[Restore from quarantine fail]

Hi. I have good news. Finally I restored the files has been quaratined. I did it from management center without any problem. 

I'dont know if this is the way, but it solved the problem. 

Thanks so much.

 

[Restore from quarantine fail]

Here's the log file. I hope it helps.

It begins before I open quarantine option and ends when the message "Restore fail" appears.

 

Thanks.

Logfile.zip

[Restore from quarantine fail]

5 minutes ago, itman said:

Was the file restored?

In any case the file was restored.

I'm using Remote Administrator and I have some folder exclusions. But any other policies are configured.

 

Thanks again.

[Restore from quarantine fail]

15 minutes ago, itman said:

I just restored a previous PUA detection from quarantine in EIS ver. 13.0.24. It restored w/o issue. It is restored to its original detected directory and is no longer present in Eset quarantine.

So if this is an issue, it must be in Endpoint versions only which I somewhat doubt.

Yes, this product is endpoint 7 for business.

 

13 minutes ago, itman said:

Here's a thought.

Does the location; i.e. full original directory path, where the PUA was originally detected still exist? Eset may have an issue with quarantine restoration if this is the case.

I restore to an existing folder and I try to use "restore to.." option too. The first show a fail message, the other don't show any.

 

 

 

[Restore from quarantine fail]

50 minutes ago, Marcos said:

The log doesn't contain any useful records. There was no single record containing "quarantine". Please do not apply any filter.

Marcos, do that expose some sensitive data. Any alternative?

Thanks

[Restore from quarantine fail]

1 hour ago, itman said:

Are you stating that the file upon being restored from quarantine later is again detected as a PUA and placed back into quarantine? If so, this is desired behavior since real-time protection re-scanned the file. The file needs to be excluded from real-time scanning either prior to restoration from quarantine or immediately thereafter.

Itman, thanks for reply. I tried with anothers sane files and the result is the same.

Thanks

[Restore from quarantine fail]

Marcos, thanks for reply. I attach the log file with some filters (Windows processes, and others), If you need the whole file please send me and email to send it.

 

Thanks

 

 

[Restore from quarantine fail]

Hello everybody, I'm new in the forum. The av is detecting some files as PUA and it send them to quarantine. 

The problem is when I try to restore them, the action fail. 

Details:

_ I run the action as admin, so I have privileges. 

_ The action is performed with the same OS user account the av detect the PUA.

_ The action is realized some minutes after the files are send to quarantine.

_ I browse the quarantine directory and it has the files.

_ Endpoint version: 7.1.20.53.0

_ OS version: Windows 7 Professional

 

Thanks in advance.