Do not choose an action based only on the filename. When you are uncertain, Quarantine is the safest first step: it blocks the item from running while keeping it available for review.
When to quarantine
- The file is unfamiliar, unsigned, or located in an unusual temporary or startup folder.
- The path looks important to Windows or to a work application.
- You may need to report a false positive or preserve evidence for Support.
When deletion is appropriate
Delete or permanently remove an item when it is confirmed malware, no investigation is needed, and the system works normally after isolation and restart. Some active threats are removed during a reboot. Run a follow-up scan afterward to confirm that related files and persistence entries are gone.
If the file might be legitimate
- Leave it quarantined.
- Record the detection name, original path, publisher, and scan time.
- Use the in-app false-positive option or send a Support request.
Do not restore and permanently ignore an item merely to stop an alert. If Support confirms it is safe, update the Threat List before restoring it and create only the narrowest necessary exception.