Protect Remediation Error

Products

• Symantec Products

Issue/Introduction

You have a Discover scan configured to leave a 'ransom' note in the folder where a violating file was found and quarantined. You view a Discover Report and see this Error:

Protect Status:   Protect Remediation Error.

Incident Details:

Server:         Discover Server Name    

Protect Status:   Protect Remediation Error

Target:          <Scan Name>

Scan:            <Date>

Detection Date:   <Date>

Seen Before:  First seen <Date>

Is Hidden:  No [ Do Not Hide ]
      

File Location:        //<IP Address>/abc/MyFile.pdf

             [ go to file | go to directory ]

Remediated Location:       File "//<IP Address>/abc/MyFile.pdf.TXT" already exist in scanned share.

Document Name           MyFile.pdf   

Cause

This caused by the 'ransom note' existing in the folder from a previous detection and the violating file that triggered the previous incident has been copied back into the original location.  When the file is detected again the file is again quarantined but a second 'ransom note' cannot be left in the folder to replace the first one. 

Resolution

Remove the ransom note .txt file and the next time the violating file is found there will be a new ransom note left behind and the error will no occur