stapp 153 Posted February 7 Report Share Posted February 7 I have quite a few different types of eicar files that I keep in downloads so I can test EAM scanner. I always have EAM set to ALERT so that I can see in Forensic logs what they found. Today I was copying my pics and docs (including downloads) onto a memory stick as an additional backup along side Macrium. EAM quarantined 2 of the items... why? The other 2 eicar were left in downloads and copied over to the memory stick. (they were zip files) Quote Link to post Share on other sites
Frank H 108 Posted February 8 Report Share Posted February 8 When you have set the File Guard in Default Scan mode, .com files are scanned. Zip files are not. Quote Link to post Share on other sites
JeremyNicoll 80 Posted February 8 Report Share Posted February 8 But why was anything quarantined? @stappsaid that EAM was configured just to /alert/. Quote Link to post Share on other sites
Kevin Zoll 309 Posted February 8 Report Share Posted February 8 Check and make sure that "Automatically quarantine files with bad reputation" is not checked in Settings => Advanced. That looks like a a reputation based action was taken. Quote Link to post Share on other sites
Frank H 108 Posted February 8 Report Share Posted February 8 30 minutes ago, JeremyNicoll said: But why was anything quarantined? @stappsaid that EAM was configured just to /alert/. I just tested and i got an alert while copying. @Kevin Zoll Alert overrules that setting you pointed to. Quote Link to post Share on other sites
stapp 153 Posted February 9 Author Report Share Posted February 9 @Frank H I didn't see an alert. Is it expected behaviour for 'copy' to quarantine something even when I just have 'alert' as my preferred choice ? Quote Link to post Share on other sites
Frank H 108 Posted February 9 Report Share Posted February 9 14 hours ago, stapp said: s it expected behaviour for 'copy' to quarantine something even when I just have 'alert' as my preferred choice ? Nope, an alert should popup if you have set that ,see screenshot. why that didn't happen? no idea. maybe you could try again. Quote Link to post Share on other sites
stapp 153 Posted February 10 Author Report Share Posted February 10 I'll have another look when I next do a backup copy of all my data again to usb. I rely on Macrium so the backup is just for extra insurance. Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.