What to do if a virus is found

If Norton AntiVirus finds a virus or a file containing a virus or a potential security risk on your computer, there are several possible resolutions to the problem:

  • Fix infection
    Removes the virus from the file or if the threat is a worm or Trojan horse, deletes the file.
  • Quarantine infection
    Makes the file inaccessible by any programs other than a Symantec antivirus program. You cannot accidentally open the file and spread the virus, but you can still evaluate it for possible submission to Symantec.
  • Delete the file
    Removes the virus from your computer by deleting the file that contains the virus, worm, or Trojan horse. It should be used only if the file cannot be repaired or quarantined.
  • Exclude at-risk files
    Excludes the files at risk from future scans. If you exclude a file, you are doing so permanently from future scans. The threat may still be on your computer.

Viruses can be found during a manual or scheduled scan or by Auto-Protect when you perform an action with an infected file. Threats and security risks can appear during an instant messenger session, when sending an email message, or during a manual or scheduled scan.

More Info from the Symantec Knowledge Base Web site

More Information


If a virus is found during a scan

If Norton AntiVirus finds a virus, Trojan horse, worm, or security risk during a scan or from an instant messenger session, you either receive a summary of the automatic repair or deletion results, or use the Repair Wizard to resolve the problem.


Review the repair details

If you have set your manual scan options so that Norton AntiVirus repairs or deletes files automatically, and all infected files could be repaired or deleted, the scan summary lists the number of files found, infected, and repaired or deleted. This information is presented for status purposes only; you don't need to take further action to protect your computer. If you want to know more, you can check the repair details to see which files were infected and with which threats.

To review the repair details

  1. In the scanner window, in the Summary pane, click More Details.
  2. When you are done reviewing the results, click Finished.

Use the Repair Wizard


Use the Repair Wizard

If there are files that could not be fixed, or if you have set options so that Norton AntiVirus asks you what to do when a virus or threat is found, the Repair Wizard opens. If Norton AntiVirus did not attempt a repair, the Repair Wizard opens in the Fix Infection pane. Otherwise, it opens in the Quarantine window.

To use the Repair Wizard

  1. If the Repair Wizard opens in the Fix Infections pane, uncheck any files that you don't want Norton AntiVirus to fix.
    All files are checked by default. This is the recommended action.
  2. Click Fix.
    If any files cannot be fixed or deleted, the Quarantine Infections window opens. All files are checked to be added to Quarantine by default. This is the recommended action.
  3. In the Quarantine window, uncheck any files that you do not want to quarantine.
  4. Click Quarantine.
    If any files could not be quarantined, the Delete window opens. All files are checked to be deleted by default.
  5. In the Delete window, uncheck any files that you do not want to delete.
    6. If you do not delete the infected files, the virus or file at risk remains on your computer and can cause damage or be transmitted to others.
  6. Click Delete.
    If any files could not be deleted, the Exclude At-risk Files window opens to allow you to exclude files considered to be at risk from future scans.
  7. In the Exclude At-risk Files window, select any files that you want to exclude.
  8. Click Exclude.
  9. Once all of the files have been repaired, quarantined, deleted, or excluded, the Scan Summary window opens.
    10. If any files could not be deleted, they appear in the Scan Summary window with a status of at risk or delete failed. There are a variety of reasons why some files cannot be deleted: a file could be in use or part of a larger program. Norton AntiVirus recommends that you select the threat name to review the information from the Internet and determine the appropriate action.
  10. When you are done reviewing the summary, click Finished.

More Info from the Symantec Knowledge Base Web site


Scan Summary

The Scan Summary displays information about the scan just performed. It shows how many viruses were scanned, detected, repaired, quarantined, deleted, or excluded and indicates Inoculation changes.

Status | Description
Scanned | Indicates how many files, master boot records, and/or boot records were scanned.
Detected | Indicates how many of the above items, if any, were infected.
Repaired, Quarantined or Deleted | Indicates how many files, if any, were repaired, quarantined or deleted. You can view the items in Quarantine by clicking Reports in the Norton AntiVirus main window. Next to Quarantined Items, click View Report.
Excluded | Indicates how many files at risk were excluded from future scans.

If any viruses or potential risks still exist on your computer, a message appears at the bottom of the Scan Summary window.

Click the More Details button to get more information about remaining viruses. Click the name of the file to view its complete file name and location on your computer. If you have Internet access, click the Virus Name to go to the online Virus Encyclopedia Web site.

More Details also displays whether the scan checked for viruses in your computer's memory; what other types of files were scanned, such as compressed files; and the action taken on every infected file found on your computer.

Review the repair details


If a virus is found by Auto-Protect

Auto-Protect scans files for viruses when you perform an action with them, such as moving them, copying them, or opening them. If it detects a virus or virus-like activity, in most cases you receive an alert telling you that a virus was found and repaired. How you proceed depends on the operating system that you are using.

More Info from the Symantec Knowledge Base Web site


If you are using Windows 98/98SE/Me

If a virus or threat is found and repaired by Auto-Protect in Windows 98/98SE/Me, you receive an alert telling you which file was repaired or deleted.

To close the alert

  • Click Finish.

If you have set your options so that Auto-Protect asks you what to do when it finds a virus, the alert asks you to choose one of the following actions. The recommended action is always preselected.

Action | Result
Repair the infected file | Automatically eliminates the virus, Trojan horse, or worm and repairs or deletes the infected file. When a virus is found, Repair is always the best choice.
Quarantine the infected file | Isolates the infected file, but does not remove the threat. Select Quarantine if you suspect that the infection is caused by an unknown threat and you want to submit the threat to Symantec for analysis.
Delete the infected file | Erases both the threat and the infected file. Select Delete if Repair is not successful. Replace the deleted file with the original program file or backup copy. If the virus, Trojan horse, or worm is detected again, your original copy is infected.
Do not open the file, but leave the problem alone | Stops the current operation to prevent you from using an infected file. This action does not solve the problem. You will receive an alert the next time that you perform the same activity.
Ignore the problem and do not scan this file in the future | Adds the file that is suspected of containing a threat to the Exclusions list. When you add a file to the Exclusions list, the file is excluded from any future virus scans, unless you remove it from the list. Select this option only if you know that the file does not contain a virus.
Ignore the problem and continue with the infected file | Continues the current operation. Select this option only if you are sure that a virus, Trojan horse, or worm is not at work. You will receive an alert again. If you are not sure what to do, select Do not open the file, but leave the problem alone.

If a file cannot be repaired, you receive an alert telling you that the repair was not made and recommending that you quarantine the file. You have the same options as those listed in the table, with the exception of Repair the infected file.

More Info from the Symantec Knowledge Base Web site


If you are using Windows 2000/XP

If a virus is found and either repaired or automatically deleted by Auto-Protect in Windows 2000/XP, you receive an alert telling you which file was repaired or deleted and which virus, Trojan horse, or worm was infecting the file. If you have an active Internet connection, selecting the virus name opens the Symantec Web page that describes the virus.

To close the alert

  • Click OK.

If the file cannot be repaired, you receive two alerts, one telling you that Auto-Protect was unable to repair the file, and another telling you that access to the file was denied.

More Info from the Symantec Knowledge Base Web site

You can set your Auto-Protect options to try to quarantine any infected files that it cannot repair. If you do this, you are informed if any files are quarantined.

To resolve problems with unrepaired files

  1. Run a full system scan on your computer to ensure that no other files are infected.
  2. Follow the recommended actions in the Repair Wizard to protect your computer from the infected files.


If a threat is found by Worm Blocking

If a program tries to email itself or email a copy of itself, it could be a worm trying to spread via email. A worm can send itself or a copy of itself in an email message without any interaction with you.

Worm Blocking continually scans outgoing email attachments for worms. If it detects a worm, you receive an alert telling you that a malicious worm was found.

The alert presents you with options and asks you what to do. If you were not sending an email message at that time, then it is probably a worm and you should quarantine the file. You can click Help on the alert for additional information about how to respond.

After you have responded to the threat and deleted the file, you could still have an infected system. Follow these procedures.

Procedure For more information

Run LiveUpdate to ensure that you have the latest protection updates.

About protection updates

Scan your system.

Perform a full system scan

Go to the Symantec Security Response Web page for the most up-to-date virus definitions and clean-up tools.

See the Symantec Security Response Web page at securityresponse.symantec.com


Malicious worm alert

Norton AntiVirus has detected a malicious worm on your computer that is trying to email itself to other computers. If a Malicious worm alert appears when you are not sending an email message, the worm is trying to spread itself by email and you should select the "Quarantine this program (Recommended)" option from the drop-down list. You can see more information about the specific worm from the online Symantec Security Response virus encyclopedia.

To respond to a worm alert

  • In the alert window, select the action that you want to take. Your options are:

    Stop this program from emailing itself

    Stops the worm from emailing itself at this time, but does not quarantine the worm. This action leaves the worm on your computer, where it can possibly be activated again. Select this option only if you are sure you want to leave the worm on your computer.

    Quarantine this program (Recommended)

    Permanently stops the worm by putting it in the Norton AntiVirus Quarantine. While in Quarantine, the worm will not be able to spread itself. This is the safest action.

    Allow this program to email itself

    Sends the email containing the worm. If you allow the worm to be emailed, it could infect the recipient's computer. Select this option only if you are sure the email is not infected with a worm.

    Always allow this program to email itself

    Sends email containing the worm anytime it tries to email itself. In the future, Norton AntiVirus will not check this file for worms. This is the riskiest action because this worm could email itself from your computer without your knowledge.

To handle a worm-infected file

  • From the drop-down list in the alert, click Quarantine this worm (Recommended)

After the worm has been quarantined, follow these procedures:

Run LiveUpdate to ensure that you have the latest protection updates.

About protection updates

Scan your computer.

Perform a full system scan

If nothing is detected, submit the infected file to Symantec Security Response, indicating that Norton AntiVirus Worm Blocking detected the file and that you have scanned it with the latest virus definitions. Symantec Security Response will reply to you within 48 hours.


If Inoculation alerts you about a change in system files
Inoculation protection is available on Windows 98/98SE/Me systems only.

System files can change for a variety of reasons. You may have updated your operating system or repartitioned your hard disk, or you could have a virus. Norton AntiVirus alerts you when a change occurs in your system files.

If you get an alert about a change in your system files, you have two options. You can update your Inoculation snapshot or repair the file. Before you repair the file, be sure that your virus definitions are up-to-date and run a scan.

To respond to Inoculation changes

  • In the Alert window, select the action that you want to take. Your options are:

    Update the saved copy of my Master Boot Record

    Use if the alert appears after a legitimate change in system files.

    Restore my Master Boot Record

    Use if you are certain the system did not change for legitimate reasons.

    Ignore the change

    Use if you are not certain if the change is legitimate. After responding with this option, run LiveUpdate and then scan with Norton AntiVirus.

Ensure that protection settings are enabled


If Norton AntiVirus places files in Quarantine

Once a file has been placed in Quarantine, you have several options. All of the actions that you take on files in Quarantine must be performed in the Quarantine window.

The toolbar at the top of the Quarantine window contains all of the actions that you can perform on quarantined files.

Add Item | Adds files to Quarantine. Use this action to quarantine a file that you suspect is infected. This action has no effect on files that are already in Quarantine.
Properties | Provides detailed information about the selected file and the virus that is infecting it.
Repair Item | Attempts to repair the selected file. Use this action if you have received new virus definitions since the file was added to Quarantine.
Restore Item | Returns the selected file to its original location without repairing it.
Delete Item | Deletes the selected file from your computer.
Submit Item | Sends the selected file to Symantec. Use this option if you suspect that a file is infected even if Norton AntiVirus did not detect it.
LiveUpdate | Runs LiveUpdate to check for new protection and program updates. Use this if you haven't updated your virus definitions for a while and then try to repair the files in Quarantine.

To open the Quarantine window

  1. On the left side of the main window, under Norton AntiVirus, click Reports.
  2. In the Reports pane, on the Quarantined items line, click View Report.

To perform an action on a file in Quarantine

  1. In the Quarantine window, select the file on which you want to perform the action.
  2. On the toolbar, select the action that you want to perform.
  3. When you are finished, on the File menu, click Exit.

More Info from the Symantec Knowledge Base Web site


About Norton AntiVirus Quarantine

Sometimes Norton AntiVirus detects an unknown virus or other threat that can't be eliminated with the current set of virus definitions. Or, you have a file you think is infected that is not being detected. Norton AntiVirus prompts you to put the file in Quarantine or it quarantines it automatically. Files in Quarantine are isolated from the rest of your computer, so they cannot spread or reinfect your computer.

From the Norton AntiVirus Quarantine, you can send a file over the Internet directly to Symantec Security Response for analysis. Symantec Security Response determines if your file is infected. If the file is not infected, Symantec Security Response reports the results to you. If your file is infected with a new virus, Symantec Security Response will create and send you special updated virus definitions to detect and eliminate the new virus on your computer.

You must have an Internet connection to submit a sample and an email address to receive a reply. Once you submit the file in question, Symantec responds immediately with an acknowledgement email message including a tracking number you should use for further correspondence regarding this file. You are notified again by email with the results of the final analysis within 48 hours.

In addition to quarantined files, Quarantine stores two other groups of items:

  • Backup Items

    • Norton AntiVirus is preset to make a backup copy of a file before attempting a repair. After the repaired file is verified, you can delete the infected backup copy from Quarantine.

  • Items Submitted To Symantec Security Response

    • Files sent to Symantec Security Response for analysis are isolated. After receiving the results of the analysis, you can determine what to do with the files.

If you quarantine an individual file out of a compressed file it does not have an original name to restore to, so no location appears in the Original Location column.

More Info about what to do after you quarantine a file


Change Quarantine options

You change Quarantine options from the Quarantine window.

To change settings

  1. In the main window, under Norton AntiVirus, click Reports.
  2. In the Reports pane, on the Quarantined items line, click View Report.
  3. In the Quarantine window, click View > Options.
    4. If you set a password for Quarantine, Norton AntiVirus asks you for the password before you can continue.
  4. On the tab of the option you want to change, select the appropriate settings.
  5. Click OK.
    The changes take effect immediately.


If Norton AntiVirus cannot repair a file

One of the most common reasons that Norton AntiVirus cannot automatically repair or delete an infected file is that you do not have the most up-to-date virus definitions. Update your virus definitions with LiveUpdate and scan again.

If that does not work, read the information in the report window to identify the types of items that cannot be repaired, and then take one of the following actions, depending on the file type.

File type | Action
Infected files with .exe, .doc, .dot, or .xls file name extensions (any file can be infected) | Use the Repair Wizard to solve the problem.
Hard disk master boot record, boot record, or system files (such as IO.SYS or MSDOS.SYS) and floppy disk boot record and system files | Replace using the Rescue Disks or your operating system disks.

More Info from the Symantec Knowledge Base Web site

Keeping current with LiveUpdate


Look up viruses on the Symantec Web site

The Symantec Web site contains a complete list of all known viruses and related malicious code, along with descriptions. You must be connected to the Internet to look up viruses.

To look up viruses

  1. On the left side of the main window, under Norton AntiVirus, click Reports.
  2. In the Reports pane, on the Online Virus Encyclopedia line, click View Report.
    The Symantec Web site opens in your Internet browser.
  3. Use the links on the Web page to access the virus information for which you are looking.