Frequently Asked Questions

• What is the difference between F-Secure Anti-Virus for Windows Servers and F-Secure Anti-Virus for Citrix Servers products?
• I have many files with extension like '0xe', '0ll' and so on in my hard drive. What are these files?
• F-Secure Anti-Virus has detected a virus in the "System volume information" or the "_RESTORE" folder, but it cannot disinfect, rename or delete the infected file? What can be done to get access to those files?
• Can I install F-Secure Anti-Virus 5 for Servers to Terminal Server computer?
• Should I manually scan my hard disks on daily basis?
• How do I update the databases of F-Secure Anti-Virus?

The F-Secure Anti-Virus for Windows Servers and the F-Secure Anti-Virus for Citrix Servers products are different both functionally and license wise. Functional differences refer to the use cases of the whole system, as well as to the underlying functionality.

To illustrate the above statement:

If a user copies a file from a file server to his own hard disk, the file is scanned with F-Secure Anti-Virus for Windows Servers as it is accessed in the file server. The file will be scanned again of course when it is written to the workstation’s hard disk but that scanning is performed by the workstation's antivirus product, if one exists.

The Citrix environment provides much more flexibility in accessing files wherever they reside through various ICA (Citrix) connections. For example, when accessing a .doc file through the ICA connection, the file is scanned by F-Secure Anti-Virus for Citrix Servers regardless of: the file’s location; the Citrix server itself; or the user's hard disk.

Also, the user is able to perform manual scans on his workstation’s hard disks by using F-Secure Anti-Virus for Citrix Servers if he has the ICA connection to the Citrix Server. In principle, workstations are protected in a Citrix environment by simply deploying F-Secure Anti-Virus for Citrix Server to the Citrix Server, even if there would not be antivirus protection at the workstation level at all. In the network security sense, this hypothetical scenario would be true only if the user's actions would be limited to ICA connections.

These files were found infected and were renamed by F-Secure Anti-Virus. These files are still infected, but they can't spread from the computer automatically or otherwise harm it because the file extension has been changed. Rename operation done by FSAV changes the first character from the file extension to a number (0,1,2,...).

You can normally delete these infected files without worries. You can also leave them on your hard disk, because they're not dangerous in itself. This way you won't delete important system files or for example your mailbox by accident. You can also try first to disinfect these files, if you believe that they're important.

With default settings, first operation on infected file is file disinfection (Action on infection=Disinfect automatically). If disinfection fails, file is then renamed. Disinfection may fail for example if the file is a worm or a trojan. This is because file has then no clean part in it, it's all infected code. Files can also be renamed automatically by F-Secure product if it's configured to do so (Action on infection=Rename automatically). You should check your product settings on this by double clicking the blue F-logo in the system tray and finding the virus scanning settings.

Depending on real-time scanning settings, files with these extensions (0xe, 0ll, etc) might not be found during normal program usage. With default settings, real-time scans only files with specified extensions and manual scan checks all files.

Please use one of the methods described on the following pages.

European page:

US page: