NOD32 and Deleting found viruses

[tully]

I've recently started using NOD32 antivirus, switching over from Norton AV
2004. I like it and the fact it seems to do a pretty thourough job and
doesn't tend to slow my computer down as drastically as Norton did. My only
problem with this scanner is the fact it hardley ever gives me the option to
delete, or clean a virus. I'm not sure if that is the way it works or what.
For example I downloaded the Eicar test virus, and let NOD32 find it, just
to get a feel of what it does and how it detects. I am seeing tho when it
finds this virus and alerts me about it I get this disturbing message. ..

eicar_com[1].zip is infected with test file Eicar. NOD32 cannot clean this
infiltration.

Then I have only one option, and that is the Leave button, clean rename
delete and replace are all blacked out. If this is normal could someone let
me know why this is? I'm sure there has to be some explaination behind it.
TIA.

 

[Clive]

I've recently started using NOD32 antivirus, switching over from Norton AV
2004. I like it and the fact it seems to do a pretty thourough job and
doesn't tend to slow my computer down as drastically as Norton did. My only
problem with this scanner is the fact it hardley ever gives me the option to
delete, or clean a virus. I'm not sure if that is the way it works or what.
For example I downloaded the Eicar test virus, and let NOD32 find it, just
to get a feel of what it does and how it detects. I am seeing tho when it
finds this virus and alerts me about it I get this disturbing message. ..

eicar_com[1].zip is infected with test file Eicar. NOD32 cannot clean this
infiltration.

Then I have only one option, and that is the Leave button, clean rename
delete and replace are all blacked out. If this is normal could someone let
me know why this is? I'm sure there has to be some explaination behind it.
TIA.

Noticed the same problem - you very rarely get a satisfactory 'option' to
remove or clean a found virus. See my post earlier on.

I'm now testing AVG 7.0. This is not slowing my system down (the same as
NOD32), but gives more options when/if a virus is found (including the Eicar
test virus).

Clive

 

[Jeffrey A. Setaro]

I've recently started using NOD32 antivirus, switching over from Norton AV
2004. I like it and the fact it seems to do a pretty thourough job and
doesn't tend to slow my computer down as drastically as Norton did. My only
problem with this scanner is the fact it hardley ever gives me the option to
delete, or clean a virus. I'm not sure if that is the way it works or what.
For example I downloaded the Eicar test virus, and let NOD32 find it, just
to get a feel of what it does and how it detects. I am seeing tho when it
finds this virus and alerts me about it I get this disturbing message. ..

eicar_com[1].zip is infected with test file Eicar. NOD32 cannot clean this
infiltration.

Then I have only one option, and that is the Leave button, clean rename
delete and replace are all blacked out. If this is normal could someone let
me know why this is? I'm sure there has to be some explaination behind it.

There is... RTFM.

1) NOD32 like most doesn't clean infected files in .ZIP files. NOD32
could allow the user to delete or rename the .ZIP file but that has it's
own potential pit falls. Suppose there are other important uninfected
files in the .ZIP and a user in classic panicked fashion opts to delete
the .ZIP? Then what?

Malware contained in .ZIP files isn't infectious until it's extracted...
Once it's extracted it can be cleaned (assuming there is a host to
clean), deleted or renamed.

TIA.

Your welcome. HTH.

--
Cheers-

Jeff Setaro
jasetaro <at> mags.net
http://people.mags.net/jasetaro/
PGP Key IDs DH/DSS: 0x5D41429D RSA: 0x599D2A99 New RSA: 0xA19EBD34

 

[Duane Arnold]

I've recently started using NOD32 antivirus, switching over from
Norton AV 2004. I like it and the fact it seems to do a pretty
thourough job and doesn't tend to slow my computer down as drastically
as Norton did. My only problem with this scanner is the fact it
hardley ever gives me the option to delete, or clean a virus. I'm not
sure if that is the way it works or what. For example I downloaded the
Eicar test virus, and let NOD32 find it, just to get a feel of what it
does and how it detects. I am seeing tho when it finds this virus and
alerts me about it I get this disturbing message. ..

eicar_com[1].zip is infected with test file Eicar. NOD32 cannot clean
this infiltration.

NOD32 cannot clean this infiltration. Event occured on file creation.

Is the message I got -- Delete or Rename were the options that were
enabled.

The Rename does nothing and retuns one to the Win Zip screen. The Delete
option deletes the start of the file being created off of the machine.

You cannot extract it. That seems stright forward to me.

Then I have only one option, and that is the Leave button, clean
rename delete and replace are all blacked out. If this is normal
could someone let me know why this is? I'm sure there has to be some
explaination behind it. TIA.

Looks like your on an old version of NOD32.

Duane

 

[tully]

There is... RTFM.

1) NOD32 like most doesn't clean infected files in .ZIP files. NOD32
could allow the user to delete or rename the .ZIP file but that has
it's own potential pit falls. Suppose there are other important
uninfected files in the .ZIP and a user in classic panicked fashion
opts to delete the .ZIP? Then what?

Malware contained in .ZIP files isn't infectious until it's
extracted... Once it's extracted it can be cleaned (assuming there is
a host to clean), deleted or renamed.


Your welcome. HTH.

This does help tremendously, guess I should have looked a little harder than
I did for the answer, makes perfect sense now that I think about. Thanks
again.

 

[tully]

I've recently started using NOD32 antivirus, switching over from
Norton AV 2004. I like it and the fact it seems to do a pretty
thourough job and doesn't tend to slow my computer down as
drastically as Norton did. My only problem with this scanner is the
fact it hardley ever gives me the option to delete, or clean a
virus. I'm not sure if that is the way it works or what. For
example I downloaded the Eicar test virus, and let NOD32 find it,
just to get a feel of what it does and how it detects. I am seeing
tho when it finds this virus and alerts me about it I get this
disturbing message. ..

eicar_com[1].zip is infected with test file Eicar. NOD32 cannot clean
this infiltration.

NOD32 cannot clean this infiltration. Event occured on file creation.

Is the message I got -- Delete or Rename were the options that were
enabled.

The Rename does nothing and retuns one to the Win Zip screen. The
Delete option deletes the start of the file being created off of the
machine.

You cannot extract it. That seems stright forward to me.

Then I have only one option, and that is the Leave button, clean
rename delete and replace are all blacked out. If this is normal
could someone let me know why this is? I'm sure there has to be some
explaination behind it. TIA.

Looks like your on an old version of NOD32.

Duane

Yes I didn't even try to extract it, when I did it caught it and let me
delete it, thanks for your input.