Bitdefender GravityZone provides full visibility into organizations' overall security posture, global security threats, and control over its security services that protect virtual or physical desktops, servers and mobile devices. All Bitdefender's Enterprise Security solutions are managed within the GravityZone through a single console, Control Center, that provides control, reporting, and alerting services for various roles within the organization.

This article describes how GravityZone quarantine works and how to restore, delete and download quarantine files.

• Overview
• Restoring Quarantined Files
• Automatic Deletion of Quarantined Files
• Deleting Quarantined Files
• Downloading Quarantined Files in VMware Environments Integrated with vShield Endpoint

Overview

By default, the GravityZone security services isolate suspicious files and the malware-infected files that cannot be disinfected in a secure area named quarantine. When a virus is in quarantine it cannot do any harm because it cannot be executed or read.

Important: Quarantine is only available in Security for Endpoints and Security for Virtualized Environments.

The behavior of the quarantine is different for each component:

• Security for Endpoints stores the quarantined files on each managed computer. Using Control Center you have the option to either delete or restore specific quarantined files.
• Security for Virtualized Environments (Multi-Platform) stores the quarantined files on each managed virtual machine. Using Control Center you have the option to either delete or restore specific quarantined files.
• Security for Virtualized Environments (integrated with VMware vShield Endpoint) stores the quarantined files on the Security Server appliance. Using Control Center you have the option to delete quarantined files or download them to a location of your choice.

By default, quarantined files are automatically sent to Bitdefender Labs in order to be analyzed by the Bitdefender malware researchers. If malware presence is confirmed, a signature is released to allow removing the malware.
In addition, quarantined files are scanned after each malware signature update. Cleaned files are automatically moved back to their original location.
Control Center provides detailed information on all files moved to quarantine on the network objects managed from your account.
To check and manage quarantined files, go to the Quarantine page and choose the desired network object from the service selector.

Information about quarantined files is displayed in a table. You are provided with the following information:

• The name of network object the threat was detected on.

• The IP of network object the threat was detected on.

• Path to the infected or suspicious file on the network object it was detected on.

• Name given to the malware threat by the Bitdefender security researchers.

• Time when the file was quarantined.

• Pending action requested by administrator to be taken on the quarantined file.

To make sure the latest information is being displayed, click the Refresh button at the top of the table. This may be needed when you spend more time on the page.

Restoring Quarantined Files

On particular occasions, you may need to restore quarantined files, either to their original location or to an alternate location. One such situation is when you want to recover important files stored in an infected archive that has been quarantined.

To restore one or more quarantined files:

1. Log in to GravityZone web console.
2. Go to the Quarantine page.
3. Select the files you want to restore.
4. Click Restore at the top of the table.
   The files are restored to their original location.

Automatic Deletion of Quarantined Files

By default, quarantined files older than 30 days are automatically deleted. This setting can be changed by editing the policy assigned to the managed network objects.

To change the automatic deletion interval for quarantined files:

1. Log in to GravityZone web console.
2. Go to the Policies section.
3. Find the policy assigned to your target endpoints and click its name to edit it.
4. Navigate to Antimalware > Settings.
5. Under Quarantine, specify the number of days after which the quarantine files are to be deleted.
6. Click Save.
   The option is saved to your policy.

Deleting Quarantined Files

If you want to delete quarantined files manually, you should first make sure the files you choose to delete are not needed. Use these tips when deleting quarantined files:

• A file may actually be the malware itself. If your research leads you to such a situation, you can search the quarantine for the specific threat and delete it from quarantine.
• You can safely delete:

– Unimportant archive files.

– Infected setup files.

To delete one or more quarantined files:

1. Log in to GravityZone web console.
2. Go to the Quarantine page.
3. Select the files you want to delete.
4. Click Delete at the upper side of the table.
   To remove all files from the quarantine, click Empty Quarantine.

Downloading Quarantined Files in VMware Environments Integrated with vShield Endpoint

If you want to examine or recover data from quarantined files, you can download them from the Security Server using Control Center. Quarantined files are downloaded as an encrypted, password-protected ZIP archive to prevent accidental malware infection. To open the archive and extract its content, you must use the Quarantine Tool.

Quarantine Tool is a standalone application that does not require installation. Two versions are available: one for Windows and the other for Linux.

Warning: Use caution when extracting the quarantined files because they can infect your system. It is recommended to extract and analyze the quarantined files on a test or isolated system, preferably running on Linux. Malware infections are easier to contain on Linux.

To download quarantined files to your computer:

1. Go to the Quarantine page.
2. Choose Virtual Machines from the service selector.
3. Select the files you want to download.
4. Click the Download button at the right side of the Quarantine table.
   Depending on your browser settings, the files may be downloaded automatically to a default download location.

To access the quarantined files:

1. Download the appropriate Quarantine Tool for your computer from the following addresses:
   • Quarantine Tool for Linux
   • Quarantine Tool for Windows
     Note: Quarantine Tool for Linux is archived in a tar.gz file.
2. Open Quarantine Tool (for example, by double-clicking it).
3. Open the archive containing the quarantined files in Quarantine Tool by doing any of the following:
   • From the File menu, choose Open.
   • Click the Open icon on the toolbar.
   • Use the Ctrl+O keyboard shortcut.
   Files are organized in the archive by virtual machine they were detected on and preserving their original path.
4. Before extracting the archived files, if on-access antimalware scan is enabled on the system, make sure to either completely disable it or configure a scan exclusion for the location where you will extract the files. Otherwise, your antimalware program will detect and take action on extracted files.
5. Extract the archived files to the location of your choosing by doing any of the following:
   • From the File menu, choose Extract.
   • Click the Extract icon on the toolbar.
   • Use the Ctrl+E keyboard shortcut.

• Accessing and Restoring Quarantined Files in VMware Environments Integrated with vShield Endpoint