Working with quarantined objects

A heuristic code analyzer, detecting up to 92% of new viruses, determines whether a file is suspicious in terms of possible presence of a virus. This mechanism is very effective but sometimes gives false positives. Is it possible to determine whether a file is actually infected with a new virus not yet recorded in the anti-virus database or whether this is just a false alarm?

During the scan of the entire computer or individual disks files and in real-time protection mode, Kaspersky Anti-Virus quarantines all suspicious objects. Various actions (scan, recover, delete, etc.) can later be applied to the quarantined objects. Quarantined files are stored using a special format and do not constitute any danger to your computer.

You are advised to update the anti-virus database before scanning quarantined files. The update may contain information about any viruses which have infected the quarantined files, and you may be able to repair the files.

You can work with possibly infected files in the Quarantine window, which can be opened by clicking View Quarantine in the Protection tab of the main application window or by clicking the View Quarantine link in the Scan window.

The following actions can be performed from the Quarantine window:

Quarantine a file suspected of being infected with a virus that is not detected by Kaspersky Anti-Virus. To quarantine a file, click Add and select the suspicious file in the standard file selection window. The file will be added to the list with the status quarantined by user.
Scan and disinfect all of, or a subset of, the suspicious files using the current anti-virus database. To do this, either click Scan All, or select the files to be scanned and click  Scan.

After the scanning and disinfection of a quarantined object its status may change to infected, false alarm, not infected, ect. In this case, a message will give recommendations on how to treat this file.

The infected status means that the object was identified as infected but its disinfection failed. You are advised to delete such objects.

All objects with the false alarm status may be safely restored as their previous possibly infected status was incorrectly assigned by Kaspersky Anti-Virus.

Quarantine for suspicious files

Restore files from the quarantine folder to their original folders. To restore an object, select it in the list and click the Restore button. When restoring objects quarantined from archives, email databases and mail format files, you must specify the folder to which they are to be restored.

You are advised to restore only objects with a false alarm, not infected or disinfected status because restoring other objects may infect your computer!

Send suspicious objects to Kaspersky Lab for analysis. You are advised to only send objects that have retained their possibly infected status after numerous attempts to scan and disinfect them. To send a file to Kaspersky Lab, click Send (for details see section Contacting Technical Support).

Note that files that you send to Kaspersky Lab for analysis should be scanned by Kaspersky Anti-Virus, using an anti-virus database, updated at most one day before you send the file.

Delete a quarantined object or a selected group of objects. Delete only files that cannot be disinfected. To delete such files, select them in the list and click the Delete button.

See also:

Additional quarantine settings