Actions

Settings that are not supported in check of stations under UNIX system-based and OS X are included into square brackets [ ].

On the Actions tab, you can configure reactions of Scanner on detection of infected or suspicious files, malware and infected archives.

Dr.Web Agent Scanner automatically applies actions that are specified for detected virus threats.

The following actions for detected threats are provided:

•Cure—restore the original state of an object before infection. If the object is incurable, or the attempt of curing fails, the action set for incurable viruses is applied.

Available for known viruses only except Trojan programs that are deleted on detection, and infected files within complex objects (archives, mail boxes or file containers).

•Delete—delete infected object.

•Move to quarantine—move the object to the special Quarantine at the station.

•Report—send a notification to the Control Center about the detection of a virus (see the Setting Alerts section on how to configure alerts).

•Ignore—skip the object without performing any action and do not send notification in the scan statistic.

Reactions of Scanner to various virus events

Object	Action
Object	Cure	Delete	Move to quarantine	Report	Ignore
Infected	+/*	+	+
Suspicious		+	+/*		+
Incurable		+	+/*
Containers		+	+/*
Archives		+	+/*
Email files			+/*		+
Boot sectors	+/*			+
Adware		+	+/*		+
Dialers		+	+/*		+
Jokes		+	+/*		+
Riskware		+	+/*		+
Hacktools		+	+/*		+

Conventions

To set actions on detected threats, use the following options:

•The Infected files drop-down list specifies the Scanner reaction to the detection of a file infected with a known virus.

•The Suspicious files drop-down list specifies the Scanner reaction to the detection of a file presumably infected with a virus (upon a reaction of the heuristic analyzer).

If scanning includes the OS installation folder, it is recommended to select the Report action for suspicious files.

•The Incurable files drop-down list specifies the Scanner reaction to the detection of a file infected with a known incurable virus and in case if attempt to cure a file is failed.

•The Infected containers drop-down list specifies the Scanner reaction to the detection of an infected or suspicious file in a file container.

•The Infected archives drop-down list specifies the Scanner reaction to the detection of an infected or suspicious file in a file archive.

•The Infected archives drop-down list specifies the Scanner reaction to the detection of an infected or suspicious file in email format.

If viruses or suspicious program code is detected within complex objects (archives, email attachments or file containers), an actions selected for this type of a complex object is performed to a whole object, not just to the infected part. By default informing the user on the threat is performed.

•The Infected boot sectors drop-down list specifies the Scanner reaction to the detection of an viruses or suspicious program code in the boot sectors area.

•In the following drop-down list, set the Scanner reaction to the detection of corresponding type of unsolicited software:

▫Adware;

▫Dialers;

▫Jokes;

▫Riskware;

▫Hacktools.

If you select Ignore, no action is performed: no notifications are sent to the Control Center as compared to when you select Report on virus detection.

Set the [Restart computer automatically] flag to reboot user's computer automatically after the scan is completed, if during the check infected objects detected and the cure process requires reboot of operating system. If the flag is cleared, reboot of a user's computer is not performed. Statistics of a station scan received by the Control Center, contains notification on the need of station reboot to compete the cure process. Information on a state that requiring reboot is displayed in the State table. Administrator is able to reboot a station from the Control Center if it is needed (see the Anti-Virus Network section).

Set the Show scan progress flag to display a progress bar and the status bar of the stations scan process in the Control Center.