Why when recovering a file from quarantine is the filename converted to lowercase and the creation and modification date/time changed? Why does Norton tamper with the files in this way?
Hi RHJenkins,
I believe that a file in quarantine is a copy of the original malicious file, which has actually been removed from your system, so some of its properties will differ from the original.
Hi SendOfJive:
Isn't the file just moved to Quarantine, where it is simply Sandboxed?
Atomic_Blast :)
Some programs move the file, others create a backup copy in quarantine. Compression, encryption and changing the file extension can also used. I think I have read that Norton creates a copy, but I am unable to locate anything on that now, so I'm not 100% certain of that. In any event, it would not surprise me that modifications to the file would result in some small noticeable changes in dates, etc.