Quarantine, Delete, or Clean: Which Is Best for a Virus?

What It Means to Quarantine, Delete, and Clean Malware

Hand of hacker with squeegee wiping laptop computer screen
Oivind Hovland / Getty Images

Antivirus programs typically give three options for what to do when a virus is found: clean, quarantine, or delete. If the wrong option is selected, the results can be catastrophic. If it's a false positive, such a mishap can be even more frustrating and damaging.

While deleting and cleaning might sound the same, they definitely aren't synonymous. One is meant for removing the file from your computer and the other is just a cleaner that tries to heal the infected data.

What's more, quarantine does neither!

This can be very confusing if you're totally unaware of what makes quarantine or cleaning different than deleting, and vice versa, so make sure to read carefully before deciding what to do.

Delete vs Clean vs Quarantine

Here's a quick rundown of their differences:

  • Delete: Completely removes the file from the computer, which is useful if you don't want it anymore. This should be easy to remember because when you delete a file on your computer, it's no longer visible and can't be used. The same concept applies to an AV program.
  • Clean: To clean a virus is to remove the infection from the file but not actually delete the file itself. This is only pertinent to virus behavior, wherein a legitimate file has been infected with non-legitimate (usually viral) code. Use this option if you want to keep the file but just remove the malicious code.
  • Quarantine: Quarantining is moving the virus to a safe location that's managed by the antivirus software but not deleting it or cleaning it. It's similar to quarantining a sick person so that they can't infect anyone else; they're not removed permanently nor are they necessarily healed, but instead just isolated.

    As an example, if you instruct your antivirus software to delete all infected files, those that were infected by a true file infecting virus could also be deleted. This could impact the normal features and functionality of your operating system or programs you use.

    On the other hand, antivirus software can't clean a worm or a trojan because there is nothing to clean; the entire file is the worm or trojan.

    Quarantine plays a nice middle ground because it moves the file to safe storage under control of the antivirus application so that it can't harm your system, but it's there in case a mistake was made and you need to restore the file.

    How to Choose Between These Options

    Generally speaking, if it's a worm or trojan then the best option is to quarantine or delete. If it's a true virus, the best option is to clean. However, this assumes you are actually able to distinguish exactly what type it is, which may not always be the case.

    The best rule of thumb is to proceed from the safest option to the safest. Start by cleaning the virus. If the Antivirus scanner reports that it cannot clean it, choose to quarantine so that you have time to examine what it is and later decide if you want to delete it. Only delete the virus if the AV scanner specifically recommends, if you've done research and found that the file is totally useless and you're absolutely certain that it's not a legitimate file, or if there's simply no other option.

    It's worthwhile to check the settings in your antivirus software to see what options have been pre-configured for automatic use and adjust accordingly.