Tuesday, June 03, 2008

Deleting VirusScan Enterprise quarantine files

I am using the Networks Associate VirusScan Enterprise 8.0 with patch 10 and found out that it was using more than 400MB to store the quarantined files. Version 8.5 provides a tool that allows users to manage these files, the Quarantine Manager. However, version 8.0 don't have such tool and I was not even able to manually delete the corresponding ".Vir" files, since they were locked by the application.

Fortunately, I found a solution to overcome this problem in the McAfee Support Forums. Indeed it is quite simple.To delete files in the Quarantine directory, on must disable the On-Access Scanner, and delete the file. After that it is important to remember to enable it again. Although it can be done using GUI, I present bellow the corresponding console commands:

% cd \quarantine
% net stop mcshield
% del *.Vir
% net start mcshield

No comments: