McAfee QUICKCLEAN 3.0 User's Guide download pdf (Page 23)

How quarantine works

McAfee MOVE AV Agentless implements a remote quarantine system, where quarantined files are

stored on an administrator‑specified network share.

In McAfee MOVE AV Agentless 2.6, the option for enabling Quarantine configuration and Quarantine network share

were present under the Scan policy, however, the latter has now been moved to the SVA policy. This

allows you to enable or disable quarantine for specific virtual machine. For details on assigning the Scan

policy to specific virtual machine, see How VM

‑

based scan configuration works.

The quarantine network share is mounted on the SVA during policy enforcement at /mnt/quarantine

using the Common Internet File System (CIFS) protocol. If mounting fails, the Quarantine Mount Failed

event is generated and mounting is attempted at the next policy enforcement.

A file is quarantined when:

• The Quarantine configuration option, which is present under Scan policy, is enabled.

• The Quarantine network share configuration, which is present under the SVA policy, is mounted.

• A detection occurs.

• Delete files automatically is the primary action.

Quarantined files are automatically deleted after 28 days.

The restore tool at-a-glance

This diagram provides an overview of how the quarantine restore tool works.

The restore tool requires Java Runtime Environment (JRE) 1.6 or 1.7.

For JRE 1.7 you must modify quarantine_restore.cmd by adding ‑Djava.net.preferIPv4Stack=true to the

JVMARGS variable.

Connect to a quarantine share.

View the list of quarantined files.

Monitoring and managing

How quarantine works

McAfee MOVE AntiVirus 3.0.0 Product Guide

1 2 ... 18 19 20 21 22 23 24 25 26 27 28 ... 40 41

No comments

McAfee QUICKCLEAN 3.0 User's Guide Page 23