Norton 360

[dbrisendine Norton Fighter]

The Quarantine files will be in ProgramData\Norton\{user ID number}\N360_2.5.0.5\Qbackup .  Please check for any files there other than the index.qbs file; this folder and any files inside it should be listed with a blue font due to them being encrypted and compressed.  If you find no other files than the index.qbs file, then you can purge your Quarantine History Log as there are no real files in Quarantine (the Qbackup folder is where Norton will place all the quarantined files along with the remediation information for those files).  If there are other files there, then you can proceed as directed above on manually purging the files and the History Log.

[Alex_PH]

Hello Dbrisendine,

Thank you for continuing to work on this.  I found my Qbackup folder as directed and yes, this folder and its contents are displayed by Vista's Explorer in blue font.

Observations specific to my case:

Folder location            . . . . .  ProgramData\Symantec\Shared\Qbackup

Folder Size                 . . . . .  95.7MB (39.2MB on disk)

Folder Contents         . . . . .   3,623 files; 900 folders

Security Properties    . . . . .   SYSTEM and Administrators have full control but no special permissions

Content Details          . . . . .   a index.qbs file; 17.2MB

                                               900 {...}.qbi  files;  1kB each

                                               a folder for each {...}.qbi file; 236B ~ 401kB

Date Modified             . . . . .   index.qbs file       14Jan2010

                                              {...} files/folders    15May2008 ~ 21Nov2009

Please clarify:

• Is the index.qbs file the Quarantine History Log file that you are referring to?
• Are you saying that I can now delete all of the above in one go and just leave the ..\Qbackup folder empty?

I was about to copy all the contents of the ..\Qbackup folder to another location and then empty that folder just to see what happens when I check N360's Quarantine Tab, but I decided to better check with you first lest N360 goes nuts on me.

Best regards,

Alex_PH

[AllenM Norton Fighter]

Yes I am very interested in the final resolution here as well. Here is to hoping that Symantec will add functionality to both N360 and NIS in the near future to allow us users to empty the quarantined files without all these convoluated steps. This really does seem like pretty basic and normal expectations which a user would want to do.

Allen

[dbrisendine Norton Fighter · Accepted solution]

If you are sure that you do not want these files ever again, then turn off the Tamper Protection in N360 v2 and delete the folder's contents.  Please leave the folder.  Then turn Tamper Protection back on and reboot your system.  When you go back into the History Log or Quarantine, there should be nothing listed there anymore and the only file left in the folder now will be the index.qbs (which is not the log file but an internal db record for N360's Quarantine process).

I believe that the Quarantine process does let you delete these files if you do it before clearing the History Logs.  Once the record is removed from the log files, the only way to delete the files is manually as pointed out earlier in this thread.

[Alex_PH]

Hi Dbrisendine,

Following your instructions, I was able to clean out my list of quarantined items that can be restored.  Thanks a bundle!  I expected though that N360 would re-initialize the index.qbs file to a smaller size after re-starting the pc.

To confirm that N360 quarantine logging still worked, I visited another website that issued persistent cookies and then performed an N360 quick scan.  Now, there is one new entry in my list of quarantined items that can be restored.  One entry versus 900 previously ... is fine by me.

For the benefit of everybody who might try your solution, this is what I did:

1.  Isolate the pc - disable the LAN card;

2.  Perform a full virus and spyware scan;

3.  Create a restore point;

4.  Disable N360 tamper protection;

5.  Delete all ProgramData\...\Shared\Qbackup contents except the index.qbs file.

     Note: this file cannot be deleted anyway (not while it is in use by N360);

6.  Verify that the list of quarantined items that can be restored by N360 is empty;

7.  Re-enable N360 tamper protection;

8.  Re-start the pc.