NOD32 Recommended Settings/AH

Hi!

I just did a deep scan and found a .jar with multiple infections, so I thought maybe the default settings aren't good enough. So I came on here to ask "Should I turn on Advanced Heuristics?"

In fact I have a follow up questions as AH can lead to false positives does NOD32 say, "blah found by AH but not H" so that you can decide how to treat the message?

Should I apply the settings from the "Extra settings for Nod32" thread?

Thanks,
Fairy

 

Yes.

Trev.
____________________
Useful Links:
Anti-virus:
NOD32 Anti-virus ... Avast Anti-virus (Free) ... AVG Anti-virus (Free) ... Housecall (Online Scan)
Firewall:
LooknStop Firewall ... Sygate Personal Firewall (Free)
Anti-trojan:
TDS-3 ... Trojan Hunter ... A² (Personal & Free) ... BOClean
Anti-Spyware:
AdAware SE ... Spybot S&D 1.3 ... HijackThis! ... SpywareBlaster ... DialerWatcher
Misc:
System Safety Monitor ... Proxomitron ... Firefox ... SysMetrix ... Rainlender

 

Since AMON, the on-access scanner, does not scan within archives in real time, it wasn't intercepted before. On the other hand, if it came from the Internet, IMON would have blocked it because it scans within archives. At any rate, unless files are in archives, they are not dangerous.

 

I am a Nod32 Reseller and have been for quite some time now (over 2 ½ years). We always tweak Nod32 to the absolute maximum for every customer.

I am yet to see a false positive with Nod32 using Advanced Heuristics, though it will occur at some time during the future due to the nature of AH's. A new virus detected by AH will be seen as a “Probable NewHeur_PE virus found”, and in such a case we advise to do the following:

1. Place a tick in the Quarantine check-box.

2. Select Delete.

3. Send the Quarantined file to Eset: samples@nod32.com This file can be found here:

C drive

Program files.

Eset.

Infected.


Hope this helps...

Cheers

 

thanks to you all

 

that .jar infection sounds like byteverify.exploit.. here is a related thread from another forum..

http://www.dslreports.com/forum/remark,12057018~mode=flat