Resource icon

Quarantine: contained is different from deleted

What it means​

Quarantine isolates a detected file so the security tool can prevent normal use while you decide what to do. Microsoft says a quarantined threat is blocked and should not currently pose the same risk as an active file, but it has not necessarily been removed. A Threat blocked entry is different: Defender reports the item was blocked and removed.

A practical decision​

You download a supposed utility and Defender quarantines it. The safe first choice is to leave it contained while you verify the publisher and source. Restoring it puts the file back; allowing it can permit execution. Microsoft's Protection History definitions describe these actions and caution against Allow when uncertain.

What to check​

Record the threat name, file path and download source. If you do not need the file, remove it. If the tool is genuinely important, seek a signed official release or vendor clarification first. Quarantine does not undo data already stolen before detection, so an executed file may still require account review.
Posted by
Jack
Views
1
First release
Last update

Ratings

0.00 star(s) 0 ratings

More resources from Jack