Restore and exclude button is greyed out

[ucvijan 4]

Hi, 

 

As soon as put some clients in ERA, and install EEA, they appear to have some files that are quarantined, in the details of the client no scan has been done, and i can see the files in quarantine, and for the one i want to restore and exclude i cant (that option is grayed out). I can only restore them, but then after scanning is finished, same file is back to the quarantine. 

 

I want to restore and exclude it, and really hope that creating policy with exclusions is not the only way to do it. Cause that would mean that i have to create policy for every client, every file,to its own location. That would be a mess.

 

So simply put, how can I restore and exclude file from quarantine, so it wont appear again on the next scans. 

 

Thank you.

[michalp 20]

Some files in Quarantine may be flagged as non-excludable. Then ERA will not allow to exclude them from next scan. If you think that it is false positive, then please send sample to our virus lab so they can add exclusion for it.

[ucvijan 4]

Hi, 

There is no file for which i can exclude from quarantine. 

Will send you couple of screenshots, with the files, that should be ok, i think. Some executable files, some are non executable.

There are also non executable, but will post here only some programs. I have no option to exclude any file. Even from the PC itself, there is no option to exclude (its greyed out)

 

 

If there is need for other files, i can send a screenshot of all threats that are in quarantine, and i cant exclude any of file of those. And after next scanning, it returns back to quarantine. 

[ucvijan 4]

Hi,

 

Any update on this?

[Marcos 5,070]

Couldn't it be that those files weren't detected as potentially unwanted or unsafe applications? Only these can be excluded from scanning.

[ucvijan 4]

Well these are just a few, adobe, filezilla, thought they are ok executable. But there is no option for any file to the exclude. For example, as i wrote in other thread, whole thunderbird inbox is showing in quarantine, and i cant exclude it. So even if i want to exclude something, that eset sees as unsafe or threat, I cant do that? I can only delete it? Why cant I exclude anything i want, cause there is a lot of files i want excluded but i cant, i mean i can restore it, but on the first sacn it is back on quarantine. 

[samjo511 0]

This is the only way I found it.
You need restore the suspicious file and dont use that file related app or folder till you complete next step.

Go to advance setup > computer > antivirus and spyware > exclusions > Add > find and select the suspicious file > Ok

 

[Marcos 5,070]

So is it a false positive or PUA which was detected and quarantined that you want to restore? If FP, what was the detection name? Excluding any files or folders is not recommended as it deteriorates protection capabilities of the product and creates a security hole. Exclusions should be used with care and only in case there's no other option to solve issues.

[DurMaZoN 0]

Don't know what you think of this: Made a directory ...\Eset Temp Exclusions and added to the exclusions path. Restored the file to this directory for further examination in e.g. Acronis Try&Decide mode.

For me Eset is the best protection, in all those many years it has been my best companion and watchdog. I would be lost without it.