Antivirus
Quarantined files list options
FortiGate-100A Administration Guide
01-28007-0068-20041203
293
Figure 153:Sample quarantined files list
Quarantined files list options
The quarantined files list has the following features and displays the following
information about each quarantined file:
Apply
Select Apply to apply the sorting and filtering selections to the quarantined
files list.
Sort by:
Sort the list. Choose from: status, service, file name, date, TTL, or duplicate
count. Click apply to complete the sort.
Filter:
Filter the list. Choose from status (infected, blocked, or heuristics) or
service (IMAP, POP3, SMTP, FTP, or HTTP). Click apply to complete the
filtering. Heuristics mode is configurable through the CLI only. See
“CLI
configuration” on page 299
.
File Name
The processed file name of the quarantined file. When a file is quarantined,
all spaces are removed from the file name, and a 32-bit checksum is
performed on the file. The file is stored on the FortiGate hard disk with the
following naming convention: <32bit CRC>.<processed filename>
For example, a file named Over Size.exe is stored as
3fc155d2.oversize.exe.
Date
The date and time that the file was quarantined, in the format dd/mm/yyyy
hh:mm. This value indicates the time that the first file was quarantined if the
duplicate count increases.
Service
The service from which the file was quarantined (HTTP, FTP, IMAP, POP3,
SMTP).
Status
The reason the file was quarantined: infected, heuristics, or blocked.
Status
Description
Specific information related to the status, for example, “File is infected with
“W32/Klez.h”” or “File was stopped by file block pattern.”
DC
Duplicate count. A count of how many duplicates of the same file were
quarantined. A rapidly increasing number can indicate a virus outbreak.
TTL
Time to live in the format hh:mm. When the TTL elapses, the FortiGate unit
labels the file as EXP under the TTL heading. In the case of duplicate files,
each duplicate found refreshes the TTL.
Upload status
Y indicates the file has been uploaded to Fortinet for analysis, N indicates
the file has not been uploaded.
The Delete icon.
The Download icon. Download the corresponding file in its original format.
The Submit icon. Upload a suspicious file to Fortinet for analysis.
Note:
Duplicates of files (based on the checksum) are not stored, only counted. The TTL value
and the duplicate count are updated each time a duplicate of a file is found.
Summary of Contents for FortiGate 100A
Page 12: ...Contents 12 01 28007 0068 20041203 Fortinet Inc ...
Page 24: ...24 01 28007 0068 20041203 Fortinet Inc FortiLog documentation Introduction ...
Page 72: ...72 01 28007 0068 20041203 Fortinet Inc Transparent mode VLAN settings System network ...
Page 80: ...80 01 28007 0068 20041203 Fortinet Inc DHCP IP MAC binding settings System DHCP ...
Page 114: ...114 01 28007 0068 20041203 Fortinet Inc Access profile options System administration ...
Page 232: ...232 01 28007 0068 20041203 Fortinet Inc Profile CLI configuration Firewall ...
Page 244: ...244 01 28007 0068 20041203 Fortinet Inc peergrp Users and authentication ...
Page 276: ...276 01 28007 0068 20041203 Fortinet Inc ipsec vip VPN ...
Page 338: ...338 01 28007 0068 20041203 Fortinet Inc Configuring the banned word list Spam filter ...
Page 356: ...356 01 28007 0068 20041203 Fortinet Inc syslogd setting Log Report ...
Page 374: ...374 01 28007 0068 20041203 Fortinet Inc Index ...