Event Id: 1053 Event Description: Infected file found.

[User16096767]

We have been getting this alert from a legitimate file. The file also excluded. Action taken shows Allow. Obviously not getting deleted, but its a noise that our SOC team shouldn't be worried about.

Do we know why we are getting this alert?

OS Type - Linux 

ENSL 10.2.2.1320

ENSL 

[Former Member · Accepted solution]

in case anyone else runs across this issue, here is the reason it is happening.

first this is an issue with ensl 10.2.2 only and has been fixed in ensl 10.2.3 and later builds.

the event is generated when the ensl service is stopped/restarted and there are files left in the scan queue.  when ensl was clearing out the queue it incorrectly set a flag on the file which caused the virus alert to get generated.  no actual scan or action is taken on the file when this occurs and is purely a cosmetic issue.  

to fix the issue upgrade ensl to the latest version which is currently 10.6.4.

[User16096767]

Your solution is correct. Since we started upgrading to the latest version, the issue seems to go away.