05-02-2012 10:46 AM
I just installed SAF & it detected 5 threats. Opening the Quarantine Manager I found many MS Word docs but only one threat "OF97/Crown-C". These are very important files, so I need to know if I clean these files, will they be deleted in order to eleminate the virus. Also, why does SAF say 5 threats are detected but only one is shown in the Quarantine Manager?
05-02-2012 04:20 PM
You have 5 documents that are all infected with the same macro virus. The Quarantine manager is showing you that you have a single threat that has spread to five distinct files.
OF97/ detections remove the malicious macros from the documents but leave the documents themselves intact. If those documents contain other macros, there is the slight possibility that these macros will be affected -- however, NOT cleaning the malicious macros will ensure that any other documents you open in the same session as an infected document (including the normal.dot file if it's infected) will also become infected -- and if you send these documents to anyone else, their computers will also become compromised. Best to clean up the macros and then restore from a known-good backup if you find critical macros are missing from your documents.