I am using Blackspear's recommended settings and feel very comfortable doing so. One setting I am not yet quite clear on is the recommended action in the various modules. In Amon the recommendation to prohibit access and show warning alert seems clear to me. In Imon I am wondering why the default clean + quarantine version is preferred to the alert option. What is the risk that something is cleaned by mistake? Do I lose out on security if I keep the alert without automatic cleaning? In Nod32 basically the same applies. Thanks - I think Nod is great and this forum is excellent.