Settings and Actions

I am using Blackspear's recommended settings and feel very comfortable doing so.
One setting I am not yet quite clear on is the recommended action in the various modules.

In Amon the recommendation to prohibit access and show warning alert seems clear to me.

In Imon I am wondering why the default clean + quarantine version is preferred to the alert option. What is the risk that something is cleaned by mistake? Do I lose out on security if I keep the alert without automatic cleaning?

In Nod32 basically the same applies.

Thanks - I think Nod is great and this forum is excellent.

 

It's recommend to keep a copy of the infected file because if it's a FP (false alarm) or it's a repairable threat, you can restore it.

 

Personally, I wouldn't quarantine anything detected by IMON but NewHeur_PE viruses. With the growing number of worms, it would easily mess up quarantine and there's almost no chance IMON would report a false positive (well, this might happen very occasionally with the HTTP scanner, but not in the case of worms).

 

Thanks guys but I am still a bit confused.

How often do you actually get worms, trojans or virii?
I have been using NOD for about 2 months now (at max setting) and haven't had a single alert
Mind you, I am not complaining

My underlying question is whether to leave the action setting to "alert" and then decide on a case by case basis whether to clean, abort, delete... Is that not a good procedure and if not, why not?

 

I'd say for your situation try it and see how you go...

Cheers