Note

This document applies to Norton AntiVirus 2004. If you have Norton AntiVirus 2005, then read What to do when Norton AntiVirus 2005 detects a threat or security risk.

STEP 1		Print this page
		We suggest that you print this page before you start.  Expand each section by clicking the "+" before you actually print. PRINT

STEP 2		Select the risk type
		If the alert appeared during a manual scan, to locate the type of risk that Norton AntiVirus has detected, look at the Action heading to the right of the risk listed in the Norton AntiVirus Repair Wizard. If you see an Auto-Protect alert, then the type of threat will be named in the text of the alert.  Virus, worm, or Trojan In most cases, Norton AntiVirus 2004 automatically repairs virus-infected files or automatically deletes files that are infected by a worm or Trojan. After a successful repair or deletion, Norton AntiVirus displays a dialog box to inform you of the detection and what action was taken. The appearance of the dialog box differs depending on whether Auto-Protect or the manual scanner detected the infection. Read the information under the section for the type of alert that was displayed.   Auto-Protect detection When you see this alert, if you have Internet access and want more information on the threat, then click the virus name to go to the Symantec Security Response online database. (For example, in this case, click EICAR Test String.)  If Norton AntiVirus cannot successfully repair a virus-infected file or delete a worm or Trojan-infected file, then it will attempt to automatically quarantine the file. See the document What to do after you quarantine a file for more information about the quarantine process.  If quarantine is not successful, then Norton AntiVirus will attempt to delete the file. A successful deletion bypasses the Windows Recycle Bin and completely removes the file from the hard drive.  If Norton AntiVirus cannot delete the file, then it denies access to the file to make sure that the file cannot infect the computer. For more information on why Norton AntiVirus denies access to a file, read the document What does it mean when Norton AntiVirus denies access to a file?. Norton AntiVirus cannot repair, quarantine, or delete a file that is running in memory or that you do not have permission to access. In most cases, you can start Windows in Safe mode, scan for viruses, and then delete infected files. To restart the computer in Safe mode, read the document Starting your computer in Safe mode. Note You must turn off the power for at least 30 seconds to remove the virus from memory. Do not use the reset button to start your computer in Safe mode.   Manual scan detection Manual scan detection Manual scan summary. Click More Details for information on the results of the repair process. If you want more information on the threat and you have Internet access, then click the threat name to go to the Symantec Security Response online database. (For example, in this case, click EICAR Test String.) If Norton AntiVirus cannot successfully repair a virus-infected file or delete a worm or Trojan-infected file, then it will attempt to automatically quarantine the file. See the document What to do after you quarantine a file for more information about the quarantine process. If quarantine is not successful, then Norton AntiVirus will attempt to delete the file. A successful deletion bypasses the Windows Recycle Bin and completely removes the file from the hard drive. If Norton AntiVirus cannot delete the file, then it denies access to the file to make sure that the file cannot infect the computer. For more information on why Norton AntiVirus denies access to a file, see the document What does it mean when Norton AntiVirus denies access to a file? Norton AntiVirus cannot repair, quarantine, or delete a file that is running in memory or that you do not have permission to access. In most cases, you can start Windows in Safe mode, scan for viruses, and the infected file will be automatically repaired or deleted. To restart the computer in Safe mode, read the document Starting your computer in Safe mode. Note You must turn off the power for at least 30 seconds to remove the virus from memory. Do not use the reset button to start your computer in Safe mode. Adware, spyware, dialer, hack tool, remote access program, joke program, or other type of security risk   From the Repair Wizard (Manual Scan) Click the hyperlinked title of the detected security risk in the Norton AntiVirus Repair Wizard results screen to go to the write-up, and then follow the removal instructions in the write-up to remove the security risk.   From the Norton AntiVirus Activity Log 1 Open Norton AntiVirus.  If Norton AntiVirus was installed as part of Norton Internet Security or Norton SystemWorks, then open that program and click Norton AntiVirus. 2 Click Reports and View Report to the left of Activity Log. 3 Click Threat activity. 4 Click the link to the security risk write-up and follow the instructions to remove the risk.   From the Security Response online database Note the name of the security risk, and then go to the Symantec Security Response online database and search for the security risk write-up and follow the removal instructions in the write-up to remove the risk. Note For additional information on these risks (including Script Blocking to handle malicious threats), consult the Norton AntiVirus help file in your software. Start Norton AntiVirus, click Help & Support in the upper-right corner, and then choose Norton AntiVirus Help from the menu. Click "Index" to enter a search term.

©1995 - 2012 Symantec Corporation