine and its original location).

    - Same for “Submit files for analysis” checkbox (as the context menu “Quarantine files” option mentioned above)
     
Thread Status:
Not open for further replies.