Windows 10: restoring quarantined items

where is the history tab in MSE

:)

 

Where to restore quarantined items in Windows 10 creator update?

Hi,

As per the description of the issue, you would like to know how to restore files that has been quarantined by Windows Defender. For us to assist you, here's a simple guide on how to see where the quarantined files are located:

• Open Windows Defender.
• Go to History tab.
• In the History tab, check for Quarantined items.
• Place a check on the file that you want to restore, this should enable
  Allow item.
• Press Allow item, this should bring the file back to the original location.

To check where the files are located, kindly follow the steps listed below:

• Open Windows Defender.
• Go to History tab.
• In the History tab, check for Quarantined items.
• Click on view details.
• In the description, it will show you the file path where it is located.

Let us know if the resolution provided works.

 

Where to restore quarantined items in Windows 10 creator update?

Nothing has changed. We still have erroneous status reports in the Full history page just like we did in the All detected items page in the classic Defender interface. If a threat doesn't appear in the Quarantined threats list on the Scan history page, then
it wasn't actually quarantined.

So we need to correct the documentation here:

https://www.microsoft.com/en-us/wdsi/help/antimalware-faq

On Windows Defender Antivirus for Windows 10 version 1703 and later:

• Use the Windows search box to find and open the Windows Defender Security Center
• Navigate to the Virus & threat protection > Scan history.
• Under Quarantined threats, select See full history

On earlier versions of Windows:

• Open Microsoft Security Essentials or Windows Defender.
• Click the History tab.
• Select Quarantined items and then View details. You might be asked for an admin password or to confirm your choice.

Once you have reviewed the quarantined items you can:

• Select Remove all to delete all quarantined software.
• Select individual files, and then click Remove or Restore.
• Select Quarantined items and then View details. You might be asked for an admin password or to confirm your choice.

 

Where to restore quarantined items in Windows 10 creator update?

So far I had no joy so I dug around. There is a command line futility that can solve the problem if you grit your teeth and hold your tongue sideways.

1) Open a CMD prompt as adminstrator.

2) Visit the "C:\Program Files\Windows Defender" folder.

3) "dir *.exe" should show "mpcmdrun.exe". He is your best friend of the moment.

4) "mpcmdrun -?" gives a list of commands. Near the bottom are the interesting parameters. "-restore" says you want to restore.

mpcmdrun -restore -listall

This shows a list of quarantined items.

mpcmdrun -restore -all

This restores ALL quarantined items. Be afraid. Be very afraid. But it can be useful.

mpcmdrun -restore -name "fu.bar"

This will restore fu.bar to its rightful place in the universe.

Then figure out how to submit a false detection report to the Windows crew. (In my case I knew freaking well the file was clean and legitimate. I'd designed and built the file myself - a midi device driver DLL. The build detected was 4 years old already.)

I hope this rescues at least one person from Quarantine Hell.

{^_^}