Quarantine

[John Byrd]

What happens to a file or program that is Quarantined?
Will I be able to use that program if I do quarantine it?

 

[Dave M]

From MSAS Help:

Quarantine. Selecting this action removes this threat from your computer
and stores it in a Spyware Quarantine file. Any threats in your Spyware
Quarantine file do not run on your computer but you can restore these items
back to their original state at any time. (Note, some spyware threats cannot
be quarantined, only deleted.)

You should be aware that this program is still Beta, and we've had reports
that .mp3 (and maybe other) files do NOT properly restore from quarantine.

 

[Bill Sanderson]

At the moment, it is renamed, relocated, and, if you allow the quarantine
operation to complete, indexed in a file such that these actions are
completely reversable.

Many failures of quarantine chronicled in these groups involve someone
seeing that all their Kazaa files are being "deleted" and halting the
process. When you do this, the index file never gets completed, and there's
no reversal process.

You can't use the files or programs while they are quarantined--but you can
reverse the quarantine operation.

 

[Dave M]

Hi Bill;
So your saying that Kazaa files with the .mp3 extension can get restored
properly, and it's only a user error?
I hadn't picked that up from the reports, but if that's the case it's pretty
good news. Maybe a warning about canceling the process during any
quarantine would help, if they don't get that already. I've personally
never had any Kazaa experience, and my understanding was that it was
related to the file format and renaming such files. Welcome back.

 

[Bill Sanderson]

Thanks--I've tested the quarantine process with mp3 files and Kazaa, and it
worked for me--but it was an academic sort of test--I probably had only one
..mp3 file.

I've also seen reports of successes with reversing quarantine of large
numbers of mp3 files--so I know that CAN work, although there are also
reports of failures.

The files are renamed, including the suffixes. My belief is that in a
situation where Microsoft Antispyware does not show in the UI that anything
has been quarantined, but, in fact, you can see hundreds of files in the
quarantine area, you are probably in the situation of having halted the
quarantine operation, and left it irreversable.
I also know from experience and testimony here, that the MP3 files are
playable. You can rename them .MP3 and they play. However, getting them
back into their original names isn't something I've seen anyone manage,
although knowledgable folks tell me that the song title is part of the
internal content of the file, and that there are command-line utilities that
ought to allow for that to be extracted, and used to create new names for
the files--but maybe the same folks who lose their kazaa stores, are not
also batch file wizards--it seems a pretty reasonable challenge, to me--but
I haven't attempted it myself, mostly 'cause of lack of direct need, to say
nothing of time....

I don't know if all quarantine failures are user error--that'd be a pretty
broad statement. There's also an issue in this beta code where processing
which involves large numbers of lines of text takes MUCH longer than
expected--perhaps hours. I've seen this remarked on with regard to some
log-file reading processes, and I also believe it relates to processing
quarantines containing large numbers of files. This inefficiency is
something I'm quite sure will be addressed for beta2.

--