View And Manage Quarantined Items, Move & Isolate Suspicious Files, Quarantine Items

View and Manage Quarantined Items

Click 'Security Sub-Systems' > 'Antivirus' > 'Quarantined Files' to open the quarantine interface

Quarantine is a secure holding area for potentially dangerous files. Quarantined files pose no threat to your system.

You can delete or restore quarantined items, or assign a file rating to them.

File ratings determine how CCS handles the file:

Files rated as 'Malicious' will stay in quarantine on the device.

Files rated as 'Unrecognized' will be restored to their original locations on the device. Future virus scans may flag them as malicious again.

Files rated as 'Trusted' will be restored to their original locations on the device. These files are skipped in future virus scans.

How do threats quarantined?

Windows Devices

Real time scans - Threats are placed in quarantine if:

'Show antivirus alerts' is disabled and 'Quarantine Threats' is set as the default action in the profile on the device. This setting is in the 'Realtime Scan Settings' area of the profile's antivirus section.

'Show antivirus alerts' is enabled and the end-user quarantined the threat at an alert.

See Realtime Scan settings if you want to read more about the antivirus section of a profile.

On-demand / Scheduled scans - Threats are placed in quarantine if:

'Automatically clean threats' is enabled and 'Quarantine' is set as the action in the profile on the device.

See Custom Scans in Antivirus Settings if you need more help with this.

DLP Scans

Documents quarantined by a Data Loss Prevention (DLP) scan are NOT shown in this interface. They are placed in a different quarantine area.

You can view DLP quarantined files at ‘Security Sub-Systems‘ > ‘Data Loss Prevention’ > ‘Logs’

You cannot restore DLP quarantined files remotely using Endpoint Manager. You can only restore them through Comodo Client Security on the endpoint.

Manual quarantine:

Admins can move threats to quarantine from the 'Current Malware List' interface.

End-users can move files to quarantine on their endpoint.

See View and Manage Identified Malware for more details.

MAC OS Devices

Real time scans - Threats are placed in quarantine if:

'Automatically quarantine threats found during scanning' is enabled is enabled in the profile on the device. This setting is in the 'Realtime Scan Settings' area of the profile's antivirus section.

The end-user chooses to quarantine the threat at an alert

See the explanation of Realtime Scanner settings in the section Antivirus Settings for Mac OS Profile under Create a Mac OS Profile

On-demand / Scheduled scans - Threats are quarantine if:

'Automatically quarantine threats found during scanning' is enabled in the profile on the device

See Manual Scanner settings and Scheduled Scanner settings for more help with this

Manual quarantine:

An administrator moved a threat to quarantine from the 'Current Malware List' interface

An end-user moved a file to quarantine on the endpoint

See View and Manage Identified Malware for more details.

Linux Devices

Real time scans - Threats are quarantine if:

'Automatically quarantine threats found during scanning' is enabled in the profile on the device. This setting is in the 'Realtime Scan Settings' area of the profile's antivirus section.

The end-user chooses to quarantine the threat at an alert

See Realtime Scanner settings for more help with this under Create a Linux Profile

On-demand / Scheduled scans - Threats will be placed in quarantine if:

'Automatically quarantine threats found during scanning' is enabled in the profile on the device

See Realtime Scanner settings and Scheduled Scanner settings to view help on these settings.

Manual quarantine:

An administrator moved a threat to quarantine from the 'Current Malware List' interface

An end-user moved a file to quarantine on the endpoint

See View and Manage Identified Malware for more details.

Items moved to quarantine are encrypted and not allowed to run.

Open the quarantine interface

Click 'Security Sub-Systems' > 'Antivirus'

Click the 'Quarantined Files' tab

Select a company or a group to view malware identified on their devices

Or

Select 'Show All' on the left menu to view malware identified on all devices enrolled to EM

'Quarantine Files' - Table of Column Descriptions
Column Heading	Description
OS	The operating system of the device at which the item was quarantined.
File Name	The file that was moved to quarantine. Click the name of a file to view its details. See View details of a quarantined item for more details.
Hash	The SHA1 hash value of the quarantined file Click the icon to copy the hash value to the clipboard.
Signature	The name of the identified malware. 'User Item' indicates the file was moved to quarantine manually by the user on the endpoint.
Comodo Rating	The file's trust level as rated by CCS.
Admin Rating	The trust rating of the file as set by the administrator. Files can be rated as trusted, malicious or unrecognized.
Devices Detected On	The number of devices on which the item was quarantined. Click the number to view the list of devices on which the item was quarantined See the explanation of Device Details given below
First Quarantined	Date and time at which the malware was identified and quarantined the first time.

The quarantine interface allows you to:

View details of a quarantined item

Restore False Positives from Quarantine

Remove Malware files from the devices

Rate files as 'Unrecognized', 'Trusted' or 'Malicious'

Export the list of quarantined files as a CSV file

View Details of a Quarantined Item

Click 'Security Sub-Systems' > 'Antivirus' > 'Quarantined Files'

Click on the file name of an item in the list:

This will open the file details interface which shows:

File Info - General information such as OS, file-name, hash, file rating, number of devices on which the file was quarantined, and more.

Device List - Shows list of endpoints upon which the file was found with their details like installation path of the file on each device, the device owner and the date and time at which the file was quarantined.

Device Details

The options on the top let you to:

Restore False Positives from Quarantine on a device

Remove the item from a device

Rate files as 'Unrecognized', 'Trusted' or 'Malicious'

See the following sections for more details

Manage Quarantine Items

If your review confirms that a quarantined item is a genuine threat then it can be deleted from endpoints.

Conversely, if an item is is found to be a false positive, you can restore it to its original location.

You can also rate a file as unrecognized, trusted or malicious based on your assessment. The new verdict will be sent to all endpoints and will be reflected in the 'Unrecognized' and 'Trusted' interfaces.

Restore False Positives from Quarantine

If the identified item is a false positive, select the item from the list and click 'Restore File(s) on Devices' from the options at the top.

The item will be restored to its original location on all devices and removed from the list.

Remove Malware files from the devices

Select the item(s) from the list and click 'Delete File(s) From Device' from the options at the top.

Click 'Confirm' in the confirmation dialog.

The file will be deleted from all devices at which it was quarantined and removed from the list.

Rate files as 'Unrecognized', 'Trusted' or 'Malicious'

If the rating of a quarantined file is changed to 'Trusted' or 'Unrecognized', the file is restored to its original location. The new rating is also stored in the CCS database on the devices.

To change the rating of a quarantined file, select it and click the appropriate button at the top:

A confirmation will be displayed and the information will also be sent to the devices.

Files rated as 'Malicious' will stay in quarantine on the device

Files rated as 'Unrecognized' will be restored to their original locations on the device. Future AV scans may flag them as 'malicious' again

Files rated as 'Trusted' will be restored to their original locations in the device. These files will be white-listed and skipped by future antivirus scans.

Export quarantined files records as a CSV file

Click 'Security Sub-Systems' > 'Antivirus' > 'Quarantined Files' tab

Click the funnel icon to filter which records are included in the report.

Click the 'Export' button and choose 'Export to CSV':

The report will be generated in .csv format.

The file will be available in 'Dashboard' > 'Reports'. See Reports if you need more help with this interface.

IT Endpoint Manager

Endpoint Manager Administrator Guide 6.43

English

View and Manage Quarantined Items