Understanding Antivirus Alerts: What They Mean and What to Do
Antivirus software generates alerts when it detects something suspicious. But not all alerts are equal, and the right response depends on what the alert is actually telling you. Here is how to read them.
Alert Severity Levels
Most security software uses a severity scale. High or Critical severity means the software detected something it is confident is malicious — a known malware signature, a file behaving like ransomware, or a connection to a known command-and-control server. These require immediate action.
Medium severity typically means the software detected something suspicious but not definitively malicious — a program behaving unusually, a file with characteristics common in malware but not conclusively identified. These warrant investigation.
Low severity or informational alerts are often about potentially unwanted programs (PUPs) — software that is not strictly malicious but may be unwanted, like adware or browser toolbars bundled with other software.
What the Alert Is Telling You
A well-designed alert tells you what was detected, where it was found, what behavior triggered the detection, and what action was taken. If your antivirus software quarantined a file automatically, the threat is contained — the file cannot execute. If it is asking you what to do, you need to make a decision.
When to Quarantine vs. Delete
Quarantine isolates the file so it cannot run, but preserves it. This is the right first step for most detections — it neutralizes the threat while giving you the option to restore the file if it turns out to be a false positive.
Delete permanently removes the file. Do this after you have confirmed the detection is accurate and you do not need the file.
False Positives
Antivirus software sometimes flags legitimate files as malicious. This is called a false positive. Signs that an alert might be a false positive include: the file is from a well-known, reputable developer; the detection is low severity; the file was working fine before a recent antivirus update; and other security tools do not flag it.
If you suspect a false positive, check the file on VirusTotal (virustotal.com), which scans it against dozens of antivirus engines. If only one or two engines flag it, it is likely a false positive.
What to Do After a High-Severity Detection
Quarantine or delete the detected file. Run a full system scan to check for additional infections. Review the incident timeline if your software provides one — understand how the file got there and what it did. Change passwords for any accounts you accessed on the affected machine. Check for persistence mechanisms: startup programs, scheduled tasks, and browser extensions.
SentinelForge Security provides Explainable Threat Analysis — every alert includes the reasoning behind the detection so you can make informed decisions. View plans starting at $7.99/mo.