Configuring the Quarantine file task

This section provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.

If you suspect that an infected or probably infected file is on the computer, you can isolate it by moving it to quarantine.

Task creation is performed before, as an individual step.

If you selected the Open task details when creation is complete check box on the Finish task creation page during the task creation, proceed to step 4 of the following instruction.

To configure the Quarantine file task settings:

1. In the main Kaspersky Security Center Web Console window select Devices → Tasks.
2. To open the task settings window, click the task name.
3. Select the Application settings tab.
4. In the Please specify the file to be added to Quarantine drop-down list, select one of the following values: Specify the file by full path or Specify the file by folder path and checksum.
5. If you select the Specify the file by its full path option, specify the value in the File full path field.
6. If you select the Specify the file by folder path and checksum option, configure the following settings:
   • In the Checksum type drop-down list, select one of the following values: MD5 or SHA256.
   • Specify the value in the Checksum field.
   • Specify the value in the File folder path field.
7. In the Actions after file is quarantined group of settings, select whether the file must be deleted from the protected device after being quarantined.

   If the file is locked by another process, the file will only be deleted after the device has been rebooted.

8. In the Protection of critical system files group of settings, select the Do not perform actions on critical system files check box if you want to exclude critical system files from the task scope.

   If this option is selected and an object is a critical system file, the application does not perform any actions on this object. This information is logged in the task execution report.

9. Click the Save button.

You can start the created task manually or configure a scheduled task start.

If the file is locked by another process, the task will be displayed with the Completed status, but the file itself will only be quarantined after the device has been restarted. It is recommended to check whether the task was completed successfully after the device has been restarted.

The Quarantine file task may fail with the Access denied error if you try to quarantine an executable file that is currently running. To solve this problem, create the Terminate process task for this file and try to create a Quarantine file task again.

Page top