Dear Comodo Forums,
I have problems where comodo keep quarantine my file. Is there any function at the quarantine section, where i can add the file into trusted so that it won’t have to auto quarantine it again?
I have tried methods like going under firewall “define new trusted applications” to add the trusted file, but before i can do that, comodo quarantines the file, even when i restore the file, comodo agains quarantine it.
I have also tried to disable Defence+, Antivirus, sandbox, but still Comodo quarantines the file.
I am in dilemma. Are there any solutions to this? I have even submitted the file that they keep quarantine for analysis to tell them its a false positive. The file that keep being quarantined is inside the zip file which is called Sharkbite.thresher.dll
Thank you Comodo forums and admins =)
[attachment deleted by admin]
The usual advice is to disable auto-quarantine for any antivirus anyway, to avoid bad things to happen with false positives. But make sure that questions and actions are not surpressed (like it would be the case with “dont show questions if password is enabled”)! You can try to test the functionality with the EICAR testfile.
If you want to have an auto-quarantine feature though, you can move the file in question to the exclusion list. After you scanned it and choose: Ignore this file. Or you can insert it to the ecxlusion by browsing the path of the file. You find the exclusion list as a tab in the antivirus setting.
Keep in mind: Everything on that list will NEVER be scanned at all, as long as its in that list!
thank you Clockwork
i will add it in the exclusion list.but i have no idea how to disable auto quarantine in CIS premium.
can you provide a step by step guide?
Sorry for the trouble, but Thank you so much Clockwork =)
I dont have the antivirus running at the moment. Isnt there in each of the three settings windows (Guard, manual scan, sheduled scan) a box which says: Quarantine findings automatically? Just remove the checkmarks for that.
Again the warning: Make sure that you dont have any setting that surpresses alarms! Use the EICAR testfile to verify the antivirus function is running.
And every entry in the exclusion file list is never scanned again. If the file is erased, and something else takes its place, the exclusion is still valid for this same path, until you manually erase the list entry!
Still can’t find the
Quarantine findings automatically
Checkbox, if you have a screenshot, it will be better. Now i am trying the eicar test file…something really new to me… reading it now.
Thanks again Clockwork
I checked the manual. You are right.
We are two with the same question
Where is the setting to disable auto-quarantine now?
[attachment deleted by admin]
Btw, is the largeness of the arrows somehow intended to reflect something?
The setting position makes sense, if someone chooses to have no antivirus alerts.
Is it the case, that manual scannings never fall under the setting of surpressed alerts?
Only that I was trying to point at the checkbox without obscuring the dropdown box.
This is just my theory on the lack of auto-quarantine in regards to a manual scan. I’m not sure of the official stance.
With a manual scan, chances are pretty good that a user is going to be monitoring the scan. As such, there is no reason for the application to take action by itself. While real-time and scheduled scans can very well occur while the machine is unattended, and automatic action is perhaps desirable. (I always turn auto quarantine off)
Is valid for any antivirus. I could give an example of past two days
In that scenario it also helped to have the update frequence reduced, so i have a better chance not to get a bad update, before its fixed
Note: Think first if a reduced update frequence is reducing the protection in your case! And when you scan something, update the base before.