Hi Pete

 

If WSA put them into 'Monitored' status (as it could not determine if they are good or bad) then it will move them from that status to either Blocked (as bad), and will initiate reversal of any actions performed whilst monitired or Allow (as good) as soon as its determination in the Cloud has been completed.

 

The use can also move an automatically monitored file/app at any time if they believe that the file is good or bad in which case the journal files associated with the monitoring are not removed (I believe) or a user can set a file/app to monitor if they are suspicious of its intentions (same outome re. the journal files produced, as prevoius stated).

 

EDIT: Before you ask what happens to the journal files they remain in the WRData folder and can, with time, build up to take a good deal of disk space.  There is a manual way of understanding what each Dbnnnnn.db file relates to and then deciding if you want to delete it...if you are interested in that please let me know and I can PM you the details...but it is an area left well alone, plus another way of getting rid of the Dbnnnnn.db fiels is to uninstall/reinstall...but that would lose you the same for any validly currently/monitored file/app as well...so again, best left well alone.

 

Hope that helps?

 

Regards, Baldrick

---