Scanning disks, files, and data for viruses

Scanning disks, files, and data for viruses copyright 2004 Symantec

Keeping your computer protected requires regular monitoring by Auto-Protect, Norton Internet Worm Protection, and Worm Blocking; scanning of your email attachments and files transferred by instant messenger; and frequent system scans. All of these tasks can be set to occur automatically.

More Information


Ensure that protection settings are turned on

Ensure that protection settings are turned on copyright 2004 Symantec

Norton AntiVirus is configured to provide you with complete protection against viruses. It is unlikely that you need to change any settings. However, for maximum protection, you should ensure that your protection features are turned on.

The protection settings for each feature are found in Options.

To ensure that protection settings are turn on

  1. In the main window, click Options > Norton AntiVirus.

This table summarizes the maximum protection settings for each feature found in Options.

Feature Then for maximum protection, select

Auto-Protect

Turn on Auto-Protect

Email scanning

  • Scan incoming Email
  • Scan outgoing Email

Norton AntiVirus supports POP3 for incoming email and SMTP for outgoing email.

Norton Internet Worm Protection

  • Enable Norton Internet Worm Protection.

Timeout protection

  • Protect against timeouts when scanning Email
  • To prevent connection timeouts while receiving large attachments, turn on timeout protection.

Instant messenger scanning

  • Instant messenger clients that you want to protect

Worm Blocking

  • Enable Worm Blocking
  • Alert me when scanning email attachments


Manually scan disks, folders, and files

Manually scan disks, folders, and files copyright 2004 Symantec

If Auto-Protect is enabled and the Norton AntiVirus options are set at their default levels, you normally would not need to scan manually. However, if you choose, you can scan your entire computer, or individual floppy disks, drives, folders, or files.

Although the default settings for manual scanning are usually adequate, you can raise the level of Bloodhound heuristics or adjust the options for manual scanning in the Options window.


Perform a full system scan

Perform a full system scan copyright 2004 Symantec

A full system scan checks all boot records and files on your computer.

To perform a full system scan

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, click Scan my computer.
  3. Under Actions, click Scan.
    When the scan is complete, a scan summary appears.
  4. When you are done reviewing the summary, click Finished.

Use the Repair Wizard


Scan individual elements

Scan individual elements copyright 2004 Symantec

Occasionally, you may want to scan a particular file, removable drives, a floppy disk, any of your computer's drives, or any folders or files on your computer. You may have been working with floppy disks or have received a compressed file in an email message and suspect a virus. You can scan just a particular disk or individual element that you want to check.

To scan individual elements

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, select the scan that you want to run.
  3. Under Actions, click Scan.
    If you choose to scan all removable drives or a floppy disk, the scan starts automatically. If you choose to scan drives, folders, or files, a dialog box appears in which you choose which drives, folders, or files to scan.
  4. In the dialog box, make your selection, then click Scan.
    When the scan is complete, a scan summary appears.
  5. When you are done reviewing the summary, click Finished.

Use the Repair Wizard


If problems are found during a scan

If problems are found during a scan copyright 2004 Symantec

At the end of a scan, a summary report appears to tell you what Norton AntiVirus found during the scan. If a virus was found and you have requested that Norton AntiVirus repair the file automatically, it is listed as repaired. If the file cannot be repaired, it can be quarantined or deleted.

Use the Repair Wizard


Use custom scans

Use custom scans copyright 2004 Symantec

You can create a custom scan if you regularly scan a particular segment of your computer and don't want to have to specify the segment to be scanned every time. You can also schedule the custom scan to run automatically.

You can delete the scan when it is no longer necessary. For example, if you are working on a project for which you need to frequently swap files with others, you might want to create a folder into which you copy and scan those files before using them. When the project is done, you can delete the custom scan for that folder.


Create a custom scan

Create a custom scan copyright 2004 Symantec

Instead of running the default scans listed in the Scan for Viruses pane, you can create your own scans, that meet your specific requirements. This option may be helpful in many cases; for example, you can create a scan that checks a folder in which you store for downloaded files.

To create a custom scan

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, click Create custom scan.
  3. In the Norton AntiVirus Scan Wizard, click Next.
  4. Select the items that you want to scan. Your options are:

    Add files

    Select individual files to be scanned.

    Add folders

    Select folders and drives to be scanned.

    5. You can use both options to select the combination of items that you want.

  5. In the resulting dialog box, select the items that you want to scan.
    If you select a folder, all files in that folder are included. If you select a drive, all folders and files on that drive are included.
  6. Add the selected items to the list of items to scan by doing one of the following:
    • In the Scan Files dialog box, click Open.
    • In the Scan Folders dialog box, click Add.
  7. If you need to remove an item from the list, select it, then click Remove.
  8. When you are done creating the list of items to be scanned, click Next.
  9. Type a name for the scan by which you can identify it in the list of scans.
  10. Click Finish.


Run a custom scan

Run a custom scan copyright 2004 Symantec

When you run a custom scan, you do not have to redefine what you want to scan.

To run a custom scan

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, select the custom scan.
  3. Under Actions, click Scan.
    When the scan is complete, a scan summary appears.
  4. When you are done reviewing the summary, click Finished.


Delete a custom scan

Delete a custom scan copyright 2004 Symantec

You can delete custom scans if they are no longer needed.

To delete a custom scan

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, select the custom scan that you want to delete.
    3. If you click the button next to the scan name, the scan runs.
  3. Under Actions, click Delete.
  4. Click Yes to verify that you want to delete the scan.


Schedule scans

Schedule scans copyright 2004 Symantec

After installation, Norton AntiVirus automatically runs a weekly full system scan. You can also set up a schedule for custom virus scans.

You can schedule customized virus scans that run unattended on specific dates and times or at periodic intervals. If you are using the computer when the scheduled scan begins, it runs in the background so that you do not have to stop working.

You cannot schedule the predefined scans in the scan list, but you can schedule any custom scans that you have created.


Schedule a custom scan

Schedule a custom scan copyright 2004 Symantec

You have complete flexibility in scheduling custom scans. When you select how frequently you want a scan to run (such as daily, weekly, or monthly), you are presented with additional fields with which you can refine your request. For example, you can request a daily scan, then schedule it to occur every two days or every three days instead.

To schedule a custom scan

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, select the custom scan that you want to schedule.
    3. If you click the button next to the scan name, the scan runs.
  3. Under Schedule Task, click Schedule.
  4. In the Schedule dialog box, if Show multiple schedules is checked, click New to turn on the scheduling fields.
    If it is not checked, the fields are already enabled.
  5. Set the frequency and time at which you want the scan to run.
    Most of the frequency options include additional options that let you further refine the schedule. Set the additional options as necessary.
  6. When you are done, click OK.

You can also create multiple schedules for a scan. For example, you could run the same scan at the beginning of your work day and at the end.

To create multiple schedules for a single scan

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, select the custom scan that you want to schedule.
    3. If you click the button next to the scan name, the scan runs.
  3. Under Schedule Task, click Schedule.
  4. In the Schedule dialog box, check Show multiple schedules.
  5. To set an additional schedule, click New.
  6. Set the frequency and time at which you want the scan to run.
    Most of the frequency options include additional options that let you further refine the schedule. Set the additional options as necessary.
  7. When you are done, click OK.


Edit a scheduled scan

Edit a scheduled scan copyright 2004 Symantec

You can change the schedule of any scheduled scan, including the weekly full system scan.

To edit a scheduled scan

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, select the scan that you want to reschedule.
    3. If you click the button next to the scan name, the scan runs.
  3. Under Schedule Task, click Schedule.
  4. Change the schedule as desired.
  5. Click OK.


Delete a scheduled scan

Delete a scheduled scan copyright 2004 Symantec

You can delete any scan schedule. Deleting the schedule does not delete the scan.

To delete a scan schedule

  1. On the left side of the main window, under Norton AntiVirus, click Scan for Viruses.
  2. In the Scan for Viruses pane, under Task, select the scan whose schedule you want to delete.
    3. If you click the button next to the scan name, the scan runs.
  3. Under Schedule Task, click Schedule.
  4. In the Schedule dialog box, check Show multiple schedules.
  5. Select the schedule or schedules that you want to delete.
  6. Click Delete.
  7. Click OK.


Scan from the command line

Scan from the command line copyright 2004 Symantec

You can scan with Norton AntiVirus from the DOS window without opening the Norton AntiVirus main window. You enter the path and name of the file that you want to scan or customize the scan by adding a specific command. The following commands are available:.

Command | What it scans
NAVW32 [[pathname] options] pathname | Any drive, folder, file, or combination of these is scanned. If you want to scan a combination of items, use a space to separate the items. Use wildcards when specifying pathnames for a group of files (for example, NAVW32 A:C:\MYDIR\*.EXE).
/A | All drives, except drives A and B, are scanned.
/L | All local drives, except drives A and B, are scanned.
/S[+|-] | All subfolders specified in the pathname are scanned.
/M[+|-] | Enables (+) or disables (-) scanning of memory (for example, NAVW32 C:/M or NAVW32 D:/M-). (Available 0n Windows 98/Me only.)
/MEM | Only memory is scanned. (Available on Windows 98/Me only.)
/B[+|-] | Enables (+) or disables (-) scanning of boot records (for example, NAVW32 A: /Bor NAVW32 B: /B-).
/BOOT | Master boot records and boot records of all hard drives, plus any specified removable drives, are scanned.
/NORESULTS | No scan results are reported on screen.
HEUR:[0|1|2|3] | Set Bloodhound sensitivity (0 disables).

To scan from the command line

  1. On the command line, at the prompt, use the following syntax: NAVW32 /command path\filename. For example, NAVW32 /noresults c:\Mydirectory\mydocument.doc.
  2. Press Enter.

More Information

Scan active programs and start-up files from the command line


Start Norton AntiVirus from the command line

Start Norton AntiVirus from the command line copyright 2004 Symantec

If you are working from the command line (for example, writing a script or code), you can start Norton AntiVirus while you are still in DOS.

To start Norton AntiVirus from the command line

  1. At the command line, at the prompt, type the directory where Norton AntiVirus is located, and the executable. For example, "Program Files\Norton AntiVirus"\NAVW32.
  2. Press Enter.

Use the Scan Summary


Scan active programs and start-up files from the command line

Scan active programs and start-up files from the command line copyright 2004 Symantec

You can scan for memory and file reference infections from the command line. Your options are:

Command | What it scans
Navw32 /SESCAN | Scans exclusively for memory and file reference infections. The Repair Wizard appears only if the scan detects either infection.
Navw32 /SE+ | Scans for side memory and file reference infections, regardless of the option setting.
Navw32 /SE- | Does not scan for memory and file reference infections, regardless of the option setting.

Scan from the command line


CPDGlossary.html

CPDGlossary.html copyright 2004 Symantec


Create new or edit Auto-Protect Exclusion list

Create new or edit Auto-Protect Exclusion list copyright 2004 Symantec

If you are creating a new exclusion, type the name of the item that you want to exclude from virus checking. You can assign exclusions to drives, folders, groups of files, or single files. For example:

C:\program files\ | Excludes all files in the program files folder on drive C
\program files | Excludes all files in the program files folder on all drives (for example, C:\program files and D:\program files)
C:\myprogram.exe | Excludes the myprogram.exe file on drive C
myprogram.exe | Excludes the myprogram.exe file in all folders on all drives

If you specify the full path of a file (for example, C:\myprogram.exe), and then move or rename the file, the exclusion no longer works.

In Windows 2000/XP, you cannot exclude items inside a compressed file.

Wildcards

Wildcard characters, such as * or ?, can be used to exclude file extensions, provided that they are not specified as part of a path. For example:

*.xl? | Excludes all files on your computer with the extension .xl followed by any other single character
*.ex* | Excludes all files on your computer with the extension .ex followed by any number of characters

You cannot use a wildcard in a path. For example, C:\program files\*.xl? and C:\program ?????\ are not allowed.

You cannot specify a file name with a wildcard extension. For example, myfile.xl? is not allowed.

If you set an exclusion, you have reduced the level of protection against threats.

About Auto-Protect Exclusions options


Expired Subscription Alert

Expired Subscription Alert copyright 2004 Symantec

Your subscription for Norton AntiVirus has expired.

A valid Norton AntiVirus subscription is required for you to receive virus definitions from Symantec. However, you can continue to receive program updates without renewing your subscription.

Maintain uninterrupted protection


Subscription Alert

Subscription Alert copyright 2004 Symantec

Your subscription for Norton AntiVirus is about to expire.

A valid Norton AntiVirus subscription is required for you to receive virus definitions from Symantec.

Maintain uninterrupted protection


Norton AntiVirus - Application Activities

Norton AntiVirus - Application Activities copyright 2004 Symantec

Selecting Application Activities on the left side of the Log Viewer displays details about Norton AntiVirus activities, such as virus scans. The list on the right shows the type of action that was taken and other information. The bottom of the Log Viewer window shows details about individual actions.

Monitor Norton AntiVirus activities


Norton AntiVirus - Errors category

Norton AntiVirus - Errors category copyright 2004 Symantec

Selecting Errors on the left side of the Log Viewer displays errors that Norton AntiVirus has generated. The list on the right shows the error message, the Norton AntiVirus feature that generated the error, and other information. The bottom of the Log Viewer window shows details about individual error messages.

Monitor Norton AntiVirus activities


Norton AntiVirus - Threat Alerts

Norton AntiVirus - Threat Alerts copyright 2004 Symantec

Selecting Threat Alerts on the left side of the Log Viewer displays details about the viruses or threats that Norton AntiVirus has detected. The list on the right shows the name of the threat, which action Norton AntiVirus took to repair or quarantine the virus, and other information. The bottom of the Log Viewer window shows the original location of the infected file on your computer and, if available, a link to the online Symantec Virus Encyclopedia for more information.

Monitor Norton AntiVirus activities


Norton Internet Worm Protection

Norton Internet Worm Protection copyright 2004 Symantec

Internet Worm Protection prevents certain network worms and other Internet threats from attacking your computer by employing basic inbound port blocking (which utilizes known worm signatures) and network monitoring methods. The Log Viewer tracks activities relating to Norton Internet Worm Protection, such as programs accessing the Internet, port activity, or any detected worms.

On the left side of the Log Viewer window, you can click on any of the log categories under Norton Internet Worm Protection to see recent activity. To get help on a category, select a category and click the help button (question mark button). For help on how to use the Log Viewer, click the help button without a category selected, or click Help > Help Topics.


Norton Internet Worm Protection - Activities

Norton Internet Worm Protection - Activities copyright 2004 Symantec

Selecting Activities on the left side of the Log Viewer displays details about network communication intercepted by Internet Worm Protection and rules that were processed. The bottom of the Log Viewer window shows alerts displayed to the user, unused ports blocked, and AutoBlock events.


Norton Internet Worm Protection - Alerts

Norton Internet Worm Protection - Alerts copyright 2004 Symantec

Selecting Alerts on the left side of the Log Viewer displays any security alerts triggered by possible attacks on your computer. The bottom of the Log Viewer window shows details about the alerts and, if available, a link to the Symantec Web site for more information. This provides a history of possible attacks on your system.


Norton Internet Worm Protection - Connections

Norton Internet Worm Protection - Connections copyright 2004 Symantec

Selecting Connections on the left side of the Log Viewer displays a history of all TCP/IP network connections made with this computer. Connections are logged when the connection is closed. The bottom of the Log Viewer window shows details about individual connections.


Norton Internet Worm Protection - System

Norton Internet Worm Protection - System copyright 2004 Symantec

Selecting System on the left side of the Log Viewer displays details about the program's activity as a Windows service (a program that performs a specific task to support other programs) and error messages. The bottom of the Log Viewer window shows details about specific events, including changes to settings.


Norton Internet Worm Protection - Worm detection

Norton Internet Worm Protection - Worm detection copyright 2004 Symantec

Selecting Worm detection on the left side of the Log Viewer displays details about recent Internet Worm Protection activities. The bottom of the Log Viewer window shows whether Internet Worm Blocking is active and the number of attack signatures it is monitoring. This provides a snapshot of your computer's protection.


Norton AntiVirus

Norton AntiVirus copyright 2004 Symantec

Norton AntiVirus features continually monitor your computer and protect it from threats like viruses and potential risks in email messages or downloaded files. The Log Viewer tracks Norton AntiVirus activities, alerts and error messages.

On the left side of the Log Viewer window, you can click on any of the log categories under Norton AntiVirus to see recent activity. To get help on a category, select a category and click the help button (question mark button). For help on how to use the Log Viewer, click the help button without a category selected, or click Help > Help Topics.

Monitor Norton AntiVirus activities


Symantec Resource Protector Alerts

Symantec Resource Protector Alerts copyright 2004 Symantec

Selecting Symantec Resource Protector Alerts on the left side of the Log Viewer displays details about unauthorized attempts to modify Symantec processes and tasks that were blocked by your Symantec product. The log shows the time that the event occurred and the action taken. The bottom of the Log Viewer window shows the original location of the infected file on your computer and, if available, a link to the online Symantec Virus Encyclopedia for more information.


Command-line switches

Command-line switches copyright 2004 Symantec

NAVW32.EXE is the executable file that launches the Windows interface and scanner. It can be run with command-line switches, typically from the Start menu Run command, to override configuration settings. The command syntax is as follows:

NAVW32 [[pathname] options]

Option | Description
pathname | Any drive, folder, file, or combination of these is scanned. If you want to scan a combination of items, use a space to separate the items. You can use wildcards when specifying pathnames for a group of files (for example, NAVW32 A:C:\MYDIR\*.EXE).
/A | All drives, except drives A and B, are scanned.
/L | All local drives, except drives A and B, are scanned.
/S[+|-] | All subfolders specified in the pathname are also scanned.
/M[+|-] | Enables (+) or disables (-) scanning of memory (for example, NAVW32 C:/M or NAVW32 D:/M-). (Available on Windows 98/Me only.)
/MEM | Only memory is scanned. (Available on Windows 98/Me only.)
/B[+|-] | Enables (+) or disables (-) scanning of boot records (for example, NAVW32 A: /B or NAVW32 B: /B-).
/BOOT | Master boot records and boot records of all hard drives, plus any specified removable drives, are scanned.
/NORESULTS | No scan results are reported on screen.
/HEUR:[0|1|2|3] | Set Bloodhound sensitivity (0 disables).


Automatic LiveUpdate status

Automatic LiveUpdate status copyright 2004 Symantec

Automatic LiveUpdate status tells you if the Automatic LiveUpdate feature is on. You should have Automatic LiveUpdate turned on to ensure that Norton AntiVirus has the latest virus definitions and program updates. Virus definitions are files containing virus information that allow Norton AntiVirus to recognize and alert you to the presence of a specific virus. To prevent new viruses from infecting your computer, you must update your virus definitions frequently. Program updates are enhancements to Norton AntiVirus that are periodically issued by Symantec. Program updates usually contain changes to the inner workings of the program. After installing program updates, you won't necessarily see a difference in the way Norton AntiVirus works.

A valid antivirus subscription is required for you to receive virus definitions from Symantec. Your Symantec product includes a complimentary, limited-time subscription for virus definition services. Your subscription status is displayed in the Service Status area of the Norton AntiVirus main window. A valid antivirus subscription service is not required for you to receive program updates.

(ISDN users only): By default, Automatic LiveUpdate checks for updates to Norton AntiVirus virus definitions every four hours when your computer is connected to the Internet. If you have an Integrated Services Digital Network (ISDN) router that is set to Automatically Connect, you could be incurring connection and phone charges every time Automatic LiveUpdate runs. If this is a concern, you can turn off automatic connection on your ISDN router, or turn off Automatic LiveUpdate.

Automatically update your threat protection


Auto-Protect status

Auto-Protect status copyright 2004 Symantec

Keep Auto-Protect turned on (enabled) at all times to prevent viruses from infecting your computer. Auto-Protect works in the background, without interrupting your work.

Auto-Protect automatically:

  • Detects and protects you against all types of viruses, including macro viruses, boot sector viruses, and memory resident viruses.
  • Detects and protects you against all types of Trojan horses, worms, and other malicious code.
  • Protects your computer from viruses transmitted through the Internet by checking all files that you download from the Internet, including Java Applets and ActiveX controls.
  • Keeps your system safe at all times by checking for viruses every time you use software programs on your computer, insert floppy disks or other removable media, and modify or access documents.
  • Monitors your computer for any unusual symptoms that may indicate an active virus.

Ensure that protection settings are turned on


Email Scanning status

Email Scanning status copyright 2004 Symantec

Email has become a vital part of many people's lives. Viruses use email as the most frequent mechanism to spread and infect computers. Norton AntiVirus supports all email programs that use POP3 and SMTP communications protocols.

Upon installation, Norton AntiVirus automatically configures your email program for protection against viruses.

Norton AntiVirus stops infections in incoming and outgoing email. For maximum protection, and to prevent you from spreading virus-infected email to your friends and colleagues, Norton AntiVirus scans your outgoing messages for viruses.

You should keep Email Scanning on at all times.

Email Scanning options

The Email Scanning Status that is displayed depends on which Email Options you have selected. The following options are available.

Scan incoming Email and Scan outgoing Email | Email Scanning On
Scan incoming Email | Incoming Email On
Scan outgoing Email | Outgoing Email On
None | Email Scanning Off

About Email options


Full System Scan status

Full System Scan status copyright 2004 Symantec

Full System Scan status tells you if you have performed a virus scan of your computer. A full system scan checks all boot records, master boot records, and all files on your computer. It is important that you perform a full system scan after initial product installation to ensure that your system is free from viruses.

When you installed Norton AntiVirus and completed the Information Wizard, you were given the option to schedule a weekly full system scan as part of post-installation tasks. If you made that choice, the scan is scheduled automatically for you. After installation, you can always review and modify the scheduled scans in the Norton AntiVirus Scan for Viruses pane or create new scheduled scans.

Manually scan disks, folders, and files


Norton AntiVirus Subscription status

Norton AntiVirus Subscription status copyright 2004 Symantec

Subscription status tells you when your antivirus subscription service expires.

A valid antivirus subscription is required for you to receive virus definitions from Symantec. Virus definitions are files containing specific signature information that allow Norton AntiVirus to detect and protect you against virus and malicious code threats.

Symantec's global team of antivirus experts is continuously researching virus and malicious code threats, and new virus definitions are released periodically to provide you with the latest protection. To prevent new viruses from infecting your computer, you must keep your antivirus subscription service current and update your virus definitions frequently. Symantec recommends that you update your virus definitions at least weekly by running LiveUpdate or enabling Automatic LiveUpdate.

More Info on Subscription Service "Not installed" from the Symantec Knowledge Base web site

More Info on installing with Symantec AntiVirus for Handhelds from the Symantec Knowledge Base web site


Virus Definitions status

Virus Definitions status copyright 2004 Symantec

Virus Definitions status warns you if your virus definitions are out of date and displays the definition file date on your computer. Virus definitions are files containing specific signature information that allows Norton AntiVirus to detect and protect you against virus and malicious code threats.

A valid antivirus subscription service is required for you to receive virus definitions from Symantec. Your Symantec product includes a complimentary, limited-time subscription for virus definition services. Your subscription status is displayed in the Service Status area of the Norton AntiVirus main window.

About program updates


New file extensions

New file extensions copyright 2004 Symantec

Use the Extensions to add dialog box to add new extensions to your list.

To add a file extension

  1. Type the extension that you want to add.
  2. Click OK to save your data and return to the Program File Extensions dialog box.


Repair Wizard: delete

Repair Wizard: delete copyright 2004 Symantec

Norton AntiVirus has found one or more threats on your computer that it was unable to repair or safely quarantine. The name of the infected file, the name and type of the threat infecting the file, and the status of the repair are displayed. If you have Internet access, click the threat name to connect to the Symantec Security Response Web site and get more information about the threat. Click the file name to see its complete path and file name.

The Repair Wizard recommends that you delete the infected file to prevent it from infecting your computer. Be aware that if you delete the file, you will not be able to use the file again. The file and its threat will be completely and safely deleted from your computer.

If you do not want to delete a listed file, uncheck the box next to the file name.

Scan active programs and start-up files: delete infections

About types of infections

If Scan active programs and start-up files is turned on, Norton AntiVirus will first scan files associated with running processes and referenced by startup folders, batch files, initialization files, and registry keys.

If Norton AntiVirus detects an infection with an associated process running in memory, clicking Delete in the Repair Wizard causes Norton AntiVirus to issue an alert. The alert advises you to close your applications because Norton AntiVirus will attempt to terminate the process running in memory. If successful, it can then fix the associated infection.

If you click Delete to repair an infected file that was detected by the System Load Point Scan, any detected references to this file in the form of registry keys, batch file entries, or initialization file entries will be removed. The references will only be removed if the fix is to delete the infection.

Use the Repair Wizard


Repair Wizard: Manual Removal

Repair Wizard: Manual Removal copyright 2004 Symantec

The Manual Removal panel opens when Norton AntiVirus detects one or more infections with processes running in memory or infections referenced by the registry, startup folders, batch files, initialization and configuration files that Norton AntiVirus cannot remove automatically. To remove the infection manually, click the threat's link, and follow the instructions on the Symantec Response Web site that opens in your Web browser window. Once you remove the threat, close the Web browser window, and click the next threat until all have been removed.

About types of infections


Repair Wizard: quarantine infections

Repair Wizard: quarantine infections copyright 2004 Symantec

Norton AntiVirus has found one or more threats on your computer that it was unable to repair with the current set of virus definitions files.

The name of the infected file, the name and type of the threat infecting the file, and the status of the repair are displayed. If you have Internet access, click the threat name to connect to the Symantec Security Response Web site and get more information about the threat. Click the file name to see its complete path and file name.

The Repair Wizard allows you to store files in a special area called Quarantine. Files in Quarantine cannot interact with the rest of your system, so if they are infected, the threat will not spread. From the Norton AntiVirus Quarantine, a file can be sent over the Internet directly to the Symantec Security Response experts for analysis. Symantec Security Response experts determine if your file is infected. If the file is not infected, they report the results to you. If a new virus is discovered in your submission, Symantec Security Response experts will create and send you updated virus definitions files to detect and eliminate the new threat on your computer.

If you want to keep the infected file in Quarantine for submission to Symantec Security Response experts, or for possible future repair by updated virus definitions files, click Quarantine.

If you do not want to keep a listed file in Quarantine, uncheck the box next to the file name.

If you are sure that you don't want to keep the contents of the infected file, click Skip to skip the quarantine process, and delete the infected file using the next page of the Repair Wizard.

Scan active programs and start-up files: quarantine infections

If Scan active programs and start-up files is turned on, Norton AntiVirus will first scan files associated with running processes and files referenced by startup folders, batch files, initialization files, and registry keys.

If Norton AntiVirus detects an infection with an associated process running in memory, clicking Quarantine in the Repair Wizard causes Norton AntiVirus to issue an alert. The alert advises you to close your applications because Norton AntiVirus will attempt to terminate the process running in memory. If successful, it can then fix the associated infection.

If you click Quarantine to repair an infected file that was detected by the System Load Point Scan, any detected references to this file in the form of registry keys, batch file entries, or initialization file entries will be removed. The references will only be removed if the fix is to delete the infection.


Repair Wizard: fix infections

Repair Wizard: fix infections copyright 2004 Symantec

If the Repair Wizard indicates that you have an infected file or threat on your computer, you should click Fix to try to remove the virus or threat from the file. The Repair Wizard attempts to remove the virus or threat from the file, leaving the file contents intact; or it automatically deletes the file if it can't be fixed.

For example, if you have an infected Microsoft Word document, the Repair Wizard automatically removes the virus from the Word document so that you can open and edit the repaired document as usual. If Norton AntiVirus detects a worm or Trojan horse, the Repair Wizard automatically deletes the file containing the malicious code.

Click the file name to see its complete path and file name. If you have Internet access, click the threat name to connect to the Symantec Security Response Web site and get more information about the threat. If you do not want to try to repair any of the listed files, uncheck the box next to the file name.

If you are sure that you don't want to keep the contents of the infected file, you can skip the fixing process and immediately quarantine or delete the file. To skip the fixing process, click Skip. If you quarantine or delete the file, you will not be able to use the file again. The infected file will be inaccessible and unable to harm your computer while quarantined, unless updated virus definitions files can repair it. If you choose to delete the file, the file and its virus will be completely deleted from your computer.

Scan active programs and start-up files: fix infections

If Scan active programs and start-up files is turned on, Norton AntiVirus will first scan files associated with running processes and files referenced by startup folders, batch files, initialization files, and registry keys.

If Norton AntiVirus detects an infection with an associated process running in memory, clicking Fix in the Repair Wizard causes Norton AntiVirus to issue an alert. The alert advises you to close your applications because Norton AntiVirus will attempt to terminate the process running in memory. If successful, it can then fix the associated infection.

If you click Fix to repair an infected file that was detected by the System Load Point Scan, any detected references to this file in the form of registry keys, batch file entries, or ini file entries will be removed. The references will only be removed if the fix is to delete the infection.


Scan Summary

Scan Summary copyright 2004 Symantec

The Scan Summary displays information about the scan just performed. It shows how many viruses were found, repaired, quarantined, or deleted. The information shown includes the following:

Scanned | Indicates how many files, master boot records, and/or boot records were scanned.
Infected | Indicates how many of the above items, if any, were infected.
Repaired, Quarantined or Deleted | Indicates how many items, if any, were repaired, quarantined, or deleted. You can view the items in Quarantine by clicking Reports in the Norton AntiVirus main window. Next to Quarantined Items, click View Report.
Excluded | Indicates how many files at risk were excluded from future scans.

To review viruses remaining on your computer

  1. Click More Details for more information about remaining viruses.
  2. Select the name of the item to view its file name and location on your computer.
  3. If you have Internet access, click the virus name to go to the online Virus Encyclopedia Web site.
More Details also displays whether the scan checked for viruses in your computer's memory; what other types of files were scanned, such as compressed files; and the action taken on every infected file found on your computer.

To review non-viral threats

  1. Click Additional non-viral threats remain. To view these items, click here to open the non-viral Threats Detected window.
  2. In the Threats Detected window, can exclude non-viral threats from future scans.
  3. To learn about the threat, click the threat name to launch the Symantec Web site.

To review infections in active programs and start-up files

  1. Click Threats remain which Norton AntiVirus could not remove automatically. To view these items, click here.
  2. The link opens the Manual Removal window from which you can access the Symantec Web site for removal instructions or tools.


Auto-Protect block alert

Auto-Protect block alert copyright 2004 Symantec

The program you are using is temporarily paused while a file is being scanned for viruses by Norton AntiVirus.

To close the alert, click OK. The program you are using will continue to wait for the scan to complete.

To stop the scan and have the program resume now, click Stop Scan.

To turn off this alert

  1. In the main window, click Options.
    If a menu appears, click Norton AntiVirus.
  2. In the Options window, in the left pane, select Auto-Protect, then select Advanced.
  3. Uncheck Display alert when application is blocked.
  4. Click OK.


File extensions

File extensions copyright 2004 Symantec

Use the Program File Extensions dialog box to include new extensions, delete extensions, and reset the extensions to the original list installed with Norton AntiVirus. If Scan files using SmartScan is selected, Norton AntiVirus scans only files whose file extensions are listed in the Program File Extensions dialog box.

This feature enables you to add or exclude certain types of files or programs from scanning as follows:

  • The file extensions list contains the majority of extensions used for program files.
  • Norton AntiVirus also scans Microsoft Office documents when scanning program files. Although these are not program files, they do contain code and can be infected by macro viruses.
  • If you are using custom applications with unique file extensions, click New to display a dialog box in which you can add them to the list. Norton AntiVirus can then scan the files and protect them against infection.
  • Click Remove to delete a selected file extension.
Be careful. Removing extensions from the list reduces your protection against viruses.
  • Click Defaults to return the file extensions list to the preset options.


Export files

Export files copyright 2004 Symantec

Export allows you to save a list of current Quarantine contents with summary information to a file. In this dialog box, you can select which files to export summary information about and the format in which it will be exported.


Quarantine options: Backup files

Quarantine options: Backup files copyright 2004 Symantec

For data safety, Norton AntiVirus is preset to make a backup copy of a file before attempting a repair. These backups are also stored in Quarantine. After the repaired file is verified, you can delete the infected item from Quarantine. In this dialog box, you can specify which actions will be available for backup items.

About Norton AntiVirus Quarantine


Quarantine options: General

Quarantine options: General copyright 2004 Symantec

In this dialog box, you can set options to have Norton AntiVirus run a scan if Quarantine detects a newly updated virus definitions file at startup, to have Quarantine files automatically forwarded to a Quarantine server, and to password-protect Quarantine files.

About Norton AntiVirus Quarantine


Set and change password

Set and change password copyright 2004 Symantec

Before setting or changing your password, make sure that you've selected the items that you want protected.

Passwords can be from 1 to 16 characters in length and are not case-sensitive (a is the same as A).

Complete the fields as follows:

Old Password | If this is the first time that you've created a password, this text box is not available. If you're changing a password, type the old one here.
New Password | Type the new password in the text box. As you type the new password, Norton AntiVirus displays the characters in your password with asterisks (*) on the screen for security.
Confirm New Password | Type the new password again in the text box.


Quarantine options: Quarantine files

Quarantine options: Quarantine files copyright 2004 Symantec

Sometimes Norton AntiVirus detects an unknown virus that can't be eliminated with the current set of virus definitions. You may also have a file that you think is infected that is not being detected. In this dialog box, you can select the files for which you want summary information exported. You can also select the format of the exported information.

You can review details of an item that has side effect information from the quarantine console.

To review side effect information

  1. In the Norton AntiVirus Quarantine window, double-click a quarantine item.
  2. Click the Side Effect Info tab.

About Norton AntiVirus Quarantine


Quarantine options: Submitted files

Quarantine options: Submitted files copyright 2004 Symantec

Files sent to Symantec Security Response for analysis are isolated. After receiving the results of the analysis, you can determine what to do with the item. In this dialog box, you can specify which actions will be available for items submitted to Symantec Security Response.

About Norton AntiVirus Quarantine


Auto-Protect actions

Auto-Protect actions copyright 2004 Symantec

When Auto-Protect detects a virus, it attempts to repair the infected file by default and automatically deletes worms and Trojan horses. On computers running Windows 2000/XP, if an infected file cannot be repaired, Auto-Protect does not allow you to access the file. To handle any infected files that can't be repaired by Auto-Protect, scan your entire computer for viruses, and then scan any infected files that are found.

On computers running Windows 98/Me, if an infected file cannot be repaired, the Alert dialog box gives you the following options:

  • Repair the infected file: Eliminates the virus and repairs the infected item. When a virus is found, Repair is always the best choice. If the infection is a Trojan horse or worm that can't be repaired, it is automatically deleted.
  • Quarantine the infected file: Isolates the virus-infected file, but does not remove the virus. Click Quarantine if you suspect that the infection is caused by an unknown virus and you want to submit the virus to the Symantec Security Response experts for analysis.
  • Delete the infected file: Erases both the virus and the infected file. Click Delete if Repair is not successful. Replace the deleted file from the original program file or backup copy. After replacement, the virus is detected again, your original copy is infected. If the infection is a Trojan horse or worm that can't be repaired, it is automatically deleted.
  • Do not open the file, but leave the problem alone: Stops the current operation to prevent you from using an infected file. This action does not solve the problem. You will receive an alert the next time that you perform the same activity.
  • Ignore the problem and do not scan this file in the future: Adds the file suspected of containing a virus to the Exclusions list. When you add a file to the Exclusions list, the file will be excluded from any future virus scans, unless you remove it from the list. Select this option only if you know that the file does not contain a virus.
  • Ignore the problem and continue with the infected file: Continues the current operation. Select this option only if you are sure that a virus is not at work. You will receive an alert again. If you are not sure what to do, click Do not open the file, but leave the problem alone.

After dealing with an infected file, you should scan your entire computer for viruses to detect any other infections.


Internet Worm Protection status

Internet Worm Protection status copyright 2004 Symantec

Keep Internet Worm Protection turned on (enabled) at all times to protect your computer from worm attacks and other threats that originate from the Internet. Internet Worm Protection's default settings for basic inbound port blocking and network monitoring provide reliable network protection against worms and other malicious Internet activity. However, if you are an experienced Internet user, you can create or modify your own rules and settings.

There are five classes of rules you can customize:

  • Exclusions
    Exclude and include worm signatures from detection.
  • Program rules
    Control an program's access to the Internet.
  • General rules
    Use rules to monitor network traffic for worms, malicious incoming traffic, programs, and Trojan horses.
  • Trojan rules
    Detect varieties of Trojan horses.
  • AutoBlock rules
    Block malicious attacks.

To prevent malicious network activity and Internet worm attacks, Internet Worm Protection monitors your computer's Internet connection for four types of activity:

  • Listen events
    A listen event occurs when an application, such as a Web server or multi-player game, opens a network port for listening. This means that the port is preparing to receive a connection from the Internet. If the listen event does not match a rule, Norton AntiVirus generates a Program Control alert, which allows you to permit or block such traffic in the future.
  • IP traffic events
    Incoming traffic to open ports on your computer are detected by Internet Worm Protection. A listen event usually precludes an IP traffic event, but IP activity frequently bypasses a listen event at system startup. If the event does not match a rule, Norton AntiVirus generates a Security alert.
  • Trojan Horse events
    Internet Worm Protection can detect an application attempting to open a port for listening on one that is commonly used by Trojan Horse applications. If the characteristics of the event match a default rule or a rule that you have created, Norton AntiVirus generates a Security alert
  • Malicious traffic events
    If Norton Internet Worm Protection detects malicious Internet traffic, the activity is blocked and Norton AntiVirus issues a Security alert.


Symantec Firewall Upgrade

Symantec Firewall Upgrade copyright 2004 Symantec

An upgraded and full application-based firewall is now installed and running on your computer.

Superior to Internet Worm Protection (which provided inbound-only port blocking protection against incoming worm activity), your upgraded firewall now offers protection from both inbound and outbound Internet activity.

Your upgraded firewall also safeguards your computer from such common security problems as unauthorized connection attempts, port scans, security attacks, and privacy intrusions.


Non-viral threats Detected

Non-viral threats Detected copyright 2004 Symantec

Norton AntiVirus can detect non-viral threats. You can select to exclude detected non-viral threats from future scans. In addition, you can click the threat name to open the Symantec Security Response Web page where you can learn more about the threat. In some cases, the Symantec Security Response Web page provides steps on removing the non-viral threat from your computer.


Service Status

Service Status copyright 2004 Symantec

You can obtain updates as long as your service has not expired. If your service is expired or pending, you are prompted to renew. Follow the on-screen instructions to renew.

If you do not renew your service, you cannot obtain updates of any kind and the software will no longer function.


Protection Alert

Protection Alert copyright 2004 Symantec

Running all the Norton AntiVirus features ensures the highest security for your computer. However, you can temporarily turn off a feature and schedule the time frame in which you want it deactivated. Once the time frame you specify concludes, Norton AntiVirus automatically restarts the feature. You can override your setting at any time, and turn on the feature from Options.

To temporarily disable a feature

  1. Uncheck one or more features that you want to disable.
  2. Click OK.
  3. In the Protection Alert window, select how long you want to turn off the feature.
  4. Click OK.


Edit or create new Manual Scan Exclusion list

Edit or create new Manual Scan Exclusion list copyright 2004 Symantec

If you are creating a new exclusion, type the name of the item that you want to exclude from detection. You can assign exclusions to drives, folders, groups of files, or single files. For example:

C:\program files\ | Excludes all files in the program files folder on drive C
\program files | Excludes all files in the program files folder on all drives (for example, C:\program files and D:\program files)
C:\myprogram.exe | Excludes the myprogram.exe file on drive C
myprogram.exe | Excludes the myprogram.exe file in all folders on all drives

If you specify the full path of a file (for example, C:\myprogram.exe), and then move or rename the file, you automatically invalidate its exclusion.

Wildcards

Wildcard characters, such as * or ?, can be used to exclude file extensions, provided that they are not specified as part of a path. For example:

*.xl? | Excludes all files on your computer with the extension .xl followed by any other single character
*.ex* | Excludes all files on your computer with the extension .ex followed by any number of characters

You cannot use a wildcard in a path. For example, C:\program files\*.xl? and C:\program ?????\ are not allowed.

You cannot specify a file name with a wildcard extension. For example, myfile.xl? is not allowed.

Be careful! If you set an exclusion, you have reduced the level of protection against threats.

About Manual Scan Exclusions options


Deny access

Deny access copyright 2004 Symantec

If you are attempting to access a floppy disk drive and are denied access, there is no disk in the drive. If you are attempting to access a hard disk drive, you need to resolve the problem that is causing you to be denied access (for example, on a network, you may not have access rights).


Edit or create new Threat Category Exclusion list

Edit or create new Threat Category Exclusion list copyright 2004 Symantec

If you are creating a new exclusion, type the name of the item that you want to exclude from detection. You can assign exclusions to drives, folders, groups of files, or single files. For example:

C:\program files\ | Excludes all files in the program files folder on drive C
\program files | Excludes all files in the program files folder on all drives (for example, C:\program files and D:\program files)
C:\myprogram.exe | Excludes the myprogram.exe file on drive C
myprogram.exe | Excludes the myprogram.exe file in all folders on all drives

If you specify the full path of a file (for example, C:\myprogram.exe), and then move or rename the file, the exclusion no longer works.

Wildcards

Wildcard characters, such as * or ?, can be used to exclude file extensions, provided that they are not specified as part of a path. For example:

*.xl? | Excludes all files on your computer with the extension .xl followed by any other single character
*.ex* | Excludes all files on your computer with the extension .ex followed by any number of characters

You cannot use a wildcard in a path. For example, C:\program files\*.xl? and C:\program ?????\ are not allowed.

You cannot specify a file name with a wildcard extension. For example, myfile.xl? is not allowed.

Be careful! If you set an exclusion, you have reduced the level of protection against threats.

About Threat Categories Exclusions options


Overwrite or append

Overwrite or append copyright 2004 Symantec

You are about to overwrite an existing file with the file that you're printing to disk.

Your options are:

Overwrite | Replaces the old file
Append | Adds information to the existing file
Cancel | Cancels this action so you can go back and change the file name


What is trialware?

What is trialware? copyright 2004 Symantec

Trialware is a copy of a software product that allows you to evaluate the product for a limited period of time. Once the trial period expires, the product stops working and you must purchase a new copy to continue using it.