You are not logged in.

Saturday, April 19th 2014, 9:16am

Dear visitor, welcome to Avira Support Forum. If this is your first visit here, please read the Help. It explains in detail how this page works. To use all features of this page, you should consider registering. Please use the registration form, to register here or read more information about the registration process. If you are already registered, please login here.

  • "danielkza" started this thread

Date of registration:
Jan 6th 2009

  • Send private message

1

Tuesday, January 6th 2009, 8:24am

Deleting files from quarantine does *not* remove them from the filesystem

According to this response, Avira should physically remove files purged from the quarantine. Although, as confirmed by me, it`s *not* what happens. Files are still present in their original locations after being removed from the quarantine folder, and I can open them freely without any warning from Avira.

Any reasons for this behavior? Is that intended or is it a bug or a problem with my system?

Extra Information:

Windows XP SP3
Avira Antivir Personal: Engine 8.02.00.45, VDF 7.01.01.73, as updated @ 6/1/2009, 05:10, GMT -3, DST
Files tested for locks with Unlocker, and don`t appear in use by any other program, so there should be no problem for Avira to delete them.


Thanks for the attention.

  • "Alexandru Frigioiu" has been banned

Date of registration:
Dec 8th 2008

Operating System:
XP and VISTA

  • Send private message

2

Tuesday, January 6th 2009, 9:13am

RE: Deleting files from quarantine does *not* remove them from the filesystem

Files are still present in their original locations after being removed from the quarantine folder, and I can open them freely without any warning from Avira.


I think there is a contradiction here. The original location doesn't mean quarantine.
Please post here the settings for scanner (action for concerning files section) and the reproducing steps for this issue.

  • "danielkza" started this thread

Date of registration:
Jan 6th 2009

  • Send private message

3

Tuesday, January 6th 2009, 5:14pm

RE: RE: Deleting files from quarantine does *not* remove them from the filesystem

Files are still present in their original locations after being removed from the quarantine folder, and I can open them freely without any warning from Avira.


I think there is a contradiction here. The original location doesn't mean quarantine.
Please post here the settings for scanner (action for concerning files section) and the reproducing steps for this issue.

From the original thread:

Quoted from "D_Spider"

It found an object that "Contains suspicious code." If I choose the wastebasket icon in the Administration > Quarantine dialog, "to delete the selected object(s) from quarantine," does this delete the suspicious object from my computer and remove its threat, or does it merely remove the object(s) from quarantine and let it be a threat again?

Quoted from "Barrie"

If you delete a file/object from the Avira`s quarantine folder


For me it's clear the OP is asking about quarantine deletion, not general 'delete' option when Avira first detects a suspicious file.

And looking at the Avira config dialog, in Scanner->Scan->Actions for concerning files, it states 'copy file to quarantine'. There should be an option allowing you to move the file instead, removing it from the filesystem, because that's not what happens when you delete an item from the quarantine.

For now my solution will be set the secondary detection action to remove instead of ignoring, and keeping a copy in the quarantine, but I still believe the current behavior should at least be better documented.

Thanks again, Daniel

marinius

Community member

Date of registration:
Sep 11th 2007

Operating System:
Windows 7 Ultimate SP1

  • Send private message

4

Wednesday, January 7th 2009, 1:30am

Hello danielkza,

If you check 'copy file to quarantine' your choice for the "primary action" are only repair, rename, delete, ignore. If you wanted to quarantine a detection and move the file from its location, uncheck 'copy file to quarantine' then choose "quarantine" as your primary action.

Here's a description quoted from Help-contents regarding "quarantine""

"quarantine
If this option is enabled, the Scanner moves the file to the quarantine. These files can later be repaired or - if necessary - sent to the Avira Malware Research Center."


regards,

marinius
The moment you thought you knew everything
is the beginning of your ignorance...

This post has been edited 1 times, last edit by "marinius" (Jan 7th 2009, 1:36am)


  • "danielkza" started this thread

Date of registration:
Jan 6th 2009

  • Send private message

5

Wednesday, January 7th 2009, 3:26am

Hello danielkza,

If you check 'copy file to quarantine' your choice for the "primary action" are only repair, rename, delete, ignore. If you wanted to quarantine a detection and move the file from its location, uncheck 'copy file to quarantine' then choose "quarantine" as your primary action.

Here's a description quoted from Help-contents regarding "quarantine""

"quarantine
If this option is enabled, the Scanner moves the file to the quarantine. These files can later be repaired or - if necessary - sent to the Avira Malware Research Center."


regards,

marinius

That's exactly what I was looking for, thank you. But I still think the delete button of the quarantine folder should be more specific about what it really does. Maybe adding one button as 'release', that only marks the file as 'non-quarantined' and anothr for 'remove', that actually deletes the file.

Thank you very much for your help.