Avira AntiVir Premium Help
Detection :: Suspicious processes
If suspect processes are detected when scanning the active processes of Scanner, you will receive an alert if you have selected interactive mode or automatic mode as the action mode for virus detection with the Display Alert option (see the configuration section Scanner::Scan::Action on detection). In interactive mode you can choose in an initial dialog box whether to close the process, while in the subsequent dialog box you can choose what to do with the executable file. In automatic mode with alerts the program is automatically closed. There is no selection option for handling the executable file. The action that was automatically executed is displayed in the message.
The dialogs shown below are messages in interactive mode.
If reporting is enabled, the Scanner enters each detection in the Report file.
Alert message: Terminate process?
File name of the executable file
Name of the virus or unwanted program.
When this option is enabled, the process is terminated.
When this option is enabled, the process is not terminated, but remains active. There are no further alerts issued about the executable file.
Alert message: Affected file
Name and path of the currently detected virus or unwanted program
The name and path of the currently detected virus or unwanted program is displayed in the middle window of the message.
If this option is enabled, the Scanner repairs the affected file.
The option Repair can only be enabled if a repair of the detected file is possible.
Move to quarantine
If this option is enabled, the Scanner moves the file to quarantine. The file can be restored from the Quarantine Manager if it is of informative value or - if necessary - sent to the Avira Malware Research Center. Depending on the file, further selection options are available in the Quarantine Manager.
If this option is enabled, the file is deleted but can be restored if necessary with appropriate tools (e.g. Avira UnErase). The virus pattern can still be detected again. This process is much quicker than "overwrite and delete".
Overwrite and delete
If this option is enabled, the Scanner overwrites the file with a default pattern and then deletes it. It cannot be restored.
If this option is enabled, the Scanner renames the file. Direct access to these files (e.g. with double-click) is therefore no longer possible. Files can later be repaired and given their original names again.
If this option is enabled, access to the file is allowed and the file is left as it is.
The affected file remains active on your workstation! It may cause serious damage on your workstation!
Copy file in quarantine before action
If this option is enabled, the Scanner creates a back-up copy before carrying out the requested action. The back-up copy is saved in quarantine. It can be restored from the Quarantine Manager if it is of informative value or - if necessary - sent to the Avira Malware Research Center. Depending on the file, further selection options are available in the Quarantine Manager.
Apply selection to all subsequent detections
If this option is enabled, the Scanner uses the selected option for all malware detected during the scan.
Buttons and links
Button / link
With this link - and with an active Internet connection - you can access an Internet page with further information on this virus or unwanted program.
This page of the online help is opened via this button or link.