Jump to content
krisku

Quarantine Failed - Cannot Restore

Recommended Posts

Immunet obviously found some malware in a file containing archived email messages from Outlook (archive.pst) and tried to quarantine the file. That probably failed because the file was open in Outlook, but somehow the archive.pst got quarantined anyway.

 

Now Outlook complains that archive.pst is missing, but when I look in Immunet's quarantined items, I can only find an archive.pst with event type "Quarantine Failed" and no way of restoring the file!!! Something has gone awry here..

 

In the quarantine folder I can see a large file that based on the size ought to be the missing archive.pst, but I have no way of restoring it. Can you help?

 

SDT dump is attached.

Immunet_Support_Tool_2010_08_11_09_40_36.zip

Share this post


Link to post
Share on other sites

Immunet obviously found some malware in a file containing archived email messages from Outlook (archive.pst) and tried to quarantine the file. That probably failed because the file was open in Outlook, but somehow the archive.pst got quarantined anyway.

 

Now Outlook complains that archive.pst is missing, but when I look in Immunet's quarantined items, I can only find an archive.pst with event type "Quarantine Failed" and no way of restoring the file!!! Something has gone awry here..

 

In the quarantine folder I can see a large file that based on the size ought to be the missing archive.pst, but I have no way of restoring it. Can you help?

 

SDT dump is attached.

 

It looks like the archive.pst is supposed to be in %userprofile%\appdata\local\microsoft\Outlook. First you'll want to see if the file exists there. If it is, then maybe it's corrupt. This is not likely the situation, but probably me hoping that we didn't screw this up. The more likely scenario is that there is a bug in which we quarantined the file, but did not write the record to the database. If you can email me (millard at immunet.com) the qrt file you see in the Quarantine folder, I can try and restore it or get the developer to do it.

 

--Millard

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...