Managing the quarantined files
The behavior of the quarantine is different for each environment:
Security for Endpoints stores the quarantined files on each managed computer. Using Control Center you have the option to either delete or restore specific quarantined files.
Security for Virtualized Environments (Multi-platform) stores the quarantined files on each managed virtual machine. Using Control Center you have the option to either delete or restore specific quarantined files.
Security for Virtualized Environments (integrated with NSX) stores the quarantined files on the Security Server appliance. Using Control Center you have the option to delete quarantined files or download them to a location of your choice.
Restoring quarantined files
On particular occasions, you may need to restore quarantined files, either to their original location or to an alternate location. One such situation is when you want to recover important files stored in an infected archive that has been quarantined.
Note
Restoring quarantined files is only possible in environments protected by Security for Endpoints and Security for Virtualized Environments (Multi-Platform).
To restore one or more quarantined files:
Go to the Quarantine page.
Choose Computers and VMs.
Select the check boxes corresponding to the quarantined files you want to restore. Quarantined files located inside archives can only be restored to a custom location.
Click the Restore button on the upper side of the table.
Choose the location where you want the selected files to be restored (either the original or a custom location on the target computer).
If you choose to restore to a custom location, you must enter the absolute path in the corresponding field.
Click Save. You can notice the pending status in the Action status column.
The requested action is sent to the target endpoints immediately or as soon as they get back online. You can view details regarding the action status in the Tasks page. Once a file is restored, the corresponding entry will disappear from the Quarantine table.
Adding exclusions for quarantined files
To exclude a quarantined file:
Go to the Quarantine page.
Choose Computers and VMs.
Select the checkbox corresponding to the quarantined file you want to exclude.
Click the Add exclusions button on the upper side of the table and confirm your action. The exclusion is automatically created and displayed in the Exclusions list from the Configuration Profiles page.
Downloading quarantined files
In VMware virtualized environments integrated with NSX, the quarantine is saved on the Security Server. If you want to examine or recover data from quarantined files, you must download them from the Security Server using Control Center. Quarantined files are downloaded as an encrypted, password-protected ZIP archive to prevent accidental malware infection.
To open the archive and extract its content, you must use the Quarantine Tool, a Bitdefender standalone application that does not require installation.
Quarantine Tool is available for the following operating systems:
Windows XP or newer
Most Linux 32-bit distributions with a graphical user interface (GUI).
Note
Quarantine Tool does not have a command line interface.
Warning
Use caution when extracting the quarantined files because they can infect your system. It is recommended to extract and analyze the quarantined files on a test or isolated system, preferably running on Linux. Malware infections are easier to contain on Linux.
To download quarantined files to your computer:
Go to the Quarantine page.
Choose Computers and VMs.
Filter the table data by entering the Security Server hostname or IP address in the corresponding field from the table header.
If the quarantine is large, to view the files you are interested in, you may need to apply additional filters or increase the number of files listed per page.
Select the check boxes corresponding to the files you want to download.
Click the
Download button at the upper side of the table. Depending on your browser settings, you will be asked to save the files to a folder of your choice, or the files will be downloaded automatically to the default download location.
To access the restored files:
Download the appropriate Quarantine Tool for your operating system from the Help & Support page or from the following addresses:
Note
Quarantine Tool for Linux is archived in a
tarfile.Run the Quarantine Tool executable file.
On the File menu, click Open (CTRL+O) or click the
Open button to load the archive into the tool.Files are organized in the archive by virtual machine they were detected on and preserving their original path.
Before extracting the archived files, if on-access antimalware scan is enabled on the system, make sure to either disable it or configure a scan exclusion for the location where you will extract the files. Otherwise, your antimalware program will detect and take action on extracted files.
Select the files you want to extract.
On the File menu, click Extract
(CTRL+E)or click the
Extract button.Select the destination folder. The files are extracted at the selected location, preserving the original folder structure.
Automatic deletion of quarantined files
By default, quarantined files older than 30 days are automatically deleted. This setting can be changed by editing the policy assigned to the managed endpoints.
To change the automatic deletion interval for quarantined files:
Go to the Policies page.
Find the policy assigned to the endpoints on which you want to change the setting and click its name.
Go to the Antimalware > Settings page.
In the Quarantine section, select the number of days after which files are being deleted.
Click Save to apply changes.
Manual deletion of quarantined files
If you want to manually delete quarantined files, you should first make sure the files you choose to delete are not needed.
A file may actually be the malware itself. If your research leads you to such a situation, you can search the quarantine for the specific threat and delete it from the quarantine.
To delete one or more quarantined files:
Go to the Quarantine page.
Select Computers and VMs.
Select the check boxes corresponding to the quarantined files you want to delete.
Click the Actions button at the upper side of the table and select Delete. Click Yes to confirm your action.
You can notice the pending status in the Action status column.
The requested action is sent to the target network objects immediately or as soon as they get back online. Once a file is deleted, the corresponding entry will disappear from the Quarantine table.
Emptying the quarantine
To delete all the quarantined objects:
Go to the Quarantine page.
Select Computers and VMs.
Click the Actions button and select Empty Quarantine.
Click Yes to confirm your action.
All the entries from the Quarantine table are cleared. The requested action is sent to the target network objects immediately or as soon as they get back online.