Solved Cant find quarantined file

[beldin]

Cant find file quarantined by Win Defender

Hi, i use Windows Defender as my AV (Windows 8.1 OS) and have a file quarantined. i wish to upload it to virus total before making the decision as to delete / allow it - the problem is i cant locate it to upload.

under the history tab of defender, the path is given for where it was (it is not there now) and i cant find the directory in which it is stored so i can upload to virus total (i thought it might be C>program data>microsoft>windows defender - but it isnt in any of those folders)

so can anyone plz tell me where i can find it?

 

[Nuccii]

You may look here:
C:\ProgramData\Microsoft\Windows Defender\LocalCopy

 

[beldin]

i did a google search before posting here, and that was suggested by someone else (though it was for win 7) - i had checked it anyway and that folder is empty.

 

[beldin]

bit the bullet and restored it so i could upload to virus total.

 

[adamf]

bit the bullet and restored it so i could upload to virus total.

I hope it worked out OK. I think the opposite approach (delete it and see if anything stopped working) may have been more prudent.

 

[beldin]

virus total had it 29 v 28 (or whatever - it was 1 difference) as to whether it was malware or not, and the user voting was like 28 (safe) v 3 (not safe).

i do not seem to be having any adverse effects, and i've seen posts of others allowing it without any trouble... so i think i'm ok

 

[adamf]

virus total had it 29 v 28 (or whatever - it was 1 difference) as to whether it was malware or not, and the user voting was like 28 (safe) v 3 (not safe).

i do not seem to be having any adverse effects, and i've seen posts of others allowing it without any trouble... so i think i'm ok

You took a risk if half virus scanners say it is a problem.

If 3 (for example) say malware and 57 say no then perhaps you can think it is a false positive. I wouldn't risk it but it would make sense.

If 28 say malware and 29 say not then you have to imagine half of their scanners are wrong (one way or the other). This means no-one knows (unless you particularly trust a specific company). So you decided to remove this from quarantine based on a 50/50 guess.

User votes are pointless (written by who?) and what trouble you expect to see I just don't know. Quite possibly you'll not notice anything. Or maybe (hopefully) it was benign.