What to do if a security risk is found

Your product provides many solutions and features for handling viruses and other security threats that it detects.

In addition, your product provides solutions for security risks, such as spyware and adware.

More Information

How viruses, spyware, and other risks are detected

Reviewing Auto-Protect notifications

Responding to Worm Blocking alerts

Responding to problems reported during a scan

If Norton Internet Security cannot repair a file

Looking up viruses on the Symantec Web site


How viruses, spyware, and other risks are detected

Viruses and other security threats can be found during a manual or scheduled scan or by Auto-Protect when you perform an action with an infected file. Threats can also appear during an instant messenger session, when you send an email message, or during a manual or scheduled scan.

Security risks, such as spyware and adware, can also be detected while performing these activities.

When Scan active programs and startup files is turned on (this feature is on by default), files that have already infected your system or that can potentially infect your system when your computer first starts up are scanned first.

These files include the following:

  • Files that are associated with processes that are currently running in memory

  • Files with startup folder entries

  • Files with system start INI file entries

  • Files with system start batch file entries

  • Files that are referenced by system start registry keys

If an infected file is detected during this portion of the manual scan, it is repaired or removed. Any unnecessary references are also removed from your computer. Before attempting to repair, quarantine, or delete any infected file that has a process running in memory, your product attempts to terminate the process. You are alerted and prompted to close all unnecessary programs before the process is terminated.

You can view information about detected viruses and other security threats in Security History.

Security History also includes information about spyware, adware, and other security risks.

More Information

Viewing items in Security History


Reviewing Auto-Protect notifications

Auto-Protect scans files for viruses, worms, and Trojan horses when you perform an action with them, such as moving them, copying them, or opening them.

It also scans for spyware, adware, and other security risks.

If Auto-Protect detects suspicious activity, it logs a notification in Security History telling you that a risk was found and resolved.

If one or more viruses are found and either repaired or deleted by Auto-Protect, the notification tells you which file was repaired or deleted and which virus, Trojan horse, or worm infected the file. No further action is necessary.

To review Auto-Protect notifications

  1. At the top of the main window, click the Norton Internet Security tab.

  2. On the left-hand side of the main window, under Quick Tasks, click View History.

  3. In the Select View drop-down list, select the time period for which you want to review Auto-Protect alerts. Your options are:

    Recent History

    Review Auto-Protect notifications that you received in the last seven days.

    Full History

    Review all of the Auto-Protect notifications that you have received.

  4. In the right pane, click More Details.

    If one or more security risks such as spyware are found, you can take action on these items.

  5. Select the action that you want to take. Your options are:

    Scan now (recommended)

    The risk is scanned immediately.

    Exclude this risk from future scans

    The risk will not be included in future scans.

    Ignore this risk for 30 minutes

    The risk will be ignored for 30 minutes, but will be included in future scans.


Responding to Worm Blocking alerts

If a program tries to email itself or a copy of itself, it could be a worm trying to spread through email. A worm can send itself or send a copy of itself in an email message without any interaction with you.

Worm Blocking continually scans outgoing email attachments for worms. If it detects a worm, you receive an alert telling you that a malicious worm was found.

The alert presents you with options and asks you what to do. If you were not sending an email message at that time, then it is probably a worm and you should quarantine the file.

To respond to Worm Blocking alerts

  • In the alert window, select the action that you want to take. Your options are:

    Stop this program from emailing itself

    Stops the worm from emailing itself at this time, but does not quarantine the worm. This action leaves the worm on your computer, where it can possibly be activated again. Select this option only if you are sure that you want to leave the worm on your computer.

    Quarantine this program (Recommended)

    Permanently stops the worm by putting it in Security History. While in Security History, the worm is unable to spread. This is the safest action.

    Allow this program to email itself

    Sends the email message that contains the worm. If you allow the worm to be emailed, it could infect the recipient's computer. Select this option only if you are sure the email is not infected with a worm.

    Always allow this program to email itself

    Sends the email message that contains the worm anytime it tries to email itself. In the future, Norton Internet Security will not check this file for worms. This is the riskiest action because this worm could email itself from your computer without your knowledge.

If a malicious worm is found, it should be quarantined.

To quarantine a worm-infected file

  1. In the alert, in the drop-down list, click Quarantine this worm (Recommended).

  2. After the worm has been quarantined, perform the following tasks:

    • Run LiveUpdate to ensure that you have the latest protection updates.

    • Scan your computer.

    If nothing is detected, submit the infected file to Symantec Security Response, indicating that the file was detected and that you have scanned it with the latest protection updates. Symantec Security Response will reply to you within 48 hours.

More Information

What gets updated

Running a Full System Scan


Responding to problems reported during a scan

At the end of a scan, the Results Summary tab tells you what was found during the scan. You can use the Attention Required tab to resolve any items that were not automatically resolved during the scan. You can also view more information about the detected items on the Detailed Results tab.


If Norton Internet Security cannot repair a file

One of the most common reasons that Norton Internet Security cannot automatically repair or delete an infected file is that you do not have the most current protection updates. Run LiveUpdate, and then scan again.

If that does not work, read the information in the on the Attention Required tab to identify the types of files that cannot be repaired, and then take one of the following actions, depending on the file type:

Infected files with .exe, .doc, .dot, or .xls file name extensions (any file can be infected) | Use the Attention Required tab to solve the problem.
Hard disk master boot record, boot record, or system files (such as IO.SYS or MSDOS.SYS) and floppy disk boot record and system files | Replace using your operating system disks.

More Information

About the Attention Required tab


Looking up viruses on the Symantec Web site

The Symantec Web site contains a complete list of all known viruses and related malicious code, along with descriptions. You must be connected to the Internet to look up viruses.

To look up viruses on the Symantec Web site

  1. At the top of the main window, click the Norton Internet Security tab.

  2. Open the Reports & Statistics bar.

  3. Click View Online Virus Encyclopedia.

    The Symantec Web site opens in your Internet browser. Use the links on the Web page to access the virus information that you want to view.