FortiGate Administration Guide - FirewallShop.com

AntiVirus
Quarantine
Note: If virtual domains are enabled on the FortiGate unit, antivirus features are configured
globally. To access these features, select Global Configuration on the main menu.
Viewing the Quarantined Files list
The Quarantined Files list displays information about each file quarantined
because of virus infection or file blocking. Sort the files by file name, date, service,
status, duplicate count (DC), or time to live (TTL). Filter the list to view only
quarantined files with a specific status or from a specific service.
To view the Quarantined Files list, go to AntiVirus > Quarantine > Quarantined
Files.
Figure 272:Quarantined files list
The quarantined files list has the following features and displays the following
information about each quarantined file:
Apply
Sort by
Filter
File Name
Date
Service
Status
Status
Description
DC
TTL
Select to apply the sorting and filtering selections to the quarantined
files list.
Sort the list. Choose from: status, service, file name, date, TTL, or
duplicate count. Select Apply to complete the sort.
Filter the list. Choose from status (infected, blocked, or heuristics) or
service (IMAP, POP3, SMTP, FTP, or HTTP). Select Apply to complete
the filtering. Heuristics mode is configurable through the CLI only. See
“Antivirus CLI configuration” on page 409.
The processed file name of the quarantined file. When a file is
quarantined, all spaces are removed from the file name, and a 32-bit
checksum is performed on the file. The checksum appears in the
replacement message but not in the quarantined file. The file is stored
on the FortiGate hard disk with the following naming convention:
.
For example, a file named Over Size.exe is stored as
3fc155d2.oversize.exe.
The date and time the file was quarantined, in the format dd/mm/yyyy
hh:mm. This value indicates the time that the first file was quarantined
if the duplicate count increases.
The service from which the file was quarantined (HTTP, FTP, IMAP,
POP3, SMTP, IM).
The reason the file was quarantined: infected, heuristics, or blocked.
Specific information related to the status, for example, “File is infected
with “W32/Klez.h”” or “File was stopped by file block pattern.”
Duplicate count. A count of how many duplicates of the same file were
quarantined. A rapidly increasing number can indicate a virus outbreak.
Time to live in the format hh:mm. When the TTL elapses, the FortiGate
unit labels the file as EXP under the TTL heading. In the case of
duplicate files, each duplicate found refreshes the TTL.
The TTL information is not available if the files are quarantined on a
FortiAnalyzer unit.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 403