How to View Quarantined Files in Norton 360

To view quarantined files in Norton 360 on a Windows PC, open Norton, click Security in the left pane, click Security History, and choose Quarantine from the Recent History drop-down list. On a Mac, open Norton, click Security, then click Quarantine.

This covers the current Norton 360 app on Windows and Mac, using the labels on Norton’s current help pages. Older Norton 360 releases used other menu names, and those are listed under Troubleshooting.

Quarantine is a protected storage area inside Norton. A file that sits there is cut off from the rest of your computer, so it cannot run or be opened by other programs. The Windows steps follow Norton’s guide to acting on quarantined risks, which Norton lists as applying to Windows.

Before You Start

• Device: a Windows PC or a Mac with a current Norton 360 plan installed. Norton’s instructions call the app your “Norton device security product.”
• What you will see: only items Norton has quarantined on this computer. If Norton has not isolated anything, the list is empty.
• What viewing does: nothing changes when you only look. A file stays isolated until you choose an action for it.
• Account: some actions ask for administrator rights. On a Mac, Norton asks for your administrator password when you restore a file.

How to View Quarantined Files in Norton 360 on Windows

1. Open Norton 360 on your PC. The main window shows a menu down the left side.
2. In the left pane, click Security. The Security dashboard opens.
3. In the Security dashboard, click Security History. A window opens with a list of recent things Norton has done.
4. Open the Recent History drop-down list and select Quarantine. The list now shows only quarantined items.
5. Select an item to work with it. Use the icon beside the item to open its details or its options menu.

Security History has many categories besides Quarantine, including Full History, Scan Results, Resolved Security Risks, and Unresolved Security Risks. If you are looking for something Norton found but did not quarantine, check those categories as well. Full History shows everything Norton has logged in one list.

Another Way: Open the Quarantine Window

Norton also has a separate Quarantine window. Use it when you want to add a file yourself, delete an item, or change how much space Quarantine can use.

1. Open Norton 360.
2. In the left pane, click Security.
3. In the Security dashboard, click Quarantine. The Quarantine window opens.

More detail on this window is in Norton’s Learn more about Quarantine article. Not every Norton plan includes every feature, so if you do not see Quarantine on the dashboard, use the Security History route above.

How to View Quarantined Files in Norton 360 on a Mac

The Mac app has no Security History step. Quarantine opens straight from the Security dashboard.

1. Open Norton 360 on your Mac.
2. In the left pane, click Security.
3. In the Security dashboard, click Quarantine. The list of quarantined files appears.
4. Hover over a file and click the three dots icon to see what you can do with it.

Norton’s Learn more about Quarantine on Mac page lists these choices:

• Restore puts the file back where it was. Restore as lets you pick a new location; choose a folder and click Open. If Norton asks, type your Mac administrator password and click OK.
• Send for analysis asks you to choose Potentially malware or Potentially a false detection, not a malware, add any details, and click Send.
• Delete removes the selected file for good.
• Add a new File in the Quarantine view lets you quarantine a file yourself. Find the file and click Open.

There are three Mac-specific points to know. Quarantined files do not show up in Finder. A file restored to a different folder may not work properly. And once you uninstall Norton from your Mac, you can no longer restore quarantined files, so decide about anything you need before you remove the app.

How to Read the Details of a Quarantined Item

Check an item’s details before you do anything with it. On Windows, from Security History, open the item’s Advanced Details window. That window shows these fields:

• Time: the date and time of the activity.
• Severity: the risk level, which is High, Medium, or Info.
• Event: what Norton did.
• Status: the result of that action.
• Available Actions: what you can do next. The choices vary by category.

From there you can open File Insight, which is Norton’s report on a single file. Its Details tab covers things like how widely the file is used and how long ago it was released. Its Origin tab shows the file name and the web address it was downloaded from. Its Activity tab lists suspicious actions the file performed. Each tab is explained in Norton’s Learn more about File Insight in Security History article.

Two limits are worth knowing. Origin details exist only for files you downloaded or created after Norton was installed. And File Insight is not offered for every type of event.

What You Can Do With a Quarantined Item on Windows

Warning: Restoring files from Quarantine poses a high security risk and is meant for advanced users in specific cases, such as a critical system file that was moved there by mistake. Read this section fully before you choose a restore option.

Open the options menu next to the item. There are four choices:

• Restore: puts the item back in its original location. This is available only for items you quarantined manually.
• Restore as: moves the file to a folder you pick. Select the folder, then click OK.
• Create exception & restore: returns the item to its original location without repairing it, and stops future scans from detecting it. Use this only if you are confident the program is safe.
• Send for analysis: submits a file you believe was flagged by mistake so Norton can review it.

If Norton asks you to confirm, click Yes.

Norton does not repair an item when it restores it. It can disinfect a restored item during later scans, so scan the file after you bring it back. Here’s how to scan an individual file with Norton 360.

Should You Restore a Quarantined File?

Usually not. Leaving an item in Quarantine is the safe choice, because it cannot do anything while it is there.

A false positive is a clean file that security software flags by mistake. If you think that is what happened, Send for analysis is the lower-risk first step. Norton’s Security Response team reviews submissions, and personally identifiable information is never included in them.

Restore a file only when you trust its source: you know what it is, where it came from, and why you need it. If you do restore it and Norton keeps catching that same file, an exception for that one file is safer than a broad one. Never turn Norton’s protection off to get a file back.

If Norton keeps stopping an app you trust, the cause may be the firewall instead of Quarantine. In that case, here’s how to stop Norton 360 from blocking a program. If Norton removes a download you trust, read about turning off Norton Download Intelligence for a short time, and turn it back on afterward.

How to Add a File to Quarantine Yourself

You can quarantine a file that Norton did not flag. Close the file and any program using it first. Quarantining a file tied to running processes ends those processes.

1. Open Norton 360 and click Security.
2. Click Quarantine.
3. In the Quarantine window, click Add or Add file.
4. Browse to the file, select it, and click OK.

The file now appears in the Quarantine list. To report it, open the menu next to the item and select Send for analysis. You cannot add a Windows application file to Quarantine.

How to Delete Files From Quarantine

Warning: Deleting from Quarantine permanently removes the file from your PC, and it cannot be undone. If there is any chance you need the file, leave it where it is.

1. Open Norton 360 and click Security.
2. Click Quarantine.
3. Click the delete icon next to the item you want to remove.
4. In the confirmation window, click Yes.

The item disappears from the list. You do not have to delete quarantined files for your PC to be protected. They are already isolated.

How Much Space Quarantine Uses

By default, Norton gives Quarantine a maximum of 5120 MB, which is about 5 GB. Once Quarantine reaches that limit, new quarantined items get deleted automatically. Norton’s pages describe this size limit, not a time limit, so items are not removed after a set number of days.

1. Open the Quarantine window from Security > Quarantine.
2. Click the Settings tab.
3. Under Set storage space for Quarantine, enter a limit. Type 0 if you do not want any limit.

How to Confirm a Change or Undo It

What you did	How to confirm	How to undo
Restored a file	The file is back in its original folder, or in the folder you chose with Restore as.	Put the file back in Quarantine with Add file.
Added a file	The file appears in the Quarantine list.	Select Restore in the item’s options menu.
Sent a file for analysis	The item is still in the Quarantine list.	Nothing to undo. The file stays in Quarantine.
Deleted a file	The item is gone from the list.	It can’t be undone.

An exception made with Create exception & restore keeps working after the file is restored. Every exclusion lowers your protection, so remove it once you no longer need it:

1. Open Norton 360 and click Security.
2. In the Scans tile, click Open.
3. Select the Exclusions tab. Your excluded files and folders are listed there.
4. Click the delete X icon next to the item.

Norton’s exclusions help page covers adding and removing exclusions on Windows.

Troubleshooting

• The Quarantine list is empty. Norton may not have quarantined anything. Check the Resolved Security Risks, Scan Results, and Full History categories to see what Norton did with a detection.
• There is no Restore option. Norton offers Restore only for items you quarantined yourself. For an item Norton quarantined, the documented choices are Restore as and Create exception & restore.
• The menu names are different. Older Norton 360 versions used other labels, such as History instead of Security History, an Options button in the Details pane, and Restore & exclude this file. Run LiveUpdate to get the current version, then follow the steps again.
• Norton will not add a file. Windows application files cannot be added to Quarantine. For other files, close the file and anything using it, then try again.
• An item you expected is missing. It may have been deleted, or Quarantine may have reached its storage limit. Check the Settings tab in the Quarantine window.
• A restored file is caught again. Norton can detect it on the next scan. If you are sure it is safe, use Create exception & restore for that one file rather than excluding a whole folder, or send it for analysis and wait for Norton’s review.
• You want to save or print the list. Security History does not support exporting or downloading data. You can only view it in the app.
• Copy to Clipboard is grayed out. In File Insight, Norton disables that option for accounts that are not administrators.

Frequently Asked Questions

Next Step

Open Quarantine, read the details of each item, and leave anything you do not recognize where it is. While you are in Norton, you can also learn how to use Norton 360 to manage startup programs.