{"id":4716,"date":"2026-10-01T16:24:02","date_gmt":"2026-10-01T13:24:02","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&#038;p=4716"},"modified":"2026-10-01T16:24:02","modified_gmt":"2026-10-01T13:24:02","slug":"how-to-check-what-action-was-taken-on-a-file-by-elements-endpoint-protection-during-a-detection","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/how-to-check-what-action-was-taken-on-a-file-by-elements-endpoint-protection-during-a-detection\/","title":{"rendered":"How to check what action was taken on a file by Elements Endpoint Protection during a detection?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>Elements Endpoint Protection has detected a malicious file on a computer. How to check what action was taken on the malware \/ virus?\u00a0<\/p>\n<p>\u00a0<\/p>\n<h3>Resolution:<\/h3>\n<p>You can check the removal.log for the actual action taken on the detection. The removal.log will show if the file was for example blocked, quarantined or deleted.\u00a0<\/p>\n<p>You can collect a wsdiag diagnostic file by running the WithSecure Support Tool. It will create a wsdiag file to the desktop.<\/p>\n<p>The removal.log file can be found at: f-secure\\logs\\system\\FSAV\\<\/p>\n<p>Below are the sample of log that will be output:<\/p>\n<p>[removal.log]<br \/>\u00a0Worm.WORM\/LNK.Lodbak.Gen BEGIN<br \/>;<br \/>;Log created by USS version 5.8.255<br \/>;<br \/>Worm.WORM\/LNK.Lodbak.Gen file &quot;E:\\CANON (16GB).lnk&quot; quarantined success\u00a0<br \/>Worm.WORM\/LNK.Lodbak.Gen file &quot;E:\\CANON (16GB).lnk&quot; deleted success\u00a0<br \/>Worm.WORM\/LNK.Lodbak.Gen END<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I received a pop up, showing a virus was detected on my PC, but i&rsquo;m not so sure regarding the actual action taken on that virus.<br \/>Can I check this from log file in fsdiag?<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4716","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000004956","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-01 13:24:02","import_hash":"a841ea2094331ffde4982e2c92791dad735d191b","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/4716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=4716"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=4716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}