Summary
When scanning an EICAR test file, the malware scanning results between Deep Security Agent (DSA) Windows and DSA Linux or Deep Security Virtual Appliance (DSVA) are different.
The Anti-Malware Configuration Properties are shown below:
Details
The issue is a specification of Deep Security. The difference in malware scanning results is due to the fact that DSA Windows uses Anti-Malware Solution Platform (AMSP) while the DSA Linux and DSVA uses VSAPI.
Below are the results when using ActiveAction (Clean):
- Windows agent shows "Deleted", but the malware is actually quarantined.
- Linux agent and DSVA show "Quarantined" as the malware is really quarantined.
