ClamWin Free Antivirus :: View topic - How to un-quarantine a file

Posted: Sun Oct 11, 2009 12:32 pm

I presume that the task of un-quarantining a file is a manual process involving renaming the file and moving it back to the original location? It would be helpful if clamwin stored the original location of the file in the quarantine directory (instead of having to look in the logs to figure it out). Also, it would be good if we could tell Clamwin to ignore the quarantine directory when scanning.

Posted: Sun Oct 11, 2009 3:05 pm

yes, it would be nice if someone could automate restoring from quarantine.

here's my configuration in clamwin filters config tab to exclude quarantine:
C:\Documents and Settings\All Users\.clamwin\quarantine\*

apoligies for the typing--i will only have the use of one hand for a few weeks.

regards,

Posted: Sun Oct 11, 2009 3:26 pm

Thanks, it didn't occur to me to put a path into the filter screen. I thought I was limited to file formats only.

Posted: Mon Oct 26, 2009 4:50 pm

Hi,

This is very good and informative discussion going on. Your posts will help me to upgrade. Any new suggestions for you ? Laughing

Thanks,

Posted: Tue Oct 27, 2009 2:47 am

This is a really good suggestion to have a path where it should be going after quarantine because it's a pain in the ass to go over looking for that file

Christine

Posted: Thu Nov 12, 2009 3:12 pm

I've just had 'virus' identified in the MS OFFICE UPDATES from Microsoft. Somehow I think this can't be correct !$$!#
We NEED a simple process that 'un-quarantines' an incorrectly identified virus.

Posted: Thu Nov 12, 2009 3:22 pm

Until the developers come up with something, my solution for the moment is to have CamWin Report Only, I verify it with Jotti/VirusTotal and then Quarantine/Remove if it is a real linfection. If not, I send the file to Clam so they can adjust their signature.

Regards,

Posted: Wed Feb 24, 2016 8:02 pm

So this thread is super old, but for future wanderers I wrote a Jscript file for windows to do this.
It Moves all files from C:\Quar back to their original location(so remove real infected files first!!) run with command:

Code:

clamscan.exe c:\ -i -k --recursive=yes --log=z:\sweepLogs\%computername%.log --database=z:\ClamWinPortable\Data\db --move=c:\quar

Save the following as a .js file and run with cscript from command line so like

Code:

cscript unquar.js

Code:

/* Restore files in c:/quar to orginal location from Clam Win false positive.*/
String.prototype.trim = function()
{
return this.replace(/^\s+|\s+$/g, '');
};
var fso, ws, ts;
fso = new ActiveXObject('Scripting.FileSystemObject');
ws = WScript.CreateObject('WScript.Shell');

var folder = fso.getFolder("c:/quar");
var fileCollection = folder.files;

for(var objEnum = new Enumerator(fileCollection); !objEnum.atEnd(); objEnum.moveNext()) {
   var fileN = objEnum.item().name;
   var fileSplit = objEnum.item().name.split(".");
   var ext = fileSplit[fileSplit.length-1];
   if(ext == "infected")
   {
      var fileNE = "";
      for(var j = 0;j<fileSplit.length-1;j++)
      {
         fileNE+= fileSplit[j];
      }
      var ForReading= 1;

      ts = fso.OpenTextFile("c:\\quar\\"+fileN+".txt", ForReading, false);
      var fileContents = ts.ReadLine();
      ts.Close();
      var contSplit = fileContents.split("\\\\?\\");
      var fromWhere = contSplit[1].trim();
      var toWhere = contSplit[2].trim();
      fso.MoveFile(toWhere,fromWhere);
      WScript.Echo("Restored file back to " +fromWhere);
   }
}

WScript.Quit();

Posted: Tue Mar 08, 2016 9:04 am

Errr ...... or just run "Qrecover" which comes with Clamwin by default.

Posted: Tue Mar 08, 2016 3:59 pm

Yes, Qrecover is in the ClamWin\bin folder. For some time now, however, it doesn't automatically show you the quarantine folder--you have to use the file function to find it. The Clam Sentinel Recover program is much better, and it is accessed via the Clam Sentinel system tray menu. ClamWin should use that instead.

Regards,

Posted: Tue Mar 08, 2016 4:15 pm

Not sure why you say it doesn't open the quarantine folder. Once set it always opens the same correct quarantine folder for me.

Posted: Tue Mar 08, 2016 8:47 pm

For some time now (maybe a year), when using ClamWin Qrestore, I have been getting the message: "Could not find quarantine directory. Please use Open Quarantine Directory in the file menu and specify it manually". Next time I need to restore something, same thing happens. This is on a Win 8.1 laptop with AMD chip.

I have no problem accessing the quarantine folder via Clam Sentinel.

Regards,

Posted: Tue Mar 08, 2016 8:54 pm

The only thing I get is "Directory d:\quarantine folder does not contain any quarantine information. To open another directory use "file open...." etc"
That is different wording to your message but it is factually correct because there is nothing in my quarantine at present. If something IS in there, then it simply displays as you would expect.

I moved my default quarantine directory, and used FILE OPEN to point to it once, and it has remained pointing at it ever since. Never had a problem where I need to keep doing 'file open'.

Posted: Tue Mar 08, 2016 10:44 pm

@Bob: Have you tried a clean install of ClamWin and does it still happen? I, also, am not having any issues with Qrecover, either.

Posted: Tue Mar 08, 2016 11:24 pm

Yes--clean install doesn't help it. I have same problem on my X64 Surface and on my wife's X64 HP desktop. I guess it will sort itself out eventually. Clam Sentinel Restore works fine. It's like Qrestore doesn't read the location of the quarantine folder in the configuration file.

Regards,