Identify and restore quarantined files

Every file cPFence v4+ quarantines is listed in the WebUI, where you can search for it, preview its content and put it back. Support users need access to the server plus preview and restore permissions.

Open the quarantine list

1. Open Threat & Malware Detection and choose one server in Server scope.
2. On Scan Summary, select Bulk quarantine actions, or open Advanced Tools → Restore Quarantined Files.

The list shows when each file was quarantined, its original path, where cPFence stores it and its status, Quarantined or Restored. Type part of the original or stored path in Search Quarantined Files to filter the list, and use Refresh list to reload it.

The quarantine list for one server. Paths are blurred. Select the image for full size; use browser Back to return.

Check the file before restoring it

Select Preview on a row to show the stored content below the list, then Close it when you are done.

Preview of a quarantined test file. Select the image for full size; use browser Back to return.

Match the original path and time with the detection email or the scan’s Details. If the path contains a website ID, search that ID in Enhance’s Manage Websites to find the owner. For email, note the mailbox path so the message goes back to the right mailbox.

Restore files

1. Tick the files to restore. Select all visible selects every file on the current page; your selection is kept when you move between pages.
2. Select Restore and check the server and number of files in Restore selected files.
3. Select Also mark as safe only for files you checked and know are clean. cPFence then skips them in future scans; you can undo this under Safe files.
4. Select Restore, or Cancel to keep the files in quarantine.
5. Check that each file’s status changes to Restored. A file already at the original path, or a missing stored copy, stops that file from being restored.

Restore selected files, with the optional Also mark as safe. Nothing was restored. Select the image for full size; use browser Back to return.

Verify before restoring

Restoring malware puts it back on the website. Do not overwrite a file that already exists at the original path or move stored copies by hand. If a restore stops partway, some files may already be back; select only the remaining ones.

Prevent another false-positive detection

Without Also mark as safe or a narrow path or signature exception, the next scan can detect the restored file again.

For a false positive, open the scan’s Details and select Report false positive next to the file; the flagged file is attached automatically. A report asks support to review the signature; it does not create an exception. See quarantine retention before delaying recovery.

From the command line

As root on the affected server, you can also read the malware detection history:

less /var/lib/cpfcli/scan/infections.history

Use / to search in less and q to leave. WordPress integrity has its own history; see WordPress integrity checks. Stored copies are kept under /var/lib/cpfcli/quarantine/ with different names from the originals, so always restore from the WebUI list using the original path.