ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
How to un-quarantine a file
simonmason


Joined: 11 Oct 2009
Posts: 19
Reply with quote
I presume that the task of un-quarantining a file is a manual process involving renaming the file and moving it back to the original location? It would be helpful if clamwin stored the original location of the file in the quarantine directory (instead of having to look in the logs to figure it out). Also, it would be good if we could tell Clamwin to ignore the quarantine directory when scanning.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4226
Location: USA
Reply with quote
yes, it would be nice if someone could automate restoring from quarantine.

here's my configuration in clamwin filters config tab to exclude quarantine:
C:\Documents and Settings\All Users\.clamwin\quarantine\*

apoligies for the typing--i will only have the use of one hand for a few weeks.

regards,
View user's profileSend private message
simonmason


Joined: 11 Oct 2009
Posts: 19
Reply with quote
Thanks, it didn't occur to me to put a path into the filter screen. I thought I was limited to file formats only.
View user's profileSend private message
patricksnead24


Joined: 26 Oct 2009
Posts: 2
Reply with quote
Hi,


This is very good and informative discussion going on. Your posts will help me to upgrade. Any new suggestions for you ? Laughing



Thanks,
View user's profileSend private message
chrstnsln22


Joined: 20 Oct 2009
Posts: 1
Reply with quote
This is a really good suggestion to have a path where it should be going after quarantine because it's a pain in the ass to go over looking for that file



Christine
View user's profileSend private message
WE NEED A RESTORE FUNCTION
quaggi


Joined: 12 Nov 2009
Posts: 2
Reply with quote
I've just had 'virus' identified in the MS OFFICE UPDATES from Microsoft. Somehow I think this can't be correct !$$!#
We NEED a simple process that 'un-quarantines' an incorrectly identified virus.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4226
Location: USA
Reply with quote
Until the developers come up with something, my solution for the moment is to have CamWin Report Only, I verify it with Jotti/VirusTotal and then Quarantine/Remove if it is a real linfection. If not, I send the file to Clam so they can adjust their signature.

Regards,
View user's profileSend private message
blah1985


Joined: 24 Feb 2016
Posts: 2
Reply with quote
So this thread is super old, but for future wanderers I wrote a Jscript file for windows to do this.
It Moves all files from C:\Quar back to their original location(so remove real infected files first!!) run with command:
Code:
clamscan.exe c:\ -i -k --recursive=yes --log=z:\sweepLogs\%computername%.log --database=z:\ClamWinPortable\Data\db --move=c:\quar


Save the following as a .js file and run with cscript from command line so like
Code:
cscript unquar.js



Code:
/* Restore files in c:/quar to orginal location from Clam Win false positive.*/
String.prototype.trim = function()
{
    return this.replace(/^\s+|\s+$/g, '');
};
var fso, ws, ts;
fso = new ActiveXObject('Scripting.FileSystemObject');
ws = WScript.CreateObject('WScript.Shell');

var folder = fso.getFolder("c:/quar");
var fileCollection  = folder.files;

for(var objEnum = new Enumerator(fileCollection); !objEnum.atEnd(); objEnum.moveNext()) {
      var fileN = objEnum.item().name;
      var fileSplit = objEnum.item().name.split(".");
      var ext = fileSplit[fileSplit.length-1];
      if(ext == "infected")
      {
         var fileNE = "";
         for(var j = 0;j<fileSplit.length-1;j++)
         {
            fileNE+= fileSplit[j];
         }
         var ForReading= 1;
         
         ts = fso.OpenTextFile("c:\\quar\\"+fileN+".txt", ForReading, false);
         var fileContents = ts.ReadLine();
         ts.Close();
         var contSplit = fileContents.split("\\\\?\\");
         var fromWhere = contSplit[1].trim();
         var toWhere = contSplit[2].trim();
         fso.MoveFile(toWhere,fromWhere);
         WScript.Echo("Restored file back to " +fromWhere);
      }
   }

WScript.Quit();
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
Errr ...... or just run "Qrecover" which comes with Clamwin by default.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4226
Location: USA
Reply with quote
Yes, Qrecover is in the ClamWin\bin folder. For some time now, however, it doesn't automatically show you the quarantine folder--you have to use the file function to find it. The Clam Sentinel Recover program is much better, and it is accessed via the Clam Sentinel system tray menu. ClamWin should use that instead.

Regards,
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
Not sure why you say it doesn't open the quarantine folder. Once set it always opens the same correct quarantine folder for me.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4226
Location: USA
Reply with quote
For some time now (maybe a year), when using ClamWin Qrestore, I have been getting the message: "Could not find quarantine directory. Please use Open Quarantine Directory in the file menu and specify it manually". Next time I need to restore something, same thing happens. This is on a Win 8.1 laptop with AMD chip.

I have no problem accessing the quarantine folder via Clam Sentinel.

Regards,
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
The only thing I get is "Directory d:\quarantine folder does not contain any quarantine information. To open another directory use "file open...." etc"
That is different wording to your message but it is factually correct because there is nothing in my quarantine at present. If something IS in there, then it simply displays as you would expect.

I moved my default quarantine directory, and used FILE OPEN to point to it once, and it has remained pointing at it ever since. Never had a problem where I need to keep doing 'file open'.
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 561
Location: **UNKNOWN**
Reply with quote
@Bob: Have you tried a clean install of ClamWin and does it still happen? I, also, am not having any issues with Qrecover, either.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4226
Location: USA
Reply with quote
Yes--clean install doesn't help it. I have same problem on my X64 Surface and on my wife's X64 HP desktop. I guess it will sort itself out eventually. Clam Sentinel Restore works fine. It's like Qrestore doesn't read the location of the quarantine folder in the configuration file.

Regards,
View user's profileSend private message
How to un-quarantine a file
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 2  

  
  
 Reply to topic