Summary
The Security Agent (SA) detects multiple infected files twice with different scan results or action taken.
The SA may return the following results when cleaning multi-infected file:
| Description | Result (Action taken) |
|---|---|
| Completely cleaned file, product logs contain one entry | Cleaned |
| Deleted file, product logs contain two entries | Cleaned, Quarantined |
| Incompletely cleaned file, product logs contain two entries | Cleaned, Action required |
| Untouched infected file, product logs contain one entry | Action Required |
| Deleted file, product logs contain one entry | Quarantined |
Details
This is not an issue. This is how VSAPI (Virus Scan Application Programming Interface) detects and clean a file.
Example:
SA detects a file that has been infected multiple times. When VSAPI detects this file for the first time, it will run a scan and return the first scan result (action taken). If the file is still not clean after the first attempt, VSAPI will run again another series of scan to clean the file. As a result, SA will display the second scan result.
