Using Security History

Security History provides a centralized location where you can view your alert history, results of scans that have run on your computer, and items that you have submitted to Symantec Security Response. In addition, you can manage quarantined items in Security History.

Security History lets you monitor the security tasks that your product performs in the background. In addition, alerts that you have received can be reviewed at any time in Security History. This means that if you cannot review an alert when you receive it, you can review it later in Security History.

More Information

Opening Security History

Viewing items in Security History

About the Advanced Details window

Searching in Security History

Managing items in the Quarantine


Opening Security History

You can access Security History from the main window.

To open Security History

  • On the left-hand side of the main window, under Quick Tasks, click View History.

More Information

Viewing items in Security History


Viewing items in Security History

You can view many different categories of items in Security History.

To view items in Security History

  1. On the left-hand side of the main window, under Quick Tasks, click View History.

  2. In Security History, in the Select View drop-down list, select the category of items that you would like to view. Your options are:

    Recent History

    Displays the alerts that you received in the last seven days.

    Full History

    Displays the complete Security History.

    All Firewall Alerts

    Displays a combined view of all of the alerts in the Firewall - Traffic and Firewall - Network categories.

    Firewall - Traffic

    Displays information about the computers that attempt to access your computer and about intrusion attempts that use known attack signatures. Also displays the alerts that determine the Internet access status of programs on your computer.

    Computers are described by their IP Addresses.

    The Advanced Details view lets you trust or restrict computers that attempt to access your computer. You can also choose to allow programs that have been blocked.

    Firewall - Network

    Displays information about the networks that your computer connects to. Also displays the actions that you have taken to trust or to restrict networks and computers.

    The Advanced Details view lets you modify trust or restrict settings for computers and networks.

    Resolved Security Risks

    Displays a list of security risks that Norton Internet Security has detected and repaired, removed, or quarantined.

    Manual Scan Results

    Displays the results of the manual scans that you have run.

    Suspicious Email

    Displays a list of the suspected email worms that have been detected in outgoing email messages.

    Unresolved Security Risks

    Displays a list of security risks that Norton Internet Security was not able to repair, remove, or quarantine.

    Quarantine

    Displays all of the security risks that have been isolated in the Security History Quarantine.

    Submitted Items

    Displays a list of the files that you have submitted to Symantec Security Response for analysis.

  3. Select a row to view details for that item.

    If you want to view additional information or take an action for the item, click More Details.

  4. View Advanced Details and take actions as needed.

  5. Click Back to Security History.

More Information

About the Advanced Details window

Searching in Security History

Managing items in the Quarantine


About the Advanced Details window

The Advanced Details window lets you view more information about items that you select in the various Security History views. You can also perform actions if there are actions available for the selected item.

The Advanced Details window lets you take the following actions:

Restore Risk | Returns the selected item to its original location without repairing it.
Remove From History | Removes the selected item from the Security History log.
Submit to Symantec | Sends the selected item to Symantec. You can use this option if you suspect that an item is infected, even if scans have not identified it as a risk.
Trust | Allows the selected computer or allows all of the unclassified computers on the selected network to access your computer.
Restrict | Blocks the selected computer or blocks all of the unclassified computers on the selected network from accessing your computer.
Remove trust | Removes the trusted status from the selected computer or from all of the unclassified computers on the selected network.
Remove restriction | Removes the restricted status from the selected computer or from all of the unclassified computers on the selected network.
Allow | Allows the selected program to access the Internet.
Stop notifying me | Prevents Norton Internet Security from notifying you when it blocks the selected attack signature in the future.
Notify me | Allows Norton Internet Security to notify you when it blocks the selected attack signature in the future.


Searching in Security History

You can search in Security History. The Quick Search works on the current view only. If you want your search to include all of the items in Security History, you must select the Full History view.

You can use the Quick Search to find items using a key word or the name of a security risk. For example, if you want to view all of the alerts that Auto-Protect has generated, you can filter for the term Auto-Protect. If you want to view all of the items that pertain to a particular security risk, you can type the security risk name, such as Adware.Hotbar.

To search in Security History

  1. In Security History, in the Quick Search text box, type the name of the item for which you want to search.

  2. Click the arrow icon.


Managing items in the Quarantine

The Security History Quarantine provides a safe location on your computer where items can be isolated while you decide what action you want to take on these items. Quarantined items are isolated from the rest of your computer, so that they cannot spread or reinfect your computer. Sometimes unknown viruses or other security risks are detected, but cannot be eliminated with the current set of protection updates. These items are quarantined automatically. Or, you may have an item that you think is infected that is not being detected as a risk when it is scanned. You can manually place the item in the Quarantine.

It is not possible to open quarantined items accidentally and spread the virus, but you can evaluate the quarantined items for possible submission to Symantec.

The Quarantine includes the following groups of items:

Security risks | Includes items such as spyware and adware that are generally low risk and that may be required by another program in order for that program to function properly. You can restore these items if necessary.
Security threats | Includes viruses and other high-risk items.

Once an item has been quarantined, you have several options. All of the actions that you take on quarantined items must be performed in the Security History Quarantine.

To open the Quarantine

  1. On the left side of the main window, under Quick Tasks, click View History.

  2. In the Select View drop-down, click Quarantine.

To perform an action on a quarantined item

  1. In Security History, in the Quarantine view, select the item on which you want to perform the action.

  2. In the right pane, click More Details.

  3. Under Actions, select the action that you want to perform. Your options are:

    Restore Risk

    Returns the selected item to its original location without repairing it.

    Remove From History

    Removes the selected item from the Security History log.

    Submit to Symantec

    Sends the selected item to Symantec. You can use this option if you suspect that an item is infected, even if scans have not identified it as a risk.

  4. Click Back to Security History.

More Information

Adding an item to the Quarantine

Restoring an item from the Quarantine

Removing an item from the Quarantine item

Manually submitting an item to Symantec


Adding an item to the Quarantine

You can manually add an item to the Security History Quarantine. You can use this action to quarantine the items that you suspect are infected. This action has no effect on items that are already quarantined.

To add an item to the Quarantine

  1. In Security History, in the Quarantine view, click Add Item to Quarantine.

  2. In the Manual Quarantine dialog box, in the Description text box, type a short name for the item that you want to add.

    This text appears in the Quarantine, so you should use a recognizable description.

  3. Click Browse.

  4. In the Select File to Quarantine dialog box, browse to select the item that you want to add, and then click Open.

  5. To remove the item from your disk so that it exists only in the Security History Quarantine, in the Manual Quarantine dialog box, check Remove file from disk.

  6. Click Add.

  7. Click Close.


Restoring an item from the Quarantine

Some programs rely on other programs that are classified as security risks in order to function. For example, the program may not function if a particular file is removed. All of the removed security risks are automatically backed up in the Security History Quarantine, so if a program you need stops working, you can restore the risk in order to regain functionality.

If you restore an item to a directory other than its original location, it may not function properly.

To restore an item from the Quarantine

  1. In Security History, in the Quarantine view, select the item that you want to restore.

  2. Click More Details.

  3. In the Advance Details window, under Actions, click Restore Risk.

  4. In the Quarantine Restore window, click Yes.

  5. Click Close.


Removing an item from the Quarantine item

You can remove items from the Quarantine. If you remove an item, it cannot be restored later.

To remove an item from the Quarantine

  1. In Security History, in the Quarantine view, select the item that you want to remove.

  2. Click More Details.

  3. In the Advanced Details window, under Actions, click Remove From History.

  4. In the Delete Quarantine Item dialog box, click Yes.


Manually submitting an item to Symantec

When a virus or other risk is detected, it is automatically submitted to Symantec Security Response for analysis. If you have turned off the option to submit risks automatically, you can manually submit them from the Security History Quarantine. You must have an Internet connection to submit an item.

When you submit files to Symantec automatically or manually, you contribute to the effectiveness of your Symantec product. For example, you can submit an item that has not been detected during scanning that you believe may be a security risk. Symantec Security Response will analyze the file. If it is identified as a security risk, it will be added to a future protection update.

Personally identifiable information is never included in submissions.

In some cases it is necessary for Symantec Security Response to block submissions of a particular type or volume. These items appear as Not Submitted in Security History.

To manually submit an item to Symantec

  1. In Security History, in the Quarantine view, select the item that you want to submit to Symantec.

  2. Click More Details.

  3. In the Advanced Details window, under Actions, click Submit to Symantec.

  4. Click OK.