Scanning items which are deleted

[The_ChamP]

I just noticed that when i do a quick scan the scanning items shows that wsa is scanning items that i deleted 3 days ago [ songbird portable and splayer portable ]

Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 3
Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 4
Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 8
Tue 2011-08-09 20:08:21.0225 Monitoring process D:\SongbirdPortable\SongbirdPortable.exe [5949661BEFF4D1D4128AB3DA8A39D810]. Type: 6
Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 3
Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 4
Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 5
Tue 2011-08-09 20:08:21.0677 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 7
Tue 2011-08-09 20:08:21.0682 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 8
Tue 2011-08-09 20:08:21.0682 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 6
Tue 2011-08-09 20:08:22.0162 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 2
Tue 2011-08-09 20:08:38.0981 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 3
Tue 2011-08-09 20:08:38.0981 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 4
Tue 2011-08-09 20:08:38.0981 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 5
Tue 2011-08-09 20:08:38.0982 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 7
Tue 2011-08-09 20:08:38.0983 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 8
Tue 2011-08-09 20:08:38.0984 Monitoring process D:\SongbirdPortable\App\songbird\songbird.exe [5944F9DE4263EA115F7D9C00ACE9E28C]. Type: 6

Tue 2011-08-09 20:15:34.0523 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 3
Tue 2011-08-09 20:15:34.0523 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 4
Tue 2011-08-09 20:15:34.0621 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 8
Tue 2011-08-09 20:15:34.0621 Monitoring process D:\splayer\splayer.exe [E6940D01C334BB433CB00515BA632541]. Type: 6
Tue 2011-08-09 20:16:18.0552 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 3
Tue 2011-08-09 20:16:18.0552 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 4
Tue 2011-08-09 20:16:18.0592 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 8
Tue 2011-08-09 20:16:18.0592 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 6
Tue 2011-08-09 20:16:20.0201 Monitoring process D:\splayer\Updater.exe [E72741C1F8C82670D52741982EE3BAA8]. Type: 2

[PrevxHelp]

The scan log includes debugging information about files that have been seen since the installation. This let's us improve our whitelisting and diagnose issues within WSA. You'll notice the date on the log entries as being from a few days ago, which is why it won't log new entries (as you've removed the files now).

Hope that helps!

[The_ChamP]

The log entries are old i agree but my point is the names of these files appear when i do quick scan even now ... they appear just before wsa connects to webroot database
have uninstalled it as wrdata folder was getting arnd 500 mb
will install again later and report back

[PrevxHelp]

These files are probably still registered within the system somewhere, which is why WSA would try to scan them. I wouldn't be worried as the lookup is very quick - it looks for older files as a precaution.

[vojta]

Hitman Pro and F-Secure, for example, show the same behavior. F-Secure seems to fully scan deleted files, they are still in the hard disk until they are overwritten.

[The_ChamP]

i did wipe the free space in d drive with ccleaner and had again done a scan but it was still showing
anyways have uninstalled and re isntalled wsa as wrdata folder was close to 500 mb
now these items are not showing up in scan