Quarantine instead of delete... why?

[Proteus]

In several posts in this forum I have read statements like this one from DavidR:

"So allow avast to send it to the chest, deletion isn't really a good first option (you have none left), 'first do no harm' don't delete, send virus to the chest and investigate."

It seems that the advice is to quarantine malware that Avast discovers rather than delete it. Is this always the recommendation? I should have thought it wiser to purge one's system of an infected file and replace it with a healthy one rather than to keep it around.

How long is it kept in quarantine? How is it eventually disposed of, or isn't it?

[Mr.Agent]

Move to the Chest is more safe than delete. That what a guy said.

[spg SCOTT]

This allows for the file to be uploaded to alwil, for analysis, and can also help you in the long run.
Say a file of a program you use frequently is identified as malware, but you are unsure you can allow it to be sent to the chest and then checked out further, rather then delete it and not know whether it was genuine or not

You can leave things in the chest for as long as you want but the usual time frame is 2-3 weeks, re-scan it and take actions depending on the result.

also the virus chest is a secure place where the files are unable to be accessed.

Hope this helps,

-Scott-

[Mr.Agent]

+1 for Scott

[DavidR]

Straight from the horses mouth, so to speak. Security programs like anything in life are fallible and can have false positive detections.

So the idea is to air on the side of caution 'first do no harm' and leave yourself some other options, but at the same time ensure it can't be run, sending it to the chest where it can do no harm and investigate.

You may also have seen this in conjunction to what you quoted - There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

[cinchez]

Straight from the horses mouth, so to speak. Security programs like anything in life are fallible and can have false positive detections.

So the idea is to air on the side of caution 'first do no harm' and leave yourself some other options, but at the same time ensure it can't be run, sending it to the chest where it can do no harm and investigate.

You may also have seen this in conjunction to what you quoted - There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

+1^^

-AnimeLover^^

[Proteus]

[quote-"DavidR"]If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.[/quote]

Having nothing in the chest to scan at present and having never done this, can I get the short course on how to scan the chest? I know I can inpect the contents but saw nothing that would allow it to be scanned. Is it scanned separately or as part of a system scan?

[spg SCOTT]

Hi Proteus,

To scan something from the chest there are two options:

1. right click the particular file that you wish to scan -->scan file(s) (easiest option)

2. select the file --> click scan file (on the top toolbar)

Hope this help,

-Scott-

[Proteus]

Deleted

[Proteus]

I assume deletion is the next step, then, in any case? If it's still infected, that's logical... but I will also have replaced it in the intervening 3 weeks and will no longer need the file in quarantine.

[spg SCOTT]

If it is still identified as malware then yes, I would delete it.

-Scott-