124

Why does anti-virus software not completely delete the viruses, malware, etc., but instead quarantine them? Is it not better to completely get rid of them? Why? And how can I manually remove them?

  • 123
    A few weeks ago ClamWin AV started detecting all docx files created in Polish version of Word as malicious. I don't use ClamWin myself, but I guess those who do were grateful for having quarantine. – gronostaj Jul 3 '16 at 19:47
  • 10
    This discussion spawned a related Sec.SE question. – Ben N Jul 4 '16 at 19:30
  • 5
    Almost every single anti-virus program I've used lets you choose what happens when a particular threat is detected (whether it ignores, quarantines, or deletes the suspected file...). – Breakthrough Jul 5 '16 at 19:04
  • 8
    To the ones asking to close this question as opinion based: there are reasons to put files in quarantine that are not opinion based: false positive, future possibility to recover the file,partial recovery of the infected file, possibility to study the virus... The choice to keep or not to keep them can be eventually personal, even if not completely arbitrary: indeed if a file is a distributed one (a program part) it is possible to copy/download it from a safe source and replace the original with no need to keep the infected copy. No chance instead for the ones made by us(here personal) – Hastur Jul 6 '16 at 10:14
  • 6
    Many years ago an AV package whose name I won't mention (coughSymanteccough) decided to flag hundreds of system DLLs as infected during a routine overnight scan. Naturally, quarantining half the operating system didn't go over well when Windows was rebooted. The machine was completely bricked and couldn't be booted even in safe mode. So I had to remove the HD from the machine, put it in another machine as a second drive, and move the DLLs back where they belonged. This took a full day to accomplish. Consider what would have happened if those files had been deleted instead of quarantined. – Carey Gregory Jul 6 '16 at 18:47
136

Viruses and malwares are not dangerous if not executed.
A file in quarantine cannot be executed by the user and the malicious code (virus or malware) has no possibility to act. If the virus/malware is removable it will be removed immediately.
If not the file will be moved to quarantine.

There are different reasons for this:

  • False positive (as stressed out by other answers as well, see below in Further explanation).
  • Future possibility to recover the file (the virus adds its code inside the original file and move/crypt/hide part of the original code somewhere. At present it is not possible to recover the file but maybe in a near future it will be).
    Indeed if the file is unique (e.g. one created by the owner of the computer) and it is somehow precious, the user may find a way to recover all the parts that are still possible to recover from it. A part of a thesis (or of an image) is always better than nothing.
  • Possibility to study the virus by the antivirus company or to individuate other computer with the infection (let's imagine you have a file attacked by a virus. Its signature, md5sum changes. You have the same file on many computers. If the signature is the same you can guess they are attacked. If you check in your backups you can find the first time the virus acted).
    Note: historically the "quarantena" was a period of 40 days isolation for ships and people before entering the city in order to prevent the diffusion of the Black Death, to see if the virus develops or not. On our computers the quarantine is just a safe place were to keep inactive the suspect files, without observing any actions of the virus.

  • In the quarantine can end up even an executable file that is changed.
    Imagine that you have a program that you recompile or an open source program that is updated not via usual windows ways: the antivirus can notice activities (writing) on an exe-cutable file and put it in quarantine.
    Moreover since there are some files with active content (as, e.g., Word or eXcel macro...) some antivirus can spot differences in the executable parts and interpret those as produced by the action of a virus.

  • If you have the same version of a file attacked from a virus in different ways, it can be (theoretically) possible to recover the file by crossing and analysing data of these versions.

Further explanation
Think like a virus and an antivirus to understand why the quarantine exists, why there can be false positives and why this is a battle that continues each day.

A virus (or a malware) is a compiled code that executes the purpose for what was programmed for.
As compiled code, it's binary (usually) and not text (as what you are reading). It has to propagate itself and to execute some homework (a mission, technically a payload), not necessarily at the same time (this increases the possibility of spreading the infection before it is detected).

How can a virus propagate itself and be executed?

  • Simply it can overwrite a part of the original code (exe,dll,com... files) and put its code instead.

    DOS virus
    Example of an ancient DOS virus that acts in a such mode.
    The drawback is that the original program can stop working and the virus may be detected faster (E.g.: "...hello my program is not working... strange things are happening... can you help? - Yes sir you have a virus").

  • It can copy the initial part of file to be infected at its end, after it can put itself instead of the first part. So when you execute the program, the virus is firstly executed and only then the program is executed... A smarter variant is to copy itself at the end of the file and to put a jump to the end in the beginning of the file (and one back to its beginning at its end)... The drawback is that an antivirus can search for the code of the virus (once known) and find it easily. This happened in the Cascade virus in the 80s-90s...

    Cascade virus

  • It can be made of parts and he (note not it) can change his shape and hide himself in different parts of the program, move them, encrypt and scramble. Each time he may infect a new file in a different way. Therefore the antivirus may only find remains in fingerprints – each day he is harder to identify.

Now, do you remember that the virus is (usually) binary code? Well, the fingerprints are too.
Since they are not the full virus but only a few bytes, it may happen that a part of a compressed file, data file, or image has the same bytes of one of the many known viruses fingerprints – hence the false positive.

Conclusive note: not all the viruses were planned to damage, but most of them do it, de facto.
With the actual use of computers with bank accounts and bills to pay, it doesn't seem any more as funny as the images above.

  • 4
    +1 on this specifically because of future possibility to recover the file - once upon a time this was a standard course of operation for antivirus software! – fluffy Jul 4 '16 at 7:55
  • 3
    @MSalters. Nope, sadly no auto-correction. I was speaking figuratively (or at least I was trying to): a virus propagates from a file to another (maybe another computer...). Then it resides in a file (it finds home). Then it waits... then it executes what it was taught for (programmed for). From here the term "homework" You can read it as "mission", it should be more clear, but it is more like if you see a virus as a soldier. BTW thanks for the spot, answer updated. – Hastur Jul 4 '16 at 8:39
  • 41
    I'm curious about the "he (note not it)" portion. What was that about? – Alpha Jul 4 '16 at 18:20
  • 3
    In the phrase "In the quarantine even an executable can be finished", I can't figure out what the word "finished" means. Can you clarify this? – Tanner Swett Jul 4 '16 at 20:27
  • 4
    @Alpha (and others...) It's personal, related to the way I "sense" that kind of viruses. The formers executed basic tasks,blindly,with no exhibit of any kind of brilliance. But then they started to modify themselves,to hide and remain sleeper, encrypting themselves,somehow evolving... --the variants easy to be found had no possibilities to survive resisting to your attempts to kill them; look: I used "survive" &"kill", implicitly I start to recognise them some sort of dignity as expression of Intelligence, as if they were alive... so not any more it but he,or she if you prefer. – Hastur Jul 5 '16 at 8:24
89

Anti-malware applications provide a quarantine option, which is often on by default in order for two reasons:

  1. Keep a backup of the items identified as threatening in case of a false positive. Although not very common, I have seen cases of false positive on many different legitimate application files and drivers.
  2. Having the item in quarantine may allow it to be better investigated. The fact that it matches a malware signature doesn't mean that it is just similar but may actually have other particularities.
  • 39
    Additionally if the malware has embedded itself in a file you actually want, such as a Word document or similar, then outright deletion may be the worst option from the users perspective. Quarantine at least gives you a chance, however risky, to get the contents back. – Mokubai Jul 3 '16 at 8:03
  • 8
    Additionally the anti-malware software might have a different understanding then you in the classification. Some anti-virus software are known to detect SysAdmin tools as malware and I found some of them deleting half my USB-Stick without asking when I connect it to computers from certain companies and schools. netcat, wireshark, etc. are known canditates. I have also seen people storing their only copy of their master thesis on an USB-Stick. I hope the anti-malware scanner doesn't detect it as false positive and deletes it without asking. – H. Idden Jul 3 '16 at 14:56
  • 13
    Not very common? I think almost all detections my antivirus has had were false positives. – Oriol Jul 3 '16 at 17:49
  • 6
    @JuliePelletier The ratio of false positives is heavily influenced by the actions of the user. I never have a virus, malware or anything like that because I'm very carefull. This automatically makes that most (if not all) detections are false positives. I do still use an anti-virus of course :). – Mixxiphoid Jul 4 '16 at 8:25
  • 3
    @Mokubai It is an interesting idea that a virus could cause havoc by adding viri signature to legitimate files - making the av do the dirty work. – emory Jul 4 '16 at 22:31
72

For the same reason that (most) governments arrest suspected criminals instead of shooting them on the street at the slightest provocation:

You want to give the suspect a chance to defend themselves, in case they actually did not commit any crime at all. And, even if they did commit a crime, you probably want to find out all about it.

  • 38
    By that analogy, there should be at least some antivirus that delete by default... – PlasmaHH Jul 3 '16 at 15:31
  • 5
    @ΈρικΚωνσταντόπουλος: What a ludicrous statement. Does Windows 7 also "not exist"? – Lightness Races in Orbit Jul 5 '16 at 10:40
  • 9
    @ΈρικΚωνσταντόπουλος: People will be using Windows 7 and 8 for a long time. There is nothing "nonexistent" about a one-year old piece of software. Don't be so silly! – Lightness Races in Orbit Jul 5 '16 at 10:52
  • 14
    @ΈρικΚωνσταντόπουλος Windows 7 has extended support until 2020, mate; Windows 8 until 2023. I'm struggling to detect your point. What is it? – Lightness Races in Orbit Jul 5 '16 at 10:57
  • 20
    @ΈρικΚωνσταντόπουλος Yes, in 2023. What is your point? – Lightness Races in Orbit Jul 5 '16 at 11:08
1

Viruses (for example) are not necessarily a "stand-alone" binary (.exe). Traditionally, many of them "attach" themselves to (many) normal executables. (hence the choice of the word: "infect")

Therefore "deletion" of the malware file is not the only option. Many AVs offer the option to "clean" the infected files. (remove the virus part from otherwise normal program files. leave normal program where it is.)

"Spreading of the infection" would then not be based on "running the malware" (visible process .exe) -- but based on running any "normal program" (Word, Excel). (or open a normal document with those)

Moving the "normal but infected" program file to a quarantine location, is a first step to stop spreading the infection. There, it is less likely to be continuously executed during every day operation.

Quarantine gives you options, before deletion. In case the "cleaning" failed. In case you have a "better tool" somewhere else. Or in case you still need all those infected files. (for analysis, data recovery)

0

Just sometimes anti viruses might consider your important files as malicious and instead of automatically deleting them it quarantines them where they can't execute or access your files and notifies you of its actions.

  • Welcome to Super User! This answer adds nothing new to the thread. Please read the other answers before posting something as an answer. – rahuldottech Jul 31 '16 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.