What to do if a virus is found

What to do if a virus is found copyright 2004 Symantec

Norton AntiVirus provides many solutions and features for handling viruses and other malicious threats that it detects. We suggest that you review this entire chapter to appreciate the multiple methods in which Norton AntiVirus provides protection for your computer.


About types of infections

About types of infections copyright 2004 Symantec

Viruses can be found during a manual or scheduled scan or by Auto-Protect when you perform an action with an infected file. Threats and security risks can appear during an instant messenger session, when sending an email message, or during a manual or scheduled scan.

More Info from the Symantec Knowledge Base Web site

When Scan active programs and start-up files is turned on (this feature is on by default), Norton AntiVirus first scans files that have already infected your system or that can potentially infect your system when your computer first starts up. These files include the following:

  • Files that are associated with processes that are currently running in memory
  • Files with startup folder entries
  • Files with system start INI file entries
  • Files with system start batch file entries
  • Files that are referenced by system start registry keys

If it detects an infected file during this portion of the manual scan, Norton AntiVirus repairs or removes the file and removes the unnecessary references from your system. Before attempting to repair, quarantine, or delete any infected file that has a process running in memory, Norton AntiVirus attempts to terminate the process. You are alerted by Norton AntiVirus and prompted to close all unnecessary programs before the process is terminated.

To display information about these types of infections, you can click the file name in the Repair Wizard and view the full path to the infected file, the virus that infects the file, and any values in a file or folder that references the infection. For files associated with processes that are currently running in memory, you can view the infected file name and the process the infection has running in memory.

More Information

Which file types to scan for viruses
If a virus is found by Auto-Protect
If a threat is found by Worm Blocking
Use the Repair Wizard
Look up viruses on the Symantec Web site


If a virus is found by Auto-Protect

If a virus is found by Auto-Protect copyright 2004 Symantec

Auto-Protect scans files for viruses when you perform an action with them, such as moving them, copying them, or opening them. If it detects a virus or virus-like activity, in most cases you receive an alert telling you that a virus was found and repaired. How you proceed depends on the operating system that you are using.

More Info from the Symantec Knowledge Base Web site

If a virus or threat is found and repaired by Auto-Protect in Windows 98/Me, you receive an alert telling you which file was repaired or deleted.

To close the alert in Windows 98/Me

  • Click Finish.

If you have set your options so that Auto-Protect asks you what to do when it finds a virus, the alert asks you to choose one of the following actions. The recommended action is always preselected.

Action | Result
Repair the infected file | Automatically eliminates the virus, Trojan horse, or worm and repairs or deletes the infected file. When a virus is found, Repair is always the best choice.
Quarantine the infected file | Isolates the infected file, but does not remove the threat. Select Quarantine if you suspect that the infection is caused by an unknown threat and you want to submit the threat to Symantec for analysis.
Delete the infected file | Erases both the threat and the infected file. Select Delete if Repair is not successful. Replace the deleted file with the original program file or backup copy. If the virus, Trojan horse, or worm is detected again, your original copy is infected.
Do not open the file, but leave the problem alone | Stops the current operation to prevent you from using an infected file. This action does not solve the problem. You will receive an alert the next time that you perform the same activity.
Ignore the problem and do not scan this file in the future | Adds the file that is suspected of containing a threat to the Exclusions list. When you add a file to the Exclusions list, the file is excluded from any future virus scans, unless you remove it from the list. Select this option only if you know that the file does not contain a virus.
Ignore the problem and continue with the infected file | Continues the current operation. Select this option only if you are sure that a virus, Trojan horse, or worm is not at work. You will receive an alert again. If you are not sure what to do, select Do not open the file, but leave the problem alone.

If a file cannot be repaired, you receive an alert telling you that the repair was not made and recommending that you quarantine the file. You have the same options as those listed in the table, with the exception of Repair the infected file.

More Info from the Symantec Knowledge Base Web site

If a virus is found and either repaired or automatically deleted by Auto-Protect in Windows 2000/XP, you receive an alert telling you which file was repaired or deleted and which virus, Trojan horse, or worm was infecting the file. If you have an active Internet connection, selecting the virus name opens the Symantec Web page that describes the virus.

To close the alert in Windows 2000/XP

  • Click OK.

If the file cannot be repaired, you receive two alerts, one telling you that Auto-Protect was unable to repair the file, and another telling you that access to the file was denied.

More Info from the Symantec Knowledge Base Web site

You can set your Auto-Protect options to try to quarantine any infected files that it cannot repair. If you do this, you are informed if any files are quarantined.

To resolve problems with unrepaired files

  1. Run a full system scan on your computer to ensure that no other files are infected.
  2. Follow the recommended actions in the Repair Wizard to protect your computer from the infected files.

More Information


If a threat is found by Worm Blocking

If a threat is found by Worm Blocking copyright 2004 Symantec

If a program tries to email itself or email a copy of itself, it could be a worm trying to spread via email. A worm can send itself or a copy of itself in an email message without any interaction with you.

Worm Blocking continually scans outgoing email attachments for worms. If it detects a worm, you receive an alert telling you that a malicious worm was found.

The alert presents you with options and asks you what to do. If you were not sending an email message at that time, then it is probably a worm and you should quarantine the file. You can click Help on the alert for additional information about how to respond.

Respond to a malicious worm alert


Respond to a malicious worm alert

Respond to a malicious worm alert copyright 2004 Symantec

Norton AntiVirus provides several ways in which you can respond to a malicious worm alert.

  • In the alert window, select the action that you want to take. Your options are:

    Stop this program from emailing itself

    Stops the worm from emailing itself at this time, but does not quarantine the worm. This action leaves the worm on your computer, where it can possibly be activated again. Select this option only if you are sure what you want to leave the worm on your computer.

    Quarantine this program (Recommended)

    Permanently stops the worm by putting it in the Norton AntiVirus Quarantine. While in Quarantine, the worm is unable to spread itself. This is the safest action.

    Allow this program to email itself

    Sends the email containing the worm. If you allow the worm to be emailed, it could infect the recipient's computer. Select this option only if you are sure the email is not infected with a worm.

    Always allow this program to email itself

    Sends email containing the worm anytime it tries to email itself. In the future, Norton AntiVirus will not check this file for worms. This is the riskiest action because this worm could email itself from your computer without your knowledge.

To handle a worm-infected file

  • In the alert, in the drop-down list, click Quarantine this worm (Recommended).

After the worm has been quarantined, perform the following tasks:

Run LiveUpdate to ensure that you have the latest protection updates. | About program updates
Scan your computer. | Perform a full system scan

If nothing is detected, submit the infected file to Symantec Security Response, indicating that Norton AntiVirus Worm Blocking detected the file and that you have scanned it with the latest virus definitions. Symantec Security Response will reply to you within 48 hours.

After you have responded to the threat and deleted the file, your system may still be infected. Perform the following tasks:

Task | For more information
Run LiveUpdate to ensure that you have the latest protection updates. | About program updates
Scan your system. | Perform a full system scan
Go to the Symantec Security Response Web page for the most up-to-date virus definitions and clean-up tools. | See the Symantec Security Response Web page at securityresponse.symantec.com


Use the Repair Wizard

Use the Repair Wizard copyright 2004 Symantec

The Repair Wizard opens when an infected file cannot be repaired, and also when your Options are set to prompt you for a decision before proceeding. If Norton AntiVirus did not attempt a repair, the Repair Wizard opens in the Fix Infection pane. Otherwise, it opens in the Quarantine window.

The Repair Wizard can perform five tasks:

  • Fixes an infection
    Removes the virus from the file or deletes the file if the threat is a worm or Trojan horse
  • Quarantines an infection
    Makes the file inaccessible by any program other than a Symantec antivirus program
  • Deletes an infection
    Removes the virus from your computer by deleting the file that contains the virus, worm, or Trojan horse
  • Removes an infection
    Lists infections that Norton AntiVirus is unable to automatically remove, but that you can remove manually
  • Use the Scan Summary
    Shows how many viruses were scanned, detected, repaired, quarantined, deleted, or excluded during the scan


Fix an infection

Fix an infection copyright 2004 Symantec

If the Repair Wizard opens in the Fix Infections window, it lists viruses, files containing viruses, or potential risks that have not been automatically repaired. All files are checked by default. Uncheck any file that you do not want Norton AntiVirus to fix.

Frequently asked questions


Quarantine an infection

Quarantine an infection copyright 2004 Symantec

Sometimes Norton AntiVirus detects an unknown virus or other threat that cannot be eliminated with the current set of virus definitions. Or, you have a file that you think is infected that is not being detected. Norton AntiVirus prompts you to put the file in Quarantine or it quarantines it automatically. Files that are in Quarantine are isolated from the rest of your computer, so that they cannot spread or reinfect your computer.

You cannot accidentally open the file and spread the virus, but you can still evaluate it for possible submission to Symantec.


About Norton AntiVirus Quarantine

About Norton AntiVirus Quarantine copyright 2004 Symantec

From Norton AntiVirus Quarantine, you can send a file over the Internet directly to Symantec Security Response for analysis. Symantec Security Response determines if your file is infected. If the file is not infected, Symantec Security Response reports the results to you. If your file is infected with a new virus, Symantec Security Response creates and sends you special updated virus definitions to detect and eliminate the new virus on your computer.

You must have an Internet connection to submit a sample and an email address to receive a reply. Once you submit the file in question, Symantec responds immediately with an acknowledgement email message that includes a tracking number that you should use for further correspondence about this file. You are notified again by email with the results of the final analysis within 48 hours.

In addition to quarantined files, Quarantine stores two other groups of items:

  • Backup Items

    • Norton AntiVirus is preset to make a backup copy of a file before attempting a repair. After the repaired file is verified, you can delete the infected backup copy from Quarantine.

  • Submitted To Symantec

    • Files that are sent to Symantec Security Response for analysis are isolated. After you receive the results of the analysis, you can decide what to do with the files.

If you quarantine an individual file out of a compressed file, no location appears in the Original Location column.

More Info about what to do after you quarantine a file


About infections and Quarantine

About infections and Quarantine copyright 2004 Symantec

Like other infected files, an infected file with system load references is quarantined by the Norton AntiVirus Repair Wizard, the references are also stored in Quarantine. If that file is repaired or restored from Quarantine, these references are also automatically restored.

You can review details of these items from the quarantine console.

To review file information

  1. In the Norton AntiVirus Quarantine window, double-click a quarantine item.
  2. Click the Side Effect Info tab.

Norton AntiVirus lets you restore an infected file and it's references that appear in the startup folders, the registry, and the batch and INI files.


If Norton AntiVirus places files in Quarantine

If Norton AntiVirus places files in Quarantine copyright 2004 Symantec

Once a file has been placed in Quarantine, you have several options. All of the actions that you take on files in Quarantine must be performed in the Quarantine window.

The toolbar at the top of the Quarantine window contains all of the actions that you can perform on quarantined files.

Add Item | Adds files to Quarantine. Use this action to quarantine a file that you suspect is infected. This action has no effect on files that are already in Quarantine.
Properties | Provides detailed information about the selected file and the virus that is infecting it.
Repair Item | Attempts to repair the selected file. Use this action if you have received new virus definitions since the file was added to Quarantine.
Restore Item | Returns the selected file to its original location without repairing it.
Delete Item | Deletes the selected file from your computer.
Submit Item | Sends the selected file to Symantec. Use this option if you suspect that a file is infected even if Norton AntiVirus did not detect it.
LiveUpdate | Runs LiveUpdate to check for new protection and program updates. Use this if you haven't updated your virus definitions for a while and then try to repair the files in Quarantine.

To open the Quarantine window

  1. On the left side of the main window, under Norton AntiVirus, click Reports.
  2. In the Reports pane, click View Quarantined items.

To perform an action on a file in Quarantine

  1. In the Quarantine window, select the file on which you want to perform the action.
  2. On the toolbar, select the action that you want to perform.
  3. When you are finished, on the File menu, click Exit.

More Info from the Symantec Knowledge Base Web site


Change Quarantine options

Change Quarantine options copyright 2004 Symantec

You select Quarantine options from the Quarantine window.

To select options

  1. In the main window, under Norton AntiVirus options, click Reports.
  2. In the Reports window, click View Quarantined items.
  3. In the Quarantine window, click View > Options.
    4. If you set a password for Quarantine, Norton AntiVirus asks you for the password before you can continue.
  4. On the tab of the option that you want to change, select the appropriate settings.
  5. Click OK.
    The changes are applied immediately.


Delete an infection

Delete an infection copyright 2004 Symantec

In the Delete window, you can remove the virus from your computer by deleting the file that contains the virus, worm, or Trojan horse. Delete should be used only if the file cannot be repaired or quarantined.

If you do not delete the infected files, the virus or file at risk remains on your computer and can cause damage or be transmitted to others.

If Norton AntiVirus cannot repair a file


Remove an infection

Remove an infection copyright 2004 Symantec

Norton AntiVirus may determine that any attempt to affect virus activity by terminating processes or removing related references may harm your computer.

Norton AntiVirus displays a list of infections for you to review in the Manual Removal window.

You can click to Download removal instructions from the Symantec Web site where you can obtain removal instructions or tools.

More Information

Scan active programs and start-up files from the command line


If Norton AntiVirus cannot repair a file

If Norton AntiVirus cannot repair a file copyright 2004 Symantec

One of the most common reasons that Norton AntiVirus cannot automatically repair or delete an infected file is that you do not have the most up-to-date virus definitions. Update your virus definitions with LiveUpdate, and then scan again.

If that does not work, read the information in the report window to identify the types of files that cannot be repaired, and then take one of the following actions, depending on the file type.

File type | Action
Infected files with .exe, .doc, .dot, or .xls file name extensions (any file can be infected) | Use the Repair Wizard to solve the problem.
Hard disk master boot record, boot record, or system files (such as IO.SYS or MSDOS.SYS) and floppy disk boot record and system files | Replace using your operating system disks.

More Info from the Symantec Knowledge Base Web site

About program updates


Use the Scan Summary

Use the Scan Summary copyright 2004 Symantec

The Scan Summary shows the results of your most recent scan.

The summary includes information on the number of files that are scanned; about the infections that were detected; the action taken to repair, quarantine, and delete the infected files.

The Scan Summary statuses are as follows:.

Status | Description
Scanned | Indicates how many files, master boot records, and/or boot records were scanned
Detected | Indicates how many of the above items, if any, were infected
Repaired | Indicates how many files, if any, were repaired
Quarantined | Indicates how many files, if any, were quarantined. You can view the items in Quarantine by clicking Reports in the Norton AntiVirus main window, and then click View Quarantined Items
Deleted | Indicates how many files, if any, were deleted
Excluded | Indicates how many files at risk were excluded from future scans.


Review the repair details

Review the repair details copyright 2004 Symantec

If your manual scan options are set to repair or delete files automatically, and all infected files are able to be repaired or deleted, you can review the results of the scan in the Scan Summary window.

This status information is presented for review purposes only; you do not need to take further action to protect your computer. You can check the repair details for additional information.

Files that could not be deleted, appear in the Scan Summary window with a status of at risk or delete failed. There are a variety of reasons why some files cannot be deleted: a file may be in use, could be part of a larger program, or could be an infected file associated with a process in memory. Norton AntiVirus recommends that you click the threat name to review the information from the Internet and determine the appropriate action.

To review the repair details

  1. In the Scanner window, in the Summary pane, click More Details.
  2. When you are done reviewing the results, click Finished.

Use the Repair Wizard


Review non-viral threats

Review non-viral threats copyright 2004 Symantec

You can use the Scan Summary window to review non-viral threats that were detected but not deleted during the scan. You can exclude specific threats from future scans, if appropriate. To learn about the threat, click the threat name to launch the Symantec Web site.

To review and exclude the non-viral threats

  1. In the scanner window, in the Summary pane, click Additional non-viral threats remain. To view these items, click here.
  2. When you are done reviewing the results, click Finished.


Review infections detected by the Scan active programs and start-up files option

Review infections detected by the Scan active programs and start-up files option copyright 2004 Symantec

You can review infections that are detected by scanning active programs and start-up files that were not removed automatically. These files include infections with processes that are running in memory or infections that are referenced by a startup folder, initialization file, batch file entries, or registry keys.

To review infections detected by system point scanning

  1. In the Scanner window, in the Summary pane, click Threats remain which Norton AntiVirus could not remove automatically. To view these items, click here.
    You can click the infection's link to launch the Symantec Web site for removal instructions or tools.
  2. When you have completed your review click Finished.


Look up viruses on the Symantec Web site

Look up viruses on the Symantec Web site copyright 2004 Symantec

The Symantec Web site contains a complete list of all known viruses and related malicious code, along with descriptions. You must be connected to the Internet to look up viruses.

To look up viruses

  1. On the left side of the main window, under Norton AntiVirus, click Reports.
  2. In the Reports pane, click View Online Virus Encyclopedia.
    The Symantec Web site opens in your Internet browser.
  3. Use the links on the Web page to access the virus information that you want to view.