VT Uploader

A Windows GUI client application providing an interface to the VirusTotal service API. The utility is designed for scanning files, hash sums, and objects from antivirus software quarantines.

Key Features

1. Object Analysis
   • Uploading and scanning files.
   • Uploading and scanning executable files of running processes.
   • Uploading and scanning objects from third-party antivirus quarantines (list of supported software).
   • Requesting reports for MD5, SHA-1, SHA-256 hash sums.
2. Data Management and Privacy
   • Configurable behavior when opening a file (hash calculation only, existing report request, automatic upload).
   • Optional warning when opening files with extensions not included in a specified list (to prevent uploading files containing personal data).
   • API key encryption when stored in the Windows Registry.
3. System Integration
   • Adding an item to the Windows Explorer Send to context menu.
   • Drag&Drop operation support.
4. VirusTotal Report Handling
   • Display of report summary and details.
   • Viewing raw JSON data.
   • Requesting reanalysis.
   • Opening of the report on the VirusTotal website.

Download

The current version of VT Uploader is 1.26.2.6. The utility can be run on any version of Windows starting with Windows XP. It requires no installation or additional frameworks and is completely portable.

WARNING: VT Uploader is a tool for additional analysis of suspicious files. It is not a substitute for, or a replacement for, full-fledged antivirus software. To ensure the protection of your system, you must have an installed and up-to-date professional antivirus solution. /* Place for your advertisement :) */

Documentation

Options Tab. Configure how VT Uploader interacts with VirusTotal and your system.

• Language dropdown list. Selects the user interface language for the application.
• API key field. Enter your personal API key obtained from your VirusTotal profile here. This key is required for all operations.
• Key information button. Click to check the key owner's details and current API request limits. Useful for monitoring your quota.
• Warn when opening a file with an extension NOT included in the lists checkbox. Warns you against mistakenly opening files (e.g., .jpg, .docx, .pdf) that may contain personal data. After a file is uploaded to the virustotal.com service, it becomes accessible to an unlimited number of people, which could lead to a personal data leak. When a file is opened, its extension is checked, and if it is not on the list, a warning message appears. However, the extension list is ignored if a PE/ELF/Mach-O executable file with a non-standard extension is opened.
• Action when opening a file dropdown list. Defines the default workflow.
  1. No action (Manual Control). Only calculates file hashes (MD5, SHA-1, SHA-256). You must manually click Load last report button to get the latest report for the file.
  2. Load last report, but do not upload the file (Privacy-First Check). Automatically fetches the latest existing report from VirusTotal. If the file is new to VirusTotal, it will NOT be uploaded. You will see a message and can choose to upload manually.
  3. Load last report, upload the file (Full Automatic Analysis). Fetches the latest report and, if the file is new, automatically uploads it, waits for analysis, and displays the fresh report.
• Request reanalyze if file was analyzed more than N days ago checkbox. Recommendation: keep this option DISABLED by default. File analysis on VirusTotal can be slow. Enabling this may cause significant delays when opening files with old reports. Use the manual Request reanalysis button in the File tab when needed.
• Create a subitem in the "Send to" menu / Delete the subitem in the "Send to" menu buttons. Adds or removes a VT Uploader shortcut to your Windows context menu. Right-click any file in Explorer, navigate to Send to, and select VT Uploader to launch the application with that file already opened.

VT Uploader settings can be stored in two locations. If there is a file with the same name and .ini extension in the utility's folder, the utility will use this file to store settings, with the API key saved in plain text without encryption. If the .ini file is absent, the utility will use the Windows Registry to store settings, with the API key saved in an encrypted form.

File Tab. The main workspace for analyzing files and viewing reports.

• Opening a File
  • Primary Method: Click the Select button to choose a file from your disk.
  • Drag&Drop: Simply drag any file from Windows Explorer and drop it onto the utility window.
• What happens next?
  • The utility immediately calculates and displays the MD5, SHA-1, and SHA-256 hashes.
  • The Action when opening a file setting (from the Options tab) determines the next step: doing nothing, fetching a report, or uploading and analyzing.
• Advanced Opening Methods. Click the arrow ▼ next to the Select button for advanced options:
  • Select process. Opens a list of all running processes. Select one to analyze its executable file.
  • Select file from [Antivirus Name] quarantine. There can be several such items; their number depends on how many antivirus programs and their quarantine folders the utility can detect. The full list of antivirus programs whose quarantines the utility can process is available here. Selecting this option opens a window displaying a list of objects in the selected quarantine. You can choose an object from the quarantine to be opened. Important! In some cases, accessing objects from quarantine requires administrator privileges. If necessary, the utility itself will suggest continuing with elevated rights. In some instances, the utility may not be able to access the actual content of the object and may only access its metadata, including the hash sum. When opening such an object, the utility can request a report based on its hash sum, but if this object was never uploaded to virustotal.com before, no report will be available.
  • Enter hash. Manually enter an MD5, SHA-1, or SHA-256 hash to check for an existing report, but if an object with this hash sum was never uploaded to virustotal.com before, no report will be available.
  • Paste from clipboard. Quickly open a file path or a hash value copied to your clipboard.
• Understanding the Report. Once loaded, the report shows:
  • Scan Date: Date of the last analysis.
  • Detection Rate: Number of antivirus engines that flagged the file as malicious (e.g., "12/68").
  • Detailed Results: A list of all antivirus engines, their version, and their specific verdict.
• Further Actions
  • Copy buttons. Copies report details to the clipboard.
  • View raw report button. Opens the original complete report in raw JSON format for advanced users.
  • Request reanalysis button. Manually requests VirusTotal to re-scan the file. Be prepared for a wait (from a few minutes to an hour).
  • Open last report on virustotal.com button. Opens your default browser directly to the detailed report page on the VirusTotal website.

List of supported antivirus programs

VT Uploader can extract objects from quarantines of the following antivirus programs (names and file paths where the utility searches for quarantine files):

1. 360 Total Security (c) Beijing Qihu Keji Co. Ltd.: 360safe.Summary.dat + .q3q files, .vir files
   • %DRIVE%:\$360Section
   • %DRIVE%:\360Rec
2. Acronis (c) Acronis International GmbH: .zip files
   • %PROGRAMDATA%\Acronis\NGMP\quarantine
3. Adlice Diag (c) Adlice Software: .meta files + .vir files
   • %PROGRAMDATA%\ADiag\quarantine
4. Adlice Protect (RogueKiller) (c) Adlice Software: .meta files + .vir files
   • %PROGRAMDATA%\RogueKiller\quarantine
5. Advanced System Protector (c) Systweak Software: QDetail.db + ._qt_ files
   • %APPDATA%\Systweak\Advanced System Protector\Quarantine
6. AhnLab (c) AhnLab, Inc.: quarantine files (magic "kp"\0x01\0x01"AhnLab Quarantine Data File"), .V3B files (magic "AhnLab Inc. 2006")
   • %PROGRAMFILES%\AhnLab\V3Lite40\Quarantine
   • %PROGRAMFILES%\AhnLab\V3IS90\Quarantine
   • %PROGRAMFILES%\AhnLab\V3IS80\Backup\V3B
   • %PROGRAMFILES%\AhnLab\V3IS2007\Backup\V3B
7. ALYac (c) ESTsecurity Corp: .aqi files + .ayq files (magic "AYCFS")
   • %PROGRAMDATA%\ESTsoft\ALYac\quarantine
   • %PROGRAMDATA%\ESTsoft\ALYac\collect
8. Amiti Antivirus (c) NETGATE Technologies s.r.o.: .ifc files
   • %APPDATA%\Amiti Antivirus\Cage
9. Arcabit (c) Arcabit: .aqv files
   • %PROGRAMDATA%\Arcabit\quarantine
10. Ashampoo Anti-Virus (c) Ashampoo GmbH & Co. KG: .EQF files (magic \0xF0\0xD9\0x86\0xA7\0xB1\0xEE\0xD9\0x47\0xB9\0xD4\0x58\0x14\0x65\0x6E\0x02\0x70)
    • %PROGRAMFILES%\Ashampoo\Ashampoo Anti-Virus\Quarantine
11. AulapG (c) Fajar Anggiawan: quarantine.ini + data files
    • %LOCALAPPDATA%\AulapG\Quarantine
12. Auslogics Anti-Malware (c) Auslogics Labs Pty Ltd: .info files + .quarantine files
    • %DRIVE%:\anti-malware.quarantine
13. Avast (c) Gen Digital Inc.: vault.db + .dat files, index.xml + data files
    • %DRIVE%:\$AV_ASW\$VAULT
    • %PROGRAMDATA%\AVAST Software\Avast\$AV_ASW\$VAULT
    • %PROGRAMDATA%\AVAST Software\Avast\chest
14. AVG (c) Gen Digital Inc.: vault.db + .dat files, index.xml + data files
    • %DRIVE%:\$AV_AVG\$VAULT
    • %PROGRAMDATA%\AVG\Antivirus\$AV_AVG\$VAULT
    • %PROGRAMDATA%\AVG\Antivirus\chest
15. Avira Antivirus (c) Avira Operations GmbH.: .qua files (magic "AntiVir Qua")
    • %PROGRAMDATA%\Avira\Antivirus\INFECTED
    • %PROGRAMDATA%\Avira\AntiVir Desktop\INFECTED
    • %PROGRAMDATA%\Avira\AntiVir PersonalEdition Classic\INFECTED
    • %PROGRAMDATA%\AntiVir PersonalEdition Classic\INFECTED
16. Avira Security (c) Avira Operations GmbH.: .qua files
    • %PROGRAMDATA%\Avira\Endpoint Protection SDK\quarantine
17. Baidu Antivirus (c) Baidu: .qv files
    • %PROGRAMFILES%\Baidu Security\Baidu Antivirus\%VERSION%\qv
18. BitDefender (c) Bitdefender: .dat files + .bdq files
    • %PROGRAMDATA%\Bitdefender\Desktop\Quarantine
    • %PROGRAMDATA%\Bitdefender\Desktop\QuarantineBackup
19. CMC Antivirus (c) CMC Cyber Security: .cmc files (magic "CMC Quarantined Malware")
    • %PROGRAMFILES%\CMC\Antivirus\JAIL
20. Combo Cleaner (c) RCS LT: .dat files + .bdq files
    • %PROGRAMFILES%\Combo Cleaner\quarantine
21. Comodo (c) Comodo Security Solutions, Inc.: [{GUID}.info files] + {GUID} files
    • %PROGRAMDATA%\Comodo\Cis\Quarantine\data
    • %DRIVE%:\CCE_Quarantine
22. C-Prot/Chomar (c) C-Prot UK: Chomar.db + .7z files
    • %PROGRAMDATA%\CHOMAR\Antivirus\Quarantine
    • %PROGRAMDATA%\CHOMAR\Internet Security\Quarantine
23. CybeeAI (c) Cybee.ai: data files
    • %PROGRAMFILES%\CybeeAI\Quarantine
24. CyberLock (c) VoodooSoft, LLC: quarantine.db + .voo files
    • %PROGRAMDATA%\CyberLock\Quarantine
25. Dr.Web/Dr.Web CureIt! (c) Doctor Web: .met files + data files
    • %DRIVE%:\DrWeb Quarantine
    • %USERPROFILE%\Doctor Web\CureIt Quarantine
26. Emsisoft (c) Emsisoft: .EQF files (magic \0xF0\0xD9\0x86\0xA7\0xB1\0xEE\0xD9\0x47\0xB9\0xD4\0x58\0x14\0x65\0x6E\0x02\0x70)
    • %PROGRAMFILES%\Emsisoft Internet Security\Quarantine
    • %PROGRAMFILES%\Emsisoft Anti-Malware\Quarantine
    • %DRIVE%:\EEK\Quarantine
27. eScan (c) MicroWorld Technologies Inc.: .vir files
    • %PROGRAMFILES%\eScan\INFECTED
28. ESET (c) ESET: .NDF files (magic "FQDF"/"EQDF") + .NAF files
    • %SYSTEM32%\config\systemprofile\AppData\Local\ESET\ESET NOD32 Antivirus\Quarantine
    • %SYSTEM32%\config\systemprofile\AppData\Local\ESET\ESET Security\Quarantine
    • %SYSTEM32%\config\systemprofile\AppData\Local\ESET\ESET Endpoint Antivirus\Quarantine
    • %LOCALAPPDATA%\ESET\ESET NOD32 Antivirus\Quarantine
    • %LOCALAPPDATA%\ESET\ESET Security\Quarantine
    • %LOCALAPPDATA%\ESET\ESET Endpoint Antivirus\Quarantine
    • %LOCALAPPDATA%\ESET\ESETOnlineScanner\Quarantine
29. FortiClient (c) Fortinet, Inc.: quarantine files (magic "QUARF")
    • %PROGRAMFILES%\Fortinet\FortiClient\quarantine
30. F-Prot (c) FRISK Software: quarantine files (magic "KSS")
    • %PROGRAMDATA%\FRISK Software\F-PROT Antivirus for Windows\fq
31. F-Secure (c) F-Secure: .qua files
    • %PROGRAMDATA%\Endpoint Protection SDK\quarantine
32. G Data (c) G DATA CyberDefense AG: .q files (magic \xCA\xFE\xBA\xBE)
    • %PROGRAMDATA%\G DATA\AVK\Quarantine
    • %PROGRAMDATA%\G DATA\AntiVirusKit Client\Quarantine
    • %PROGRAMDATA%\G DATA\AntiVirus ManagementServer\Quarantine
33. Gridinsoft Anti-Malware (c) Gridinsoft LLC: .info files + .zip files
    • %PROGRAMDATA%\GridinSoft\Anti-Malware\storage
34. Heimdal Next-Gen Antivirus (c) Heimdal
    • %PROGRAMDATA%\Microsoft\Windows Defender\Quarantine (not a mistake, Heimdal is actually using Windows Defender's quarantine)
35. HitmanPro (c) Sophos: quarantine.xml + GUID files [metadata only]
    • %PROGRAMDATA%\HitmanPro\Quarantine
36. Huawei HiSec Endpoint (c) Huawei Technologies Co., Ltd: quarantineDb.db + .QKYun files
    • %PROGRAMDATA%\EDR-Agent\Quarantine
37. Huorong Internet Security (c) Beijing Huorong Network Technology Co., Ltd.: QuarantineEx.db + quarantine files (magic "YPPY")
    • %PROGRAMDATA%\Huorong\Sysdiag\Quarantine
38. Intego (c) Intego: quarantine.dbiav + .iav files
    • %PROGRAMDATA%\Intego\quarantine
39. IObit Advanced SystemCare Ultimate (c) IObit: .dat files + .bdq files
    • %PROGRAMFILES%\IObit\Advanced SystemCare Ultimate\Antivirus\BackupRec
40. IObit Malware Fighter (c) IObit: .dat files + .bdq files
    • %PROGRAMFILES%\IObit\IObit Malware Fighter\Quarantine
41. K7 Antivirus (c) K7 Computing Pvt Ltd.: .qnt files (magic "K7Qt")
    • %PROGRAMDATA%\K7 Computing\K7TSecurity\K7AntiVirus\Quarantine
42. Kaspersky (c) AO Kaspersky Lab: .klq files (magic "KLQB")
    • %PROGRAMDATA%\Kaspersky Lab\%PRODUCTNAME%\QB
    • %PROGRAMDATA%\Kaspersky Lab\%PRODUCTNAME%\Quarantine
    • %PROGRAMDATA%\Kaspersky Lab\%PRODUCTNAME%\Backup
    • %DRIVE%:\KVRT2020_Data\Quarantine
43. Loaris Trojan Remover (c) Loaris Cybersecurity Inc.: .info files + .zip files
    • %PROGRAMDATA%\Loaris\Trojan Remover\storage
44. Malware Hunter (c) Glarysoft: .quq files
    • %DRIVE%:\$GlaryQuarantine
45. Malwarebytes (c) Malwarebytes: .data files + .quar files
    • %PROGRAMDATA%\Malwarebytes\MBAMService\Quarantine
    • %PROGRAMDATA%\Malwarebytes\Malwarebytes Anti-Malware\Quarantine
    • %PROGRAMDATA%\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine
    • %APPDATA%\Malwarebytes\MBAMService\Quarantine
    • %APPDATA%\Malwarebytes\Malwarebytes Anti-Malware\Quarantine
    • %APPDATA%\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine
46. McAfee (c) McAfee, LLC: .bup files (magic \0xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1)
    • %PROGRAMDATA%\McAfee\VirusScan\Quarantine
    • %DRIVE%:\QUARANTINE
47. Micropoint AntiVirus Software (c) Micropoint Corp.: mp100094.mpl + .dat files
    • %PROGRAMFILES%\MPAV\MP14
48. Microsoft Security Essentials (c) Microsoft
    • %PROGRAMDATA%\Microsoft\Microsoft Antimalware\Quarantine
49. mks_vir (c) mks_vir Sp. z o.o.: .aqv files
    • %PROGRAMDATA%\mks_vir\quarantine
50. NANO Antivirus (c) NANO Security: {9B7D1980-V004-*} files (magic \0x01\x0F\x13\xAE)
    • %PROGRAMDATA%\nanoav
51. NGAV (c) MSecure® Data Labs: .q files + .q00 files
    • %PROGRAMFILES%\NGAV Smart Security Anti-Malware\q
    • %PROGRAMFILES%\NGAV-NetGuardian\q
52. Norton (c) Gen Digital Inc.: .qbi files + .qbd files
    • %PROGRAMDATA%\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\%VERSION%\QBackup
53. Norton 360 (c) Gen Digital Inc.: vault.db + .dat files, index.xml + data files
    • %DRIVE%:\$AV_NLL\$VAULT
    • %PROGRAMDATA%\Norton\Antivirus\$AV_NLL\$VAULT
    • %PROGRAMDATA%\Norton\Antivirus\chest
54. OmniDefender (c) OmniDefender: .json files + .zz files
    • %PROGRAMFILES%\OmniDefender\Quarantine
55. Panda (c) Panda Security: GUID files
    • %PROGRAMDATA%\Panda Security\Panda Security Protection\Quarantine
56. PC Doctor (c) MSecure® Data Labs: .q files + .q00 files
    • %PROGRAMDATA%\AVHome\Q
57. Priil Internet Security (c) Priil Ltd: threatinfo.json + .vir files
    • %PROGRAMDATA%\Priil Internet Security\QuarantiedFiles
58. Protegent (c) Unistal Systems Pvt. Ltd.: .q files + .q00 files
    • %PROGRAMDATA%\PGHome\Q
59. Quick Heal (c) Quick Heal Technologies Limited: quarfun.db + data files
    • %PROGRAMFILES%\Quick Heal\Quick Heal Total Security\QUARANTINE
    • %PROGRAMFILES%\Quick Heal\Quick Heal Internet Security\QUARANTINE
    • %PROGRAMFILES%\Quick Heal\Quick Heal AntiVirus Pro\QUARANTINE
    • %PROGRAMFILES%\Quick Heal\Quick Heal IS Essentials\QUARANTINE
60. REVE Antivirus (c) REVE Antivirus: .dat files + .bdq files
    • %PROGRAMDATA%\REVE Antivirus\Common\Quar
61. Rising Antivirus (c) Beijing Rising Information Technology Co., Ltd.: .bin files (magic \0x4D\0x65\0xBC\0x02)
    • %DRIVE%:\RavBin
62. SecureAPlus/CatchPulse (c) SecureAge Technology: AntiVirus.db + .qr2 files
    • %PROGRAMDATA%\SecureAge Technology\SecureAge\AntiVirus\Quarantine
63. Shield Antivirus (c) ShieldApps Software Innovations: .qua files
    • %PROGRAMDATA%\Endpoint Protection SDK\quarantine
64. SiriusGPT (c) VoodooSoft, LLC: quarantine.db + .gpt files
    • %PROGRAMDATA%\SiriusGPT\Quarantine
65. SiyanoAV (c) Siyano Labs Pvt. Ltd.: .info files + .qfile files
    • %PROGRAMDATA%\SiyanoAV Antivirus Pro\QuarantiedFiles
    • %PROGRAMDATA%\SiyanoAV Internet Security\QuarantiedFiles
    • %PROGRAMDATA%\SiyanoAV Total Security\QuarantiedFiles
66. SMADAV (c) Smadsoft: .dav files (magic "Dav!")
    • %DRIVE%:\[Smad-Cage]
67. Spy Emergency (c) NETGATE Technologies s.r.o.: .ifc files
    • %APPDATA%\Spy Emergency\Cage
68. Spybot - Search & Destroy (c) Safer-Networking Ltd.: .zip files
    • %PROGRAMDATA%\Spybot - Search & Destroy\Quarantine
69. SUPERAntiSpyware (c) RealDefense LLC: quarantine.db
    • %APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\Quarantine
70. Symantec (c) Broadcom: .vbn files
    • %PROGRAMDATA%\Symantec\Symantec Endpoint Protection\%VERSION%\Data\Quarantine
71. Systweak Antivirus (c) Systweak Software: .qua files
    • %PROGRAMDATA%\Systweak\Systweak Antivirus\Endpoint Protection SDK\quarantine
72. T9 Antivirus (c) Tweaking Technologies: .qua files
    • %PROGRAMDATA%\Tweaking\T9 Antivirus\Endpoint Protection SDK\quarantine
73. TACHYON Internet Security (c) INCA Internet Corporation: Name_GUID files
    • %PROGRAMDATA%\TACHYON\T6\quarantine\Backup
    • %PROGRAMFILES%\Common Files\TACHYON\T5\Quarantine\Backup
74. Tencent PC Manager (c) Tencent: virusclean.db + data files
    • %PROGRAMDATA%\Tencent\QQPCMgr\Quarantine
75. Total Defence (c) Total Defense LLC: .dat files + .bdq files
    • %PROGRAMFILES%\TotalDefense\Suite\Anti-Virus\Quarantine
76. TotalAV (c) Total Security US LLC: .qh files + .dat files
    • %PROGRAMDATA%\SecuritySuite\Quarantine
77. Trellix Stinger (c) Musarubra US LLC: .zip files
    • %DRIVE%:\Quarantine\Stinger\quarantine
78. Trend Micro (c) Trend Micro Incorporated: quarantine files (magic \0xA9\0xAC\0xBD\0xA7)
    • %PROGRAMDATA%\Trend Micro\AMSP\quarantine
    • %PROGRAMFILES%\Trend Micro\HouseCall\log
79. Twister Antivirus (c) Filseclab Corporation: .TBI files (magic "Twister Quarantine File")
    • %PROGRAMFILES%\Filseclab\Twister\quarantine
80. Vipre (c) VIPRE Security Group, Inc.: QR{GUID}NNNNNNNN.xml files + {GUID}_ENC2 files + .dat files + .bdq files
    • %PROGRAMDATA%\VIPRE\Quarantine
81. Vir.IT eXplorer (c) TG Soft S.r.l.: .lst files + .cr2 files
    • %PROGRAMDATA%\viritlite\BACKUP
82. ViRobot Security (c) Hauri, Inc.: .vsq files
    • %PROGRAMDATA%\Hauri\ViRobot Security\Backup
83. VirusChaser (c) SGA EPS Co., Ltd.: VC90.db/VC100.db + .vir files
    • %PROGRAMFILES%\Virus Chaser\VC90\Backup
    • %PROGRAMFILES%\Virus Chaser\VC100\VCBack\VirBack
84. VIRUSfighter/SPYWAREfighter (c) SPAMfighter: data files
    • %PROGRAMDATA%\Common Toolkit Suite\AVEngine\Quarantine
85. Watchdog Anti-Malware (c) Watchdog Development: info + file
    • %LOCALAPPDATA%\WAMSDK\Quarantine
86. Watchdog Anti-Virus (c) Watchdog Development: info.json + file
    • %LOCALAPPDATA%\WSDK\Quarantine
87. Webroot (c) Open Text Corporation: dbl.db + .dat files
    • %PROGRAMDATA%\WRData\qrnexl
88. Windows Defender (c) Microsoft
    • %PROGRAMDATA%\Microsoft\Windows Defender\Quarantine
89. WinZip Malware Protector (c) WinZip Computing: QDetail.db + ._qt_ files
    • %APPDATA%\Nico Mak Computing\WinZip Malware Protector\Quarantine
90. WiseVector StopX (c) Beijing Zhilang Technology Co., Ltd.
    • %PROGRAMFILES%\WiseVector\qua
91. X-Sec Malware Scanner (c) X-Sec: .bin files
    • %DRIVE%:\X-Sec_Malware_Scanner_x64\Quarantine
    • %DRIVE%:\X-Sec_Malware_Scanner_x86\Quarantine
92. Xvirus Anti-Malware (c) Xvirus: quarantinedata.xdb + .infected files
    • %PROGRAMFILES%\Xvirus Anti-Malware\quarantine
93. Zillya (c) ALLIT Service LLC.: .avqr files (magic "ZAVQUAR", "ZISQUAR", "ZTSQUAR"), .zqr files (magic "ZAVQUAR")
    • %DRIVE%:\ZAV.QUAR
    • %DRIVE%:\ZIL.QUAR
    • %DRIVE%:\ZIS.QUAR
    • %DRIVE%:\ZTS.QUAR
94. ZoneAlarm (c) Check Point: GUID files
    • %PROGRAMDATA%\CheckPoint\Endpoint Security\Remediation\Quarantine

FAQ:

Q: Why is the list of supported antiviruses so short, and why is [Antivirus Name] not on it?
A: Several factors limit the list:

1. Encryption: The vast majority of modern antiviruses use strong encryption for quarantined files. Recent encryption methods have become too complex for reliable decryption without official documentation.
2. Technical Complexity: Full reverse-engineering of proprietary quarantine formats requires significant expertise and time, which is not always feasible.
3. Availability: Some antiviruses do not offer a trial version for testing, and corporate-grade security products are generally inaccessible for development purposes.

Q: What does the note "[metadata only]" mean?
A: This note indicates that the quarantine's encryption method is currently unknown. The utility can only extract an object's metadata (including its hash sum) but not the original file. You can request a VirusTotal report for the hash. However, if a file with this exact hash has never been uploaded to VirusTotal, no report will be available.

Q: My antivirus [Antivirus Name] stores its quarantine in [Dir Name], but this path is not in your list, and the utility cannot find it. How can I fix this?
A: The default search paths may not cover all possible custom installations. Please email me the details of your setup (antivirus name, version, and full path to the quarantine folder), and I will add this directory to the search list in the next update.

Q: I know the quarantine format/encryption method for [Antivirus Name]. If I share this information, can you add full support for it to the utility?
A: Yes, absolutely. I welcome community contributions. If you can provide a detailed description, and especially sample files (if possible), please contact me via email. I will be glad to implement full support for that quarantine in a future release.

Q: Can I extract a file from quarantine using VT Uploader?
A: No. VT Uploader is designed solely for uploading and checking objects on VirusTotal.com. To extract files from quarantine, you need to use the appropriate functionality of your antivirus software. As a last resort — for example, if the antivirus program has already been uninstalled — you can use my other utility, unQuar.

Contacts

You can contact me by email at da[@]vtuploader[.]com.

VT Uploader (c) Denis Anisimov 2025-2026