Hi wuji

 

Welcome to the Community Forums.

 

I have not seen or heard of this happening before...and the only thing that I can presume is that WSA had removed some threats and quatantined the components, then on a subsequant scan an update totnhe Cloud determined that one of the threats was in fact a false postive and therefore WSA reinstated what it had previously quarantined.

 

Quarantined items are always included in scans, by default, for just this reason given that the information on threats/non threats is constantly being updated in the Webroot Cloud, and so a previous determination may end up being changed.

 

That is all I can think of in relation to the way that WSA works, and what you have described. If still peturbed by this then you can Open a Support Ticket and ask the question of the Support Team. If you do please let us know what they say. ;)

 

Regards, Baldrick

---