Copyright © 2010 F-Secure Corporation. All rights reserved. Page 12 of 15
In case the automatic action for viruses is "Disinfect automatically" then no action will be done
on suspicious items (action will be reported as "failed" in scanning report in this case).
With the default action setting for manual scanning, "Ask what to do", the user will be able to
select an appropriate action on suspicious items. If the user chooses to select the actions
automatically in Scan Wizard then no actions will be done on suspicious items.
Malware/spyware/riskware removal may result in error messages about failures to
remove, or inconsistent removal actions may be reported [65349, 65257, 50979]
If malware/spyware/riskware has been already installed on the system (the
malware/spyware/riskware is active) then its removal may result in multiple infected items to be
reported. These different reported items may be part of the same malware/spyware/riskware.
When this malware/spyware/riskware is being removed then the removal may otherwise
succeed, but for some reported items, either error messages are shown, or action “None” is
shown and these items are not reported as “cleaned”, “deleted” or “quarantined”.
In some cases, there are inconsistencies between what the “Scan Wizard”, “Virus and spyware
history” and the scanning report (HTML file) report. Scan Wizard and the history may report the
malware as quarantined, while scanning report shows it as deleted.
This behavior may occur because the removal of one malware/spyware/riskware component
also removes some other components already before the removal of the other components is
executed. A typical scenario where this happens is when the “Perform full computer check”
scan is executed in an infected computer. As a result, error messages or action “None” are
shown for items that were originally detected as infected, but did not exist any more when the
product tried to remove them.
Another scenario is where the
“Quick malware scan” finds multiple similarly named
malware/spyware/riskware items. When the first discovered item is quarantined, the second
one will be quarantined automatically, resulting in all files of both malware/spyware/riskware
being quarantined under a single item. The scanning report (HTML file) may show the second
item as deleted not quarantined, while in fact it had been quarantined as part of the first item.
To make sure that the malware/spyware/riskware was removed correctly and the above
described errors or reporting inconsistencies do not indicate a real problem, restart the
computer after the removal operation and execute the “Quick malware scan” task again. If it
does not detect the malware any more then the removal has been successful.
Excluded filename extensions ignored for scans inside archives [50408]
The product may be configured to exclude files with particular name extensions to be excluded
from scanning. This exclusion is not applied to files scanned inside archive files. For example,
if a zip archive contains .mp3 files, the files are scanned even if the .mp3 extension is excluded
from scanning.
Viruses detected during ntbackup are not quarantined [47300]
In case the “Quarantine automatically” action on viruses is selected for real-time scanning and
the viruses are found while ntbackup is trying to back up the infected files, real-time scanning
will properly block access to the infected files, but the files will not be quarantined.
