What is the VI2 file format?
A .vi2 file is a quarantine metadata record created by legacy versions of Kaspersky Anti-Virus and Kaspersky Internet Security. When Kaspersky detects a suspected malicious file and moves it to quarantine, it generates a .vi2 file storing information about the threat: the original file path, the detected threat name, the quarantine timestamp, original file size, and a hash or fingerprint of the file.
The .vi2 file contains only metadata - the actual malicious file content is stored separately in an encrypted or XOR-obfuscated vault maintained by Kaspersky. This separation prevents accidental execution of the quarantined object while preserving a record of what was isolated and why.
The extension name suggests "Virus Info version 2," an internal revision of an earlier .vi1 scheme used in older Kaspersky releases. The format is binary, proprietary, and deliberately opaque.
Important: do not manually delete .vi2 files. Doing so leaves orphaned encrypted objects in the quarantine store. Quarantined items should be managed through Kaspersky's built-in Quarantine interface (More Tools > Quarantine), where items can be restored or permanently deleted safely. Newer Kaspersky versions (2016 and later) use updated internal quarantine structures and no longer generate .vi2 files; these files are associated with legacy KAV and KIS installations only.
Security & safety
RISK: LOWThe .vi2 file itself is only metadata - it poses no direct execution risk. The associated quarantined file is stored encrypted by Kaspersky and cannot run from quarantine. Do not attempt to extract or restore quarantined objects manually unless you are certain the detection was a false positive; confirm via Kaspersky's interface. WARNING: If another antivirus scanner (not Kaspersky) flags a .vi2 file, it may be reacting to the encrypted malware content Kaspersky has encapsulated - this is expected behaviour, not a separate infection.
Format details
in a nutshellPrograms that open VI2 files
Windows1 app
Kaspersky Standard / Plus / Premium
Paid Open the Kaspersky application > More Tools > Quarantine (or Reports > Quarantine). From there you can restore, delete, or submit the quarantined object. Do NOT manually open or move .vi2 files. Technical details
deep spec| Encoding | Binary (proprietary Kaspersky internal format; deliberately opaque) |
| Byte order | Little-endian (Windows x86/x64) |
| Container | Flat binary metadata record; no wrapper |
| Typical file size | Under 10 KB (metadata record only) |
| Data stored | Original file path (Unicode string), detected threat name, quarantine timestamp, original file size, file hash/fingerprint |
| Magic bytes | None publicly documented |
| Naming convention | Name suggests 'Virus Info version 2' - an internal revision of an earlier .vi1 scheme |
| Paired quarantine object | The .vi2 stores only metadata; the actual malicious file is kept separately in an XOR-obfuscated or AES-encrypted Kaspersky vault |
| Platform | Windows only |
| Kaspersky version era | Associated with legacy KAV and KIS installations (pre-2016); newer Kaspersky versions use updated internal quarantine structures |
| Safe removal | Must be removed via Kaspersky's Quarantine UI (More Tools > Quarantine); manual deletion leaves orphaned encrypted objects |
| Integrity checking | None documented on the .vi2 metadata record itself; integrity is managed by the Kaspersky quarantine subsystem |
| Released | Late 1990s/early 2000s (Kaspersky Anti-Virus for Windows) |
VI2 conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about VI2 files.
