Quarantine

The main function of the quarantine is to safely store reported objects (such as malware, infected files or potentially unwanted applications).

The Quarantine can be accessed from the ESET Endpoint Antivirus main program window by clicking Tools > Quarantine.

Files stored in the quarantine folder can be viewed in a table that displays:

• the date and time of quarantine,
• the path to the original location of the file,
• its size in bytes,
• reason (for example, object added by user),
• and a number of detections (for example, duplicated detections of the same file or if it is an archive containing multiple infiltrations).

I manage the Quarantine on client workstations remotely

Quarantining files

ESET Endpoint Antivirus automatically quarantines deleted files (if you have not canceled this option in the alert window).

Additional files should be quarantined if they:

• cannot be cleaned,
• if it is not safe or advisable to delete them,
• if they are falsely detected by ESET Endpoint Antivirus,
• or if a file behaves suspiciously but is not detected by the scanner.

To quarantine a file, you have multiple options:

• use the drag and drop feature to quarantine a file manually by clicking the file, moving the mouse pointer to the marked area while keeping the mouse button pressed and then releasing it. After that, the application is moved to the foreground.
• Click Move to quarantine from the main program window.
• The context menu can also be used for this purpose; right-click in the Quarantine window and select Quarantine.

Restoring from the Quarantine

Quarantined files can also be restored to their original location:

• Use the Restore feature from the context menu by right-clicking a given file in the Quarantine.
• If a file is marked as a potentially unwanted application, the Restore and exclude from scanning option is enabled. See also Exclusions.
• The context menu also offers the Restore to option to restore a file to a location other than the one from which it was deleted.
• The restore functionality is not available in some cases, for example, for files located on a read-only network share.

Deleting from the Quarantine

Right-click a given item and select Delete from Quarantine, or select the item you want to delete and press Delete on your keyboard. You can also select multiple items and delete them together. Deleted items will be permanently removed from your device and quarantine.

Submitting a file from the Quarantine

If you have quarantined a suspicious file that was not detected by the program, or if a file was determined to be infected incorrectly (for example, by heuristic analysis of the code) and subsequently quarantined, you can send the sample for analysis ESET Research Lab. To submit a file, right-click the file and select Submit for analysis from the context menu.