Restore quarantined files

This article describes how to restore a file that has been quarantined by the anti-malware protection module.

Whether or not a file gets quarantined upon detection is determined by the settings in the Malware Scan Configuration that's in effect on the computer. (You can specify Malware Scan Configurations by opening the Computer or Policy editor You can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). and going to the General tab in the anti-malware module.)

You can find the list of available Malware Scan Configurations in the Deep Security Manager by going to Policies > Common Objects > Other > Malware Scan Configurations.

Create a scan exclusion for the file

Before you can restore the file to its original location you have to create a scan exclusion so that Deep Security doesn't immediately re-quarantine the file when it reappears on the computer.

The following instructions describe how to create an exclusion for the file on an individual computer but you can make the same configuration changes at the policy level.

To create a scan exclusion for the file

1. Open the Computers page and go to Anti-Malware > Identified Files and double click the quarantined file to view its properties.
2. Note the file's exact name and original location.
3. Still in the Computers page, go to Anti-Malware > General and click the Edit button next to each Malware Scan that's in effect to open the Malware Scan Configuration properties window.
   
4. In the Malware Scan Configuration properties window, click on the Exclusions tab.
5. In the Scan Exclusions area, select File List and then either press edit if a file list is already selected, or select New from the menu to create a new File List.
6. In the File List properties window, enter the file path and name of the file to be restored. Click OK to close the File List properties window.
   
7. Close the Malware Scan Configuration properties window by clicking OK.
8. When you've edited all the Malware Scan Configurations, click Save in the Computers page to save your changes. You're now ready to restore your file.

Restore your file

1. Still in the Computers page, go to the Anti-Malware > Identified Files tab.
2. Right-click the quarantined file and select Actions > Restore and follow the steps in the wizard.

Your file will be restored to its original location.