Loading...

Knowledge Center


Unable to recover quarantined or *.BUP files from quarantine when the original files existed on a network drive, SAN or NAS device
Technical Articles ID:   KB52438
Last Modified:  11/3/2016
Rated:


Environment

McAfee VirusScan Enterprise 8.8, 8.7i
NAS devices
SAN devices
Network drives
UNC locations
 

Problem

The Exchange transaction log triggered a Virus detection and was unable to restore a *.BUP file from the VirusScan Enterprise 8.x Quarantine Manager.

When the issue occurred, the quarantined item was located on a non-local drive such as:
  • Network-Attached Storage (NAS) devices
  • Storage Area Network (SAN) devices
  • Network drives or Universal Naming Convention (UNC) locations

Cause

Storing quarantined files on a non-local drive
This problem occurs when the operating system does not recognize the original path listed in the details for the quarantined item because the detection occurred on a NAS or SAN device or for a mapped network drive. If you configure quarantined files to be stored on a non-local drive, such as a network drive or UNC path, you run the risk that these files will be deleted rather than quarantined. If the defined drive cannot be reached (for example, if you are no longer connected to the network), files will be deleted without being quarantined elsewhere. There is no fallback to a local folder, and as a result, only local drives are supported.

In VirusScan Enterprise 8.x, some SAN or NAS exclusions can be made invalid because the path is sometimes translated as \Device\HardDiskVolume\ instead of  \Device\Harddisk\volume.

Solution

Use of non-local drives is not supported. Ensure your VirusScan Enterprise quarantine folder is located locally (default  setting).

  1. Verify or change the location of your quarantine folder. 
    1. Click Start, Programs, McAfee, VirusScan Console.
    2. Double-click Quarantine Manager Policy and type full name of the quarantine folder, then press ENTER.

      Default: C:\QUARANTINE 
       
    3. Click OK and exit VirusScan Console.
       
  2. Verify if you are able to potentially access quarantined files.
    1. Trigger a detection using an EICAR test file.

      EICAR is a standard test file for anti-malware products. For information about how to obtain and use EICAR, see KB59742.


       
    2. Click Start, Programs, McAfee, VirusScan Console.
    3. Double-click Quarantine Manager Policy and click the Manager tab.
    4. Locate and right-click the EICAR test file.
    5. Select Rescan.
      If this prompts another detection, files are accessible and could be restored if need be.

Rate this document

Affected Products

Beta Translate with

Select a desired language below to translate this page.

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.