MBAM quarantine

[Tigzy]

Hello,

I need to get some quarantined files from a user's computer, and so I need to know were the files are kept on the hard drive.

Can you give me the path of MBAM quarantine?

Many thanks

[nosirrah]

As with many security apps there is an encryption process when quarantining to prevent other security apps from seeing the same malware as a threat thus creating a quarantine war between the two. If you were to gain access to these files they would be useless in their current form.

The better solution would be to un-quarantine them yourself (making sure to avoid bring back any registry entries and not rebooting), making copies of the file and then removing them again.

I would not instruct the user to do this themselves.

[Tigzy]

Ok, thanks for the reply.

I don't know if the user will take that risk...

Well, next time i'll cath them before MBAM suppress them.

[Tigzy]

Ok, so I just tried something like this:

* Zip the "%Appdata%/Malwarebytes/Malwarebytes antimalware/Quarantaine" folder

* Upload or send it by mail or whatever

* Unzip into a Quarantine MBAM's folder on another PC (VM is better for your security)

* Unquarantine the file you want from MBAM

It could not work properly if the destination folder doesn't exists.... I didn't tried.