Scan Engine does not delete the Eicar.org test virus

Products

• Scan Engine

Issue/Introduction

Scan Engine does not delete the Eicar.org test virus or any other infected files although the Scan and Repair or Delete option has been selected as the Antivirus policy.

Cause

Limitations of the Scan Engine and RPC protocol.

Resolution

When using RPC, Scan Engine does not have the option to delete the infected files unless they are inside an archive/container/compressed file. The Scan and Delete option exists only for ICAP. This works as designed. Scan Engine will prevent access to the Infected file. The Filer administrator will need to delete the file manually from the Filer.

However in most cases the the virus can not be deleted because it is set to read-only. You can then configure the Scan Engine to delete the file anyway using http://www.symantec.com/docs/TECH123891

 

 

 

Applies To

- NAS NetApp Filer

- Scan Engine 5.2.x