Not what you were looking for? Ask our experts!
Reply
Virus Trouncer
mijcar
Posts: 3,098
Registered: ‎08-01-2008

Can I delete quarantined files/objects?

I've noticed that not a single threat that NIS has quarantined on my computer has the option to be deleted.  Why is this?  It appears that Norton has decided that since the threat is resolved, I would want to keep the file in question.  This is absurd.  How many people would be receiving a file they really want that just happens to be infected with malware?  Hogwash.  If I get malware, it was probably sent automatically from an infected machine; and I have no interest in the file.  In fact, I don't want it creating an ever-growing quarantine folded just wasting space on my computer.

 

I can conceive of a way to destroy someone's computer simply by using NIS or NAV as the agent.  Send the largest possible infected files your ISP will follow to the person's computer you wish to destroy.  Keep sending them over and over again, preferably while the person is away.  Each file will be cleaned and stored in the quarantine folder.  Overnight you should be able pump a fair number of gigabytes into that poor soul's quarantine folder.  And here's the kicker.  He's stuck with them!  So you can do it again the following night, launching your email from a different computer just in case he has the original sender on a black-list.

 

Below is a screen-clipping of the kind of actions Norton allows me for EVERYONE of the security risks it has quarantined.

 

Example.jpg

mij
N360 2013, v.20.1.0.24; Win7 Pro, SP1 (32 bit), IE 9, Firefox 14, No other active securityware
Tech83
Posts: 968
Topics: 55
Kudos: 168
Solutions: 27
Registered: ‎07-30-2008

Re: Can I delete quarantined files/objects?

Hi! Mijcar,

 

I have a pop quiz; have you already opened NIS>Quarantine>Selected an item>Clicked options (below the recommended action box) then Selected Submit to Symantec? If you have then select the remove item from history this should delete the file. One thing to note, most ISP's will block a file that is continuously transmitted no matter where it comes from.

Super Spam Squasher
cgoldman
Posts: 2,929
Registered: ‎06-25-2008

Re: Can I delete quarantined files/objects?

I really do not think that anyone should post methods to destroy people's computers in this forum.
Virus Trouncer
mijcar
Posts: 3,098
Registered: ‎08-01-2008

Re: Can I delete quarantined files/objects?

[ Edited ]

Tech83 wrote:

Hi! Mijcar,

 

I have a pop quiz; have you already opened NIS>Quarantine>Selected an item>Clicked options (below the recommended action box) then Selected Submit to Symantec? If you have then select the remove item from history this should delete the file. One thing to note, most ISP's will block a file that is continuously transmitted no matter where it comes from.


 

I'm sorry, but that is blatant nonsense.  I'm not referring to your words, but to the process itself.

 

How many regular users out there, people who never visit these boards -- how many of them would have the slightest clue about doing that?  I read the Help section and I was shown the following:

 

mijcar.jpg

 

That's it.  None of what you say appears to the regular user.  This is bad.

 

Moreover, consider:  Why should anyone send a file to Symantec that has already been identified as containing malware, or which has had it removed?  Symantec already knows about the malware; they don't need a submission.  And if the malware has been removed, why send them a clean file?  Both of these actions are absolutely pointless, a waste of the user's time, and an ever greater waste of Symantec's precious time that they should be spending analyzing new submissions.

 

Just give me a simple option to remove a file I have no interest in looking at or releasing back onto my computer.

 

What is worse is that the malware-makers are always one step ahead of the malware-catchers.  They create something new and there is always that interval between creation and detection.  What happens if the supposedly clean file really contains a second infection for which Symantec does not yet have a signature?  No, I don't want to play with the blasted file.  I don't need the blasted thing!  I just want it deleted and gone.

 

<<edit: resized image for better fit>> 

Message Edited by JerryM on 11-04-2009 10:44 AM
mij
N360 2013, v.20.1.0.24; Win7 Pro, SP1 (32 bit), IE 9, Firefox 14, No other active securityware
Virus Trouncer
mijcar
Posts: 3,098
Registered: ‎08-01-2008

Re: Can I delete quarantined files/objects?


cgoldman wrote:
I really do not think that anyone should post methods to destroy people's computers in this forum.

 

It's called "white-hatting" (by me, anyway); and you can be sure that this simple method is well known.  I was merely making the point that a bloated quarantine folder (which has already been discussed in these forums) is damaging to the computer (which has also already been discussed in these forums).

 

Believe me, I know of at least a few other strategies to do real damage, not this simple thing; and I would never consider posting them anywhere.

mij
N360 2013, v.20.1.0.24; Win7 Pro, SP1 (32 bit), IE 9, Firefox 14, No other active securityware
Virus Trouncer
mijcar
Posts: 3,098
Registered: ‎08-01-2008

Re: Can I delete quarantined files/objects?


Tech83 wrote:

Hi! Mijcar,

 

I have a pop quiz; have you already opened NIS>Quarantine>Selected an item>Clicked options (below the recommended action box) then Selected Submit to Symantec? If you have then select the remove item from history this should delete the file. One thing to note, most ISP's will block a file that is continuously transmitted no matter where it comes from.


 

Sorry, Tech, I forgot to mention that ttbomk removing an item from history is quite different from deleting it.  Removing it from history means that you don't want to read about it any more.  :smileytongue:  Deleting it means ... well, you know what that means.  Anyway, if Symantec really means for "delete from history" to also mean "delete from the computer", that can create a problem for the user.  What if the user knows the file is now safe since the malware has been excised and wants to keep the file but doesn't want to have the info cluttering up his or her computer (that is the user's choice, you know).  So the user clicks on "remove from history" and suddenly the file he or she wants is gone forever!

 

Nothing is more important in the interface between product and user than the correct and clear usage of words!

mij
N360 2013, v.20.1.0.24; Win7 Pro, SP1 (32 bit), IE 9, Firefox 14, No other active securityware
dbrisendine
Posts: 5,584
Kudos: 1,294
Solutions: 263
Registered: ‎10-06-2008

Re: Can I delete quarantined files/objects?

"Remove from History" (if there is no 'Remove this file') does delete the file from Quarantine and your system.  The option to 'Remove the file' is for something that is not a certain risk; for anything other than Lowest or Low risk items, Norton will remove the file automatically and place the only copy of the file in Quarantine.  'Remove from History' deletes the encrypted compressed file from the Quarantine folder / files.
Win7 x32 SP1
Virus Trouncer
mijcar
Posts: 3,098
Registered: ‎08-01-2008

Re: Can I delete quarantined files/objects?

[ Edited ]

dbrisendine wrote:
"Remove from History" (if there is no 'Remove this file') does delete the file from Quarantine and your system.  The option to 'Remove the file' is for something that is not a certain risk; for anything other than Lowest or Low risk items, Norton will remove the file automatically and place the only copy of the file in Quarantine.  'Remove from History' deletes the encrypted compressed file from the Quarantine folder / files.

I'm sorry, D, but based on the English language, I cannot allow myself to believe a word of what you just said.  (Even if it's true.)

 

According to Norton Help itself, which is official (whereas you only offer hearsay):

Example 3.jpg

Until you can provide an actual quote (and I would prefer a screenshot) from anywhere whatsoever in the NIS or NAV Help files that says what you "claim is true" is actually true, then I (and countless thousands of others) would have no reason to think that.

 

Please understand, D, I don't mean this offensively, nor is it directed against you.  This is about clarity of communication in a very important security product.  I'm sure you can understand where I am coming from.

Message Edited by mijcar on 11-03-2009 10:35 AM
mij
N360 2013, v.20.1.0.24; Win7 Pro, SP1 (32 bit), IE 9, Firefox 14, No other active securityware
Contributor
Michaeldayla
Posts: 28
Registered: ‎09-09-2009

Re: Can I delete quarantined files/objects?

I agree. Norton's help files are useless for a user who is trying to determine what actions Norton has taken when malware is discovered. For those of us that have learned not to depend on Norton alone, who use a layered approach to security, we need not only correctly worded help files but the ability to customize certain actions so that Norton does not conflict with our layered approach.

 

For example, I browse using Sandboxie which I trust more than Norton to keep my computer malware free while surfing the net. I also use a non-signature based HIPS to alert me if newly introduced files attempt to make modifications to important files, folers, or keys in addition to a tightly configured inboud/outbound firewall and router. 

 

I assume, but do not know, that the action Norton takes with respect to any malware might vary. For example, if Norton spots an executable which it knows to be malware it probaby stops it from running through quarantine. However, a threat it does not initially recognize might start performing actions which allow Norton to identify the executable as malware. Does Norton behave any differently? When a threat is removed, what does this mean exactly? Are all files introducted or modified by the malware quarantined by Norton so that no changes were made to the system? Or, do some modification remain despite the threat being removed?

 

If Norton advises me during a browsing session that it has detected malware, what should be my response during a Sandboxed browsing session? Since Norton has never detected malware on my system I am clueless regarding Norton's actions. Norton's help file lacks the specificity necessary for me to make an informed decision regarding its interaction with my other security measures.   

Tech83
Posts: 968
Topics: 55
Kudos: 168
Solutions: 27
Registered: ‎07-30-2008

Re: Can I delete quarantined files/objects?

My apologizes for my previous post.  :(