MemoryScan

Summary

---

Suspicious processes/components were found in the virtual memory after the suspect file was executed and examined in a virtual test system.

Removal

---

Flagged as Suspicious

If a file contains potentially damaging routines or suspicious code, F-Secure security products will flag it as Suspicious as a precautionary measure. Once detected, the F-Secure security product may either automatically disinfect the suspect file or prompt the user to select a desired action. For more information, see: Support Community article: Automatic actions for viruses also used for suspicious items.

Recategorization

If in doubt, or in cases where a legitimate file is suspected to contain malicious code, please send a sample to F-Secure Security Labs via the Submit A Sample (SAS) page for analysis. In some cases, subsequent analysis may determine the file is a False Alarm or False Positive. The relevant detection will then be modified to ensure the issue does not reoccur.

Technical Details

---

A detection in the format 'Memscan:[variable]', where [variable] can be 'trojan', 'worm', 'virus' or similar, is a Heuristic Detection of a file or program that behaves in a suspicious or potentially harmful manner.

To examine a suspect program's behavior, security software will run it in an isolated "virtual system" and observe its actions within the contained environment, without compromising or endangering the user's actual system. Suspect files that perform suspicious or harmful actions in the virtual system will trigger a Heuristic Detection.