Quarantine Files

This scenario shows you how to quarantine a known malicious application.

Scenario Description

Copy and rename cmd.exe: "C:\Virus\malicious application.exe".

Scenario Resolution

1. On the managed computer, create the Microsoft Word document C:\document\important document.doc.
2. In the Altiris Console, select the Tasks tab.
3. In the left pane, select Tasks > Security Management > Application Control >
   Windows > Application Control Tasks > Manage Applications.
4. In the right pane, click and select Quarantine an application policy.
5. In Step 1 of the Application Control Wizard, click Next.
6. In Step 2, click the Include link.
7. In the Items Selector dialog, click , and select Dynamically Evaluated Filters > Win32 Executable File Filter.
8. In the Win32 Executable File Filter dialog, enter the following in the appropriate fields:
   • Name - Quarantine Malicious Applications
   • File Name - Malicious application.exe
9. Click Apply and close the dialog.
10. In the Items Selector dialog, click , select the newWin32 Executable File
    Filter, and click Apply.
11. In Step 3, Enable the policy, configure the policy as follows, and click Apply:
    • Name - Quarantine Malicious Applications.
    • Description - This is a sample policy for demonstrating the quarantine capabilities of Application Control Solution.
12. Run malicious application.exe on the managed computer.
13. A message appears and the file is moved to C:\quarantined files.