True or untrue?

Discussion in 'NOD32 version 2 Forum' started by Joliet Jake, Dec 24, 2006.

Thread Status:
Not open for further replies.
  1. Joliet Jake

    Joliet Jake Registered Member

    Joined:
    Mar 1, 2005
    Posts:
    911
    Location:
    Scotland
    Someone on another forum posted this about NOD32...

    "If you scan your whole PC, the program is INCAPABLE of removing viruses without deleting the file - it does a grand job of removing them via it's resident IMON etc, but it doesn't do so well at removing them when you do a full scan."

    Is this right, wrong or just a generalisation.

    Thanks.
     
  2. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    Well it all depends on the type and what threat it finds.
    I haven't seen a virus in ages, only worms/trojans/exploits etc.

    Anyway, here's an example: https://www.wilderssecurity.com/showpost.php?p=855677&postcount=6
    so that's got to be untrue.

    Err just saw it was a screenshot of AMON. So here's one from the on-demand scanner.
     

    Attached Files:

  3. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    I'm puzzled at this contradiction. "Incapable without deleting"

    Uhm...I want a "bad" file deleted. I wouldn't want any other choice.
     
  4. ASpace

    ASpace Guest


    If you trust everything you read on other forums , Ohoooooo!

    I have read tons of junk about NOD32 in another AV's forums that you can't even imagine . All they want is to make some people believe NOD32 is bad product which is not true at all .

    As Brian's screeshot shows , NOD32 cleans the viruses and deletes the trojans as it should be , so everything is normal . :thumb:
     
  5. NOD32 user

    NOD32 user Registered Member

    Joined:
    Jan 23, 2005
    Posts:
    1,766
    Location:
    Australia
    The main this to remember is that most files that contain a threat are either a newly created file that is entirely threat, or has completely replaced a pre-existing file [good or otherwise] and so it is once again only threat.
    Mostly there is just nothing to clean except the threat - deleting is better than leaving a whole disk full of zero length files laying around :D

    Cheers :)
     
  6. Joliet Jake

    Joliet Jake Registered Member

    Joined:
    Mar 1, 2005
    Posts:
    911
    Location:
    Scotland
    I didn't trust it, I was looking for an experts (or near as dammit!) reply so I could reply to the person who wrote this with the facts.

    It wasn't an AV forum either, it was a football forum-maybe they should stick to football!
     
  7. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    Exactly....if it's a bad file..I want it gone, deleted, period. Cleaning leaves a useless junk file, on the rare chance it infected a legitimate local file...I'll replace it with a 100% healthy virgin file from a quick and easy reinstall of the program, or copying the OS file from another machine or CABs

    I flat out will not trust the "cleaning" of an infected file no matter what AV product is being used. I make "delete" my only option on all my setups.
     
  8. Howard Kaikow

    Howard Kaikow Registered Member

    Joined:
    Apr 10, 2005
    Posts:
    2,802
    I want NO file to be deleted, just a warning issued.
    AV programs can easily mis-identify a file as a false positive. I do not want ANY such files deleted.
     
  9. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    I can honestly say that hasn't happened in a few thousand clients over a lot of years of being in IT...regardless of AV brand...never seen an important file that was flagged a FP...only tmp internet files and e-mail attachments which were jokes (not business related like MS Office files) which I'd not give a rats about anyways.

    Having the AV kick up a prompt to end users..my cell phone would be ringing off the hook a hundred times a day with clients asking "what do I do?" So my preference is to automate it all.
     
  10. Howard Kaikow

    Howard Kaikow Registered Member

    Joined:
    Apr 10, 2005
    Posts:
    2,802
    FPs may not happen often, but when they do, if the file is automatically deleted, it can be a big mess to recover.

    McAfeee VS 10 did silently delete files and you can go to McAfee forums and find some horror stories.

    Things may have improved wit McAfee 2007, see http://forums.mcafeehelp.com/viewtopic.php?t=92391
     
  11. ASpace

    ASpace Guest

    Yeah , may be football would be better for them :D
     
  12. webyourbusiness

    webyourbusiness Registered Member

    Joined:
    Nov 16, 2004
    Posts:
    2,640
    Location:
    Throughout the USA and Canada
    You only want a cleanup if the file would be good without the bad code - ie, it was infected as a way to hide the virus/trojan...ie - it's a file infector.

    maybe Marcos or someone at eset can chime in -but file infectors don't seem like a major percentage of the virus/trojan mix these days.
     
  13. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    It wouldn't be with NOD though...the only time a file being deleted might cause a mess..is if it's a windows system file. AMON would be the one to pick that up, and it doesn't have an auto-delete. The other modules that allow auto delete are IMON/EMON/DMON. They are avenues into the system...but those files they'd check aren't OS/system files.

    Regardless...the advantage of freedom to set as one pleases.
     
  14. Howard Kaikow

    Howard Kaikow Registered Member

    Joined:
    Apr 10, 2005
    Posts:
    2,802
    DEleting ANY file might cause a problem.
    There are apps that run at startup.
    There are apps that are intertwined with the OS/file system.
     
  15. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    When I scanned my PC back in the day with Panda, it deleted around 150 .rar files because they were all created by WinRAR and Panda thought all files were a threat, so it deleted all rar files I had on my PC. 6 months of work lost in 10 minutes (yes I had backups, but sadly not up to date - Can't backup everytime I make a change).

    After that, I'll never trust any "intelligent antivirus" ever again. They just aren't smart enough. A warning popup asking me what to do is key when I purchase any AV software. If ESET goes all automatic, then I'll have to look for something else yet again. Hopefully they'll never do that.
     
  16. Howard Kaikow

    Howard Kaikow Registered Member

    Joined:
    Apr 10, 2005
    Posts:
    2,802
    I've seen other such horror stories.

    NAV 2006, and I ASSuME, NAV 2007 allow you to choose the action to be taken.

    As I recall, KAV also allows you to specify what is to be done.

    If correct, the documentation for McAfee 2007 states that files are no longer automatically deleted, but they are automatically disinfected, if possible, which could still ruin a perfectly good file.

    I allow suspect email to be deleted, but I'll NEVER allow disinfecting or deletion without my having a choice to ignore the file.
     
  17. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    A fully automatic AV is not something you want installed on your PC.
    If you are a developer is can bring havoc on your work.

    Of course if you never use your PC for important stuff that needs to be saved on a regular basis, then all auto is probably nice enough. I'll never use such AV ever again though.

    Oh and before I forget: NOD32 can delete all your work automatically, but it will copy the deleted stuff to the quarantine if configured. That way you'll always have a backup.
     
  18. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    And as mentioned above, those would be checked my AMON (which..well..look at the options for actions for AMON...there's no auto-delete there..it's a built in safety check).

    IMON, EMON, and DMON don't stick their noses in there.

    If an OS file got infected...I would have to replace it anyways. I've never..ever..seen an OS file get cleaned and behave properly, nor would I ever trust it. It's been molested by a virus, I'm not walking away and blessing that machine until it's been replaced by a virgin file. I learned too many times years ago..don't trust "cleaned" OS files that've been hit by a virus. The machine is practically guaranteed to act wonky down the road, you'll be called back.
     
Thread Status:
Not open for further replies.