NAV reports Quarantined file but none in Quarantine window

Running NAV 11.1.1 (2) on Mac OS X 10.6.2

 

Downloaded an exe file using Safari, NAV reported the file quarantined and moved, the downloads window in Safari reports the file moved but the quarantine window has no files listed.  A finder search for the file doesn't reveal any files...  am currently running a full scan of my macbook but nothing reported yet.

 

Where does the quarantine folder reside and why would the file that existed according to both finder & NAV just disappear?  Any help appreciated

 

Regards

 

Andrew 

Running NAV 11.1.1 (2) on Mac OS X 10.6.2

 

Downloaded an exe file using Safari, NAV reported the file quarantined and moved, the downloads window in Safari reports the file moved but the quarantine window has no files listed.  A finder search for the file doesn't reveal any files...  am currently running a full scan of my macbook but nothing reported yet.

 

Where does the quarantine folder reside and why would the file that existed according to both finder & NAV just disappear?  Any help appreciated

 

Regards

 

Andrew 

A small correction about quarantine file size: once you have opened the Quarantine window, an empty quarantine will have 108 bytes.  If it has more than that, let me know.

thanks Lee, found the file & it is 4.6MB in size, which makes sense as I've downloaded the original file a second time to see if the same result would be seen.  It was, trojan detected, file moved notification but no visibility in the quarantine window...  I assume I can just delete this file to remove the trojan or do I need to do more or do you want more info from me?

Kind regards

Andrew 

You could delete it, though you really don't need to do anything since it can't affect your system from within the quarantine file.

 

But I'm wondering why it doesn't show up in Quarantine, so would you mind sending me the quarantine file?  I'll send you a private message to follow-up.

Lee have tried to send file but get error that says can only send txt or log files...

Andrew 

Did you receive the private message I sent?  There's another email address to try there.

 

Also, I think I would recommend against deleting the quarantine file, it may cause issues with future quarantine attempts.  Though since it isn't working now, I may have to give you a means of clearing its contents.  But if possible I'd like to take a look at it first.

Thanks Lee, no problem, have sent you a mail with files attached, will wait for your response

Andrew 

I sent another response Saturday (to the address from which you sent to me privately); did you receive that?  I was just asking for some additional info about file permissions (your quar. file seems to open fine on my system).  It's not critical, just kind of curious why it isn't displaying on your system.

 

-- Lee 

Hi Lee sent you a reply about 40 mins after your mail request for additional info... just checked & reply went to the address you had replied from which wasn't the same as the one you asked me to send the file to, will resend to both addresses... hope that makes sense 

Regards 

Andrew 

Message Edited by abre on 01-11-2010 11:48 PM

Lee - I have exactly the same problem.  My file is 480 kb in size, but nothing shows up in my Quarantine window.  This is on an upgrade install of NAV 11.

Sorry, I should have copied the solution back into the public forum.  In Andrew's case there was a permissions problem, and this solution worked:

 

If you run this command in Terminal:

 

sudo chmod 666 /Library/Application\ Support/Symantec/AntiVirus/QuarantineFile.qtn

 

it should fix the problem   Note there's a space before "Support" and you'll be prompted for your admin user password. You may need to quit and relaunch NAV after doing this.

 

Let me know if this works.  I'm still trying to determine how the permissions may be getting set incorrectly.

 

-- Lee