SHvFl 1 Posted October 31, 2016 Report Share Posted October 31, 2016 Can you check this video. He deleted every detected malware but a few stayed in the gui even after they were removed. If you watch the video for a few second you can see the malware is no longer present in the location. https://youtu.be/JoT2VDpmpGQ?t=254 Ps. Not my video. Thanks. Quote Link to post Share on other sites
GT500 882 Posted October 31, 2016 Report Share Posted October 31, 2016 I've asked our QA team about this. If they aren't able to reproduce it, then they may need assistance from the person who created the video to get debug info. Quote Link to post Share on other sites
GT500 882 Posted October 31, 2016 Report Share Posted October 31, 2016 OK, here's what was happening. The scan detected a number of files that were in archives (.exe files that had embedded ZIP/RAR/etc archives in them, probably because they were installers). When the scanner detects an infection inside an archive, the cleaning engine (the component in EAM/EIS/EEK that deletes detected threats) deletes the entire archive rather than deleting the file inside the archive that was detected as malicious. When there are multiple files detected in the same archive, it gets deleted when the cleaning engine processes the first file that was detected inside the archive, and thus the archive doesn't exist anymore. When the cleaning engine tries to process the other files that were in the archive, it isn't able to, since the archive is no longer present, and thus those files remain in the list of scan results (since they couldn't be processed). 1 Quote Link to post Share on other sites
SHvFl 1 Posted November 1, 2016 Author Report Share Posted November 1, 2016 Ok this makes sense but shouldn't it remove them from gui if they are no longer physically present? It has no reason to show them if they don't exist. In theory it could track where it removed what and delete all matching detections. Should be possible to be done. 1 Quote Link to post Share on other sites
GT500 882 Posted November 2, 2016 Report Share Posted November 2, 2016 It does make sense to change this behavior, and there is a possibility that we may do so in the future. Note that we generally can't guarantee that a change will make it into a future version of our software until there's a publicly available beta version that has the change. 1 Quote Link to post Share on other sites
SHvFl 1 Posted November 2, 2016 Author Report Share Posted November 2, 2016 Yeah i know, i just wanted to see if it was only me that had this opinion. Sometimes until you share your idea you can't know if it's stupid or not. Quote Link to post Share on other sites
GT500 882 Posted November 2, 2016 Report Share Posted November 2, 2016 Understandable. Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.