True or untrue?

Someone on another forum posted this about NOD32...

"If you scan your whole PC, the program is INCAPABLE of removing viruses without deleting the file - it does a grand job of removing them via it's resident IMON etc, but it doesn't do so well at removing them when you do a full scan."

Is this right, wrong or just a generalisation.

Thanks.

 

Well it all depends on the type and what threat it finds.
I haven't seen a virus in ages, only worms/trojans/exploits etc.

Anyway, here's an example: https://www.wilderssecurity.com/showpost.php?p=855677&postcount=6
so that's got to be untrue.

Err just saw it was a screenshot of AMON. So here's one from the on-demand scanner.

 

I'm puzzled at this contradiction. "Incapable without deleting"

Uhm...I want a "bad" file deleted. I wouldn't want any other choice.

 

If you trust everything you read on other forums , Ohoooooo!

I have read tons of junk about NOD32 in another AV's forums that you can't even imagine . All they want is to make some people believe NOD32 is bad product which is not true at all .

As Brian's screeshot shows , NOD32 cleans the viruses and deletes the trojans as it should be , so everything is normal .

 

The main this to remember is that most files that contain a threat are either a newly created file that is entirely threat, or has completely replaced a pre-existing file [good or otherwise] and so it is once again only threat.
Mostly there is just nothing to clean except the threat - deleting is better than leaving a whole disk full of zero length files laying around

Cheers

 

I didn't trust it, I was looking for an experts (or near as dammit!) reply so I could reply to the person who wrote this with the facts.

It wasn't an AV forum either, it was a football forum-maybe they should stick to football!

 

Exactly....if it's a bad file..I want it gone, deleted, period. Cleaning leaves a useless junk file, on the rare chance it infected a legitimate local file...I'll replace it with a 100% healthy virgin file from a quick and easy reinstall of the program, or copying the OS file from another machine or CABs

I flat out will not trust the "cleaning" of an infected file no matter what AV product is being used. I make "delete" my only option on all my setups.

 

I want NO file to be deleted, just a warning issued.
AV programs can easily mis-identify a file as a false positive. I do not want ANY such files deleted.

 

I can honestly say that hasn't happened in a few thousand clients over a lot of years of being in IT...regardless of AV brand...never seen an important file that was flagged a FP...only tmp internet files and e-mail attachments which were jokes (not business related like MS Office files) which I'd not give a rats about anyways.

Having the AV kick up a prompt to end users..my cell phone would be ringing off the hook a hundred times a day with clients asking "what do I do?" So my preference is to automate it all.

 

FPs may not happen often, but when they do, if the file is automatically deleted, it can be a big mess to recover.

McAfeee VS 10 did silently delete files and you can go to McAfee forums and find some horror stories.

Things may have improved wit McAfee 2007, see http://forums.mcafeehelp.com/viewtopic.php?t=92391

 

Yeah , may be football would be better for them

 

You only want a cleanup if the file would be good without the bad code - ie, it was infected as a way to hide the virus/trojan...ie - it's a file infector.

maybe Marcos or someone at eset can chime in -but file infectors don't seem like a major percentage of the virus/trojan mix these days.

 

It wouldn't be with NOD though...the only time a file being deleted might cause a mess..is if it's a windows system file. AMON would be the one to pick that up, and it doesn't have an auto-delete. The other modules that allow auto delete are IMON/EMON/DMON. They are avenues into the system...but those files they'd check aren't OS/system files.

Regardless...the advantage of freedom to set as one pleases.

 

DEleting ANY file might cause a problem.
There are apps that run at startup.
There are apps that are intertwined with the OS/file system.

 

When I scanned my PC back in the day with Panda, it deleted around 150 .rar files because they were all created by WinRAR and Panda thought all files were a threat, so it deleted all rar files I had on my PC. 6 months of work lost in 10 minutes (yes I had backups, but sadly not up to date - Can't backup everytime I make a change).

After that, I'll never trust any "intelligent antivirus" ever again. They just aren't smart enough. A warning popup asking me what to do is key when I purchase any AV software. If ESET goes all automatic, then I'll have to look for something else yet again. Hopefully they'll never do that.

 

I've seen other such horror stories.

NAV 2006, and I ASSuME, NAV 2007 allow you to choose the action to be taken.

As I recall, KAV also allows you to specify what is to be done.

If correct, the documentation for McAfee 2007 states that files are no longer automatically deleted, but they are automatically disinfected, if possible, which could still ruin a perfectly good file.

I allow suspect email to be deleted, but I'll NEVER allow disinfecting or deletion without my having a choice to ignore the file.

 

A fully automatic AV is not something you want installed on your PC.
If you are a developer is can bring havoc on your work.

Of course if you never use your PC for important stuff that needs to be saved on a regular basis, then all auto is probably nice enough. I'll never use such AV ever again though.

Oh and before I forget: NOD32 can delete all your work automatically, but it will copy the deleted stuff to the quarantine if configured. That way you'll always have a backup.

 

And as mentioned above, those would be checked my AMON (which..well..look at the options for actions for AMON...there's no auto-delete there..it's a built in safety check).

IMON, EMON, and DMON don't stick their noses in there.

If an OS file got infected...I would have to replace it anyways. I've never..ever..seen an OS file get cleaned and behave properly, nor would I ever trust it. It's been molested by a virus, I'm not walking away and blessing that machine until it's been replaced by a virgin file. I learned too many times years ago..don't trust "cleaned" OS files that've been hit by a virus. The machine is practically guaranteed to act wonky down the road, you'll be called back.