Appendix B
111
B.2.3.1. Messages regarding infected files
In the event that an infected file is detected, the following record will be created
in the event log file:
<DATE> <TIME> SYS:\TEST\MY_FILE.EXE : infected::
<NAME> (User : <USER_NAME>)
SYS:\TEST\MY_FILE.EXE : <ACTION>,
where:
<DATE> – detected date,
<TIME> – detected time,
<NAME> – virus name,
<USER_NAME> – the name of the user whose file contained the virus,
<ACTION> – action applied to the infected file. Depending on the action you
have preset for the infected files (see section B.2.2 on page 106), the
<ACTION> string can take the following values:
•
disinfected
– the virus is removed
•
deleted
– the file is deleted
•
removed
– the file is quarantined
•
renamed
– the file extension is changed to .vir (or .vi1, .vi2 etc.,
if a file with the same name existed).
If you decide not to take any action on the infected file (the
No Action
option),
then the log record will contain only one line:
<DATE> <TIME> SYS:\TEST\MY_FILE.EXE : infected::
<NAME> (User : <USER_NAME>).
If for some reason the user-selected action cannot be applied to the infected file,
the log record will look as follows:
<DATE> <TIME> SYS:\TEST\MY_FILE.EXE : infected::
<NAME> (User : <USER_NAME>)
<DATE> <TIME> SYS:\TEST\MY_FILE.EXE : <FAILURE>,
where the <FAILURE> string can take the following values:
•
Disinfection error
•
Deletion error
•
Quarantining error
•
Renaming error
