Mcafee Security Center - How to remove quarantined items?

Jazza

I did a full scan of my pc today and mcafee found 7 trojans which they have quarantined. :eek:

I'm panicking a bit and trying to find out how to remove them.

I've got an option to restore but I think this means putting it back onto my hard drive - doesn't it?

How can I delete them from my system?

TIA

Debbie

rmg1

If McAfee has found something, it might be worth installing and updating MalWareBytes and running a full scan with that to see if it finds anything else.

Someone will probably be along with further instructions as well.

ankspon

Empty the quarantine bin

Jazza

Thanks rmg1, I've already got Malwarebytes installed and I'm running a full scan now.

davidhwdn how do I empty the quarantine bin ?

waddler_8

Don't be too worried about files that have been quarantined. Once in quarantine they can do no harm as they are rendered harmless by generally renaming, encrypting and password protecting them. In fact it's far better to leave them there for a while in case they turn out to be false positives. If they are, you can restore them - If you've deleted them from quarantine then you won't be able too.

Jazza

Thanks waddler_8, I'll leave it for a while as you've suggested

bruticus

The only thing I've noticed with McAfee is that sometimes it can pick up files that are in the Quarantine when it scans. As long as you realise they're there and not newly infected files....

waddler_8

If you can post the path to file/filename of the quarantined files that would be good.

Did malwarebytes find anything?

For future reference for clearing quarantine:
http://service.mcafee.com/faqdocument.aspx?id=TS101096

Jazza

Here's a list of the quarantined files


Detection Type Trojan
Detection Names: Generic Exloit!qn Generic Exloit!qn
Status: Quarantined
File name: \DEBBIE-PC\Backup Set 2010-09-02 134703\Backup Files 2010-09-05 190013\Backup files 1.zip


Detection Type Trojan
Detection Names: Generic Exloit!qn Generic Exloit!qn
Status: Quarantined
File name: \DEBBIE-PC\Backup Set 2010-09-02 134703\Backup Files 2010-10-10 190007\Backup files 1.zip


Detection Type Trojan
Detection Names: Generic Exloit!qn , Generic Exloit!qn, Generic Exloit!qn Generic Exloit!qn
Status: Quarantined
File name: \DEBBIE-PC\Backup Set 2011-03-28 072056\Backup Files 2011-03-28 072056\Backup Files 15.zip



Detection Type Trojan
Detection Names: Generic Exloit!qn , Generic Exloit!qn, Generic Exloit!qn Generic Exloit!qn
Status: Quarantined
File name: \DEBBIE-PC\Backup Set 2011-04-10 193222\Backup Files 2011-04-10 193222\Backup files 16.zip



Detection Type Trojan
Detection Names: Generic Exloit!qn , Generic Exloit!qn,
Status: Quarantined
File name: \Debbie@DEBBIE-PC\#D\DEBBIE-PC\Backup Set 2010-09-02 134703\Backup files 2010-09-05 190013\Backup files 1.zip


Detection Type Trojan
Detection Names: Generic Exloit!qn , Generic Exloit!qn,
Status: Quarantined
File name: \Debbie@DEBBIE-PC\#D\DEBBIE-PC\Backup Set 2010-09-02 134703\Backup Files 2010-10-10 190007\Backup files 1.zip


Detection Type Trojan
Detection Names: Generic Exloit!qn , Generic Exloit!qn, Generic Exloit!qn Generic Exloit!qn
Status: Quarantined

File name: \Debbie@DEBBIE-PC\#D\DEBBIE-PC\Backup Set 2011-03-28 072056\Backup Files 2011-03-28 072056\Backup files 15.zip


Malwarebyes didn't find anything.


Thank you for the mcafee faq document - I'm going to have a look at it now

waddler_8

The files are all archived backups, so Mcafee is seeing something inside them it doesn't like. With the detection name Generic Exloit!qn (Exploit?), it indicates exploit code.

Taking that, along with this very recent Mcafee Communities topic, I would guess the backups possibly contain files with Java exploit code within them (Java cache).

What type of backups are these? Full disk images?

Clear the Java cache before backing up: http://www.java.com/en/download/help/plugin_cache.xml

Or better still use OT's TFC: http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/