# Why is the file scanned as a non secure file?

**URL:** <https://discuss.elastic.co/t/why-is-the-file-scanned-as-a-non-secure-file/378018>\
**Category:** Elasticsearch\
**Created:** [May 12, 2025, 1:38am UTC](https://discuss.elastic.co/t/why-is-the-file-scanned-as-a-non-secure-file/378018 "2025-05-12T01:38:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![matianyang1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matianyang1203/32/143033_2.png) [@matianyang1203](https://discuss.elastic.co/u/matianyang1203)\
**Post date:** [May 12, 2025, 1:38am UTC](https://discuss.elastic.co/t/why-is-the-file-scanned-as-a-non-secure-file/378018/1 "2025-05-12T01:38:55Z")

</div>

c:/program files/elk/elasticsearch-8.15.0/data/indices/tdnqopoytdeizxdumput4w/0/index/\_dx.cfs, \_7t.cfs, \_6z.cfs. These files are scanned as suspicious Trojan files!

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [May 12, 2025, 9:44am UTC](https://discuss.elastic.co/t/why-is-the-file-scanned-as-a-non-secure-file/378018/2 "2025-05-12T09:44:32Z")

</div>

See the warning in [these docs](https://www.elastic.co/docs/deploy-manage/deploy/self-managed/important-settings-configuration#path-settings):

> - Don’t run virus scanners on the data directory. A virus scanner can prevent Elasticsearch from working correctly and may modify the contents of the data directory. The data directory contains no executables so a virus scan will only find false positives.

---

<div class="post-metadata">

**Author:** ![matianyang1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matianyang1203/32/143033_2.png) [@matianyang1203](https://discuss.elastic.co/u/matianyang1203)\
**Post date:** [May 13, 2025, 1:09am UTC](https://discuss.elastic.co/t/why-is-the-file-scanned-as-a-non-secure-file/378018/3 "2025-05-13T01:09:49Z")

</div>

OK，thank you David！
