"Scan for Virus" is not complete hard disk scan. Otherwise to standard antivirus disk scan, "Scan for Virus " collects information about all files used during Windows boot-up process.
"Scan for Virus" uses Greatis Application Database to detect which files are useful or dangerous. Unknown files are marked as suspicious. These files may be legitimate or not
1. Click on the "Good or Bad" button. The file will be automatically checked for Microsoft digital sign. Most of Microsoft files are signed.
2. Check the manufacturer of the file. If it is a part of legitimate software, click on the "It's OK" button.
3. Contact the Greatis Support for testing the files. It's very useful for you because the description of the file will be added to the next version of Application Database.
4. Google the file name.
5. If the file is hidden or doesn't exist, probably it's a rootkit. Hidden rootkit files may be deleted only after reboot.
"Scan for viruses" on the working computer is not effective, because the rootkit already hide their files and registry keys.
Scan at reboot activates Partizan boot anti-rootkit technology for monitoring Windows boot process. In addition, Scan at reboot will be activated before Windows shell starts and most of rookits started from the "Active Setup", "Run" registry keys will be visible.
Scan at reboot uses Partizan information for detecting and removing rootkits.
It's normally if you reboot 2-3 times to completely remove a rootkit.
You need understand that if a rookit uses boot driver, Partizan can delete the service key and the file at reboot. But the rookit driver may be already in memory. You need to simply reboot again if you find that the file remains in the Drivers section.