What to do if a security risk is found

Norton AntiVirus provides many solutions and features for handling viruses and other security threats that it detects.

In addition, Norton AntiVirus provides solutions for security risks, such as spyware and adware.

More Information

How Norton AntiVirus detects viruses, spyware, and other risks

Responding to Auto-Protect alerts

Responding to Worm Blocking alerts

Responding to problems reported during a scan

Managing items in Norton Quarantine and Restore

If Norton AntiVirus cannot repair a file

Looking up viruses on the Symantec Web site


How Norton AntiVirus detects viruses, spyware, and other risks

Viruses and other security threats can be found during a manual or scheduled scan or by Auto-Protect when you perform an action with an infected file. Threats can also appear during an instant messenger session, when sending an email message, or during a manual or scheduled scan.

Security risks, such as spyware and adware, can also be detected while performing these activities.

When Scan active programs and startup files is turned on (this feature is on by default), Norton AntiVirus first scans files that have already infected your system or that can potentially infect your system when your computer first starts up.

These files include the following:

  • Files that are associated with processes that are currently running in memory

  • Files with startup folder entries

  • Files with system start INI file entries

  • Files with system start batch file entries

  • Files that are referenced by system start registry keys

If it detects an infected file during this portion of the manual scan, Norton AntiVirus repairs or removes the file and removes the unnecessary references from your system. Before attempting to repair, quarantine, or delete any infected file that has a process running in memory, Norton AntiVirus attempts to terminate the process. You are alerted and prompted to close all unnecessary programs before the process is terminated.

You can view information about detected viruses and other security threats in the Manual Repair window.

The Manual Repair window also includes information about spyware, adware, and other security risks.


Responding to Auto-Protect alerts

Auto-Protect scans files for viruses, worms, and Trojan horses when you perform an action with them, such as moving them, copying them, or opening them.

It also scans for spyware, adware, and other security risks.

If Auto-Protect detects suspicious activity, in most cases you receive an alert telling you that a risk was found and resolved.

If one or more viruses are found and either repaired or deleted by Auto-Protect, you receive an alert telling you which file was repaired or deleted and which virus, Trojan horse, or worm was infecting the file. No further action is necessary.

If one or more security risks such as spyware are found, Auto-Protect alerts you with the following options:

Scan now (recommended) | The risk is scanned immediately.
Exclude this risk from future scans | The risk will not be included in future scans.
Ignore this risk for 30 minutes | The risk will be ignored for 30 minutes, but will be included in future scans.

You can set your Auto-Protect options to try to quarantine any infected files that it cannot repair. If you do this, you are informed if any files are quarantined.

More Information

About Auto-Protect options


Responding to Worm Blocking alerts

If a program tries to email itself or a copy of itself, it could be a worm trying to spread through email. A worm can send itself or a copy of itself in an email message without any interaction with you.

Worm Blocking continually scans outgoing email attachments for worms. If it detects a worm, you receive an alert telling you that a malicious worm was found.

The alert presents you with options and asks you what to do. If you were not sending an email message at that time, then it is probably a worm and you should quarantine the file.

To respond to Worm Blocking alerts

  • In the alert window, select the action that you want to take. Your options are:

    Stop this program from emailing itself

    Stops the worm from emailing itself at this time, but does not quarantine the worm. This action leaves the worm on your computer, where it can possibly be activated again. Select this option only if you are sure what you want to leave the worm on your computer.

    Quarantine this program (Recommended)

    Permanently stops the worm by putting it in Norton Quarantine and Restore. While in Norton Quarantine and Restore, the worm is unable to spread itself. This is the safest action.

    Allow this program to email itself

    Sends the email containing the worm. If you allow the worm to be emailed, it could infect the recipient’s computer. Select this option only if you are sure the email is not infected with a worm.

    Always allow this program to email itself

    Sends email containing the worm anytime it tries to email itself. In the future, Norton AntiVirus will not check this file for worms. This is the riskiest action because this worm could email itself from your computer without your knowledge.

If a malicious worm is found, it should be quarantined.

To quarantine a worm-infected file

  1. In the alert, in the drop-down list, click Quarantine this worm (Recommended).

  2. After the worm has been quarantined, perform the following tasks:

    • Run LiveUpdate to ensure that you have the latest protection updates.

    • Scan your computer.

If nothing is detected, submit the infected file to Symantec Security Response, indicating that Norton AntiVirus Worm Blocking detected the file and that you have scanned it with the latest virus definitions. Symantec Security Response will reply to you within 48 hours.

More Information

What gets updated

Performing a full system scan


Responding to problems reported during a scan

At the end of a scan, the Scan Complete window appears to tell you what was found during the scan. From the Scan Complete window, you can open the Manual Repair window, where you can read more details about the items that were found. You can also use the Manual Repair window to resolve items that were not automatically resolved during the scan.


Managing items in Norton Quarantine and Restore

Norton AntiVirus may detect an unknown virus or other security risk that cannot be eliminated with the current set of virus definitions. Or you may have an item that you think is infected that is not being detected. Norton AntiVirus prompts you to put the item in Norton Quarantine and Restore or it quarantines it automatically. Items that are in Norton Quarantine and Restore are isolated from the rest of your computer, so that they cannot spread or reinfect your computer.

You cannot accidentally open the item and spread the virus, but you can still evaluate it for possible submission to Symantec.

Norton Quarantine and Restore includes the following groups of items:

Security Risks | Includes items such as spyware and adware that are generally low risk and that may have dependencies. You can restore these items if another program requires them to function.
Security Threats | Includes viruses and other high-risk items.

Once an item has been placed in Norton Quarantine and Restore, you have several options. All of the actions that you take on items in Norton Quarantine and Restore must be performed in the Norton Quarantine and Restore window. You can access these actions on the toolbar.

The following actions are available:

Add Item

Adds items to Norton Quarantine and Restore. Use this action to quarantine an item that you suspect is infected. This action has no effect on items that are already in Norton Quarantine and Restore.

Details

Provides information about the selected item and the virus that is infecting it, if applicable.

Repair Item

Attempts to repair the selected item. Use this action if you have received new virus definitions since the item was added to Norton Quarantine and Restore.

This action is not available for security risks, such as spyware and adware.

Restore Item

Returns the selected item to its original location without repairing it.

Delete Item

Deletes the selected item from your computer.

Submit Item

Sends the selected item to Symantec. Use this option if you suspect that an item is infected even if Norton AntiVirus did not detect it.

LiveUpdate

Runs LiveUpdate to check for new protection and program updates. Use this if you haven’t updated your virus definitions for a while and then try to repair the items in Norton Quarantine and Restore.

To open the Norton Quarantine and Restore window

  1. On the left side of the main window, under Norton AntiVirus, click Reports.

  2. In the Reports pane, click View Norton Quarantine and Restore.

To perform an action on an item in Norton Quarantine and Restore

  1. In the Norton Quarantine and Restore window, select the item on which you want to perform the action.

  2. On the toolbar, select the action that you want to perform.

  3. When you are finished, on the File menu, click Exit.

More Information

Adding an item to Norton Quarantine and restore

Reviewing item details in Norton Quarantine and Restore

Repairing an item in Norton Quarantine and Restore

Restoring a security risk from Norton Quarantine and Restore

Resolving remaining risks

Deleting an item in Norton Quarantine and Restore

Submitting an item to Symantec

Changing Norton Quarantine and Restore options


Adding an item to Norton Quarantine and restore

You can manually add items to Norton Quarantine and Restore.

To add an item

  1. In the Norton Quarantine and Restore window, on the toolbar, click Add Item.

  2. In the add to quarantine dialog box, select the item that you want to add.

  3. Click Add.


Reviewing item details in Norton Quarantine and Restore

A security risk can be composed of multiple components, such as programs, files, and registry settings. When a security risk is moved to Norton Quarantine and Restore, all of its components, or affected areas, are moved as well. If that security risk is repaired or restored from Norton Quarantine and Restore, its affected areas are also automatically restored.

You can review details of these items from the Norton Quarantine and Restore console.

To review item details in Norton Quarantine and Restore

  1. In the Norton Quarantine and Restore window, double-click a quarantine item.

  2. Click the Affected Areas tab.


Repairing an item in Norton Quarantine and Restore

You can attempt to repair items that are in Norton Quarantine and Restore.

To repair an item in Norton Quarantine and Restore

  1. In the Norton Quarantine and Restore window, select the item that you want to repair.

  2. On the toolbar, click Repair Item.

  3. Click OK.


Restoring a security risk from Norton Quarantine and Restore

Some programs rely on other programs classified as security risks, such as spyware and adware, in order to function. All removed security risks are automatically backed up Norton Quarantine and Restore, so if a program you need stops working, you can restore the risk program in order to regain functionality.

If you restore a risk program to a directory other than its original location, it may not function properly.

To restore a security risk from Norton Quarantine and Restore

  1. In the Norton Quarantine and Restore window, select the item that you want to restore.

  2. On the toolbar, click Restore Item.

  3. In the warning dialog box asking if you are sure you want to restore the item, click Yes.

  4. If the Overwrite warning dialog box appears, select one of the following:

    Yes

    Overwrite an existing copy of the risk program.

    No

    Save the risk program to a new location.

    If you restore a risk program to a directory other than its original location, it may not function properly.

  5. In the Restore results dialog box, click OK.


Resolving remaining risks

The Manual Repair window appears when a detected security risk could not be resolved automatically, or when you click View Details in the Scan Complete window. The Remaining Risks tab provides the following information:

Name | Click the risk name to view more information about the risk on the Symantec Security Response Web site.
Risk | Click the risk level (High, Medium, or Low) to view more details about the risk, including dependencies and the impact this risk may have on your computer.
Warning | Some risks cannot be resolved automatically and require manual removal. For these risks, it is necessary to visit the Symantec Security Response Web site for manual removal instructions or other information about the item. Selecting Review it the Action drop-down list takes you to this information.
Details | Click the risk type (Spyware, Adware, etc.) to view more details about the risk, including a list of items such as files, processes, and registry keys that are affected by the risk.
Action | Select the action that you want Norton AntiVirus to take. Recommended actions are indicated with an asterisk (*).

To resolve remaining risks

  1. In the Manual Removal window, click the Remaining Risks tab.

  2. In the Action drop-down list for the risk that you want to resolve, select the action that you want Norton AntiVirus to take. Your options are:

    Repair

    Removes the virus from the item, or deletes the item if the threat is a worm or Trojan horse.

    Quarantine

    Isolates the infected item or risk program from the rest of your computer so that it cannot spread or reinfect your computer. You cannot accidentally open the item, but you can still evaluate it for possible submission to Symantec.

    Remove

    Removes the risk from your computer. Security risks such as spyware and adware that may provide functionality for other programs are backed up in Norton Quarantine and Restore.

    Exclude

    Adds the risk to the appropriate exclusions list in Norton AntiVirus options. The risk will not be included in future scans.

    Ignore

    Keeps the risk on the Remaining Risks tab. The risk will be included in future scans.

    Review

    Takes you to the Symantec Security Response Web site for manual removal instructions or other information about the risk.

    Not all actions are available for every type of security risk.

  3. Repeat Step 2 for each risk that you want Norton AntiVirus to resolve.

  4. Click OK.

    If Norton AntiVirus cannot complete the selected action for a remaining risk, the risk will continue to appear in the Manual Removal window. The previously attempted action will no longer be available for that risk. Repeat the procedure above using one of the remaining actions for that risk.

More Information

About the Scan Complete window

About Norton AntiVirus options

About the Manual Repair window


Deleting an item in Norton Quarantine and Restore

You can remove items from Norton Quarantine and Restore. If you delete an item, it cannot be restored later.

To delete an item in Norton Quarantine and Restore

  1. In the Norton Quarantine and Restore window, select the item that you want to delete.

  2. On the toolbar, click Delete Item.

  3. In the alert that appears, click Yes.


Submitting an item to Symantec

From Norton Quarantine and Restore, you can send an item over the Internet directly to Symantec Security Response for analysis. Symantec Security Response determines if your item is infected. If the item is not infected, Symantec Security Response reports the results to you. If your item is infected with a new risk, Symantec Security Response creates and sends you special updated virus definitions to detect and eliminate the new virus on your computer.

You must have an Internet connection to submit an item and an email address to receive a reply. Once you submit the item in question, Symantec responds with an acknowledgment email message that includes a tracking number that you should use for further correspondence about this item. You are notified again by email with the results of the final analysis within 48 hours.

To submit an item to Symantec

  1. In Norton Quarantine and Restore, right-click the item you want to submit, and then click Submit to Symantec.

  2. Follow the instructions in the Scan and Deliver Wizard.


Changing Norton Quarantine and Restore options

Norton Quarantine and Restore options are available in the Norton Quarantine and Restore window.

To change Norton Quarantine and Restore options

  1. In the main window, under Options, click Reports.

  2. In the Reports pane, click View Norton Quarantine and Restore.

  3. In the Norton Quarantine and Restore window, click View > Options.

  4. On the tab of the option that you want to change, select the appropriate settings.

  5. Click OK.

    The changes are applied immediately.


If Norton AntiVirus cannot repair a file

One of the most common reasons that Norton AntiVirus cannot automatically repair or delete an infected file is that you do not have the most up-to-date virus definitions. Update your virus definitions with LiveUpdate, and then scan again.

If that does not work, read the information in the Scan Complete window to identify the types of files that cannot be repaired, and then take one of the following actions, depending on the file type:

Infected files with .exe, .doc, .dot, or .xls file name extensions (any file can be infected) | Use the Manual Repair window to solve the problem.
Hard disk master boot record, boot record, or system files (such as IO.SYS or MSDOS.SYS) and floppy disk boot record and system files | Replace using your operating system disks.

More Information

About the Manual Repair window


Looking up viruses on the Symantec Web site

The Symantec Web site contains a complete list of all known viruses and related malicious code, along with descriptions. You must be connected to the Internet to look up viruses.

To look up viruses on the Symantec Web site

  1. On the left side of the main window, under Options, click Reports.

  2. In the Reports pane, click View Online Virus Encyclopedia.

    The Symantec Web site opens in your Internet browser. Use the links on the Web page to access the virus information that you want to view.