virus repair

[blindy]

I'm not a student of virology (not to be confused with medical pathology), but when I looked through the site, I noticed this proviso regarding virus protection with Avast:

REPAIRING
Limited capability of direct repair (especially macroviruses)

That concerned me because I just downloaded the program and was wondering if all antivirus programs have limited capability of direct repair or is this something specific to Avast home/Professional?

I do appreciate the company providing this free software for non-commercial use.

[RejZoR]

The direct repairing info goes for viruses (parasitic file infectors) that are either very rare by nature or cannot be repaired at all or very very difficult. This especially applies to latest versions of Virut virus. Large majority of malware is consisted of trojans, worms and backdoors which can be removed quiet easily.

[DavidR]

Trojans generally can't be repaired (either by the VRDB or avast virus cleaner), because the entire content of the file is malware, so it is either move to chest or delete, move to the chest being the best option (first do no harm). When a file is in the chest it can't do any harm and you can investigate the infected warning.

The VRDB only protects certain files, mainly .exe files, it doesn't protect data files or all files, it is not a back-up program, so there are going to be many occasions where repair won't be an option.

Only true virus infection can be repaired (as RejZoR mentioned), e.g. when a virus infects a file it adds a small part to it, provided that file is one that avast's VRDB would monitor and you have run the VRDB, then it may be possible to repair the file to its uninfected state.

However, for the most part so called viruses, trojans (adware/spyware/malware, etc.) can't be repaired because the complete content of the file is malicious.

[falltravlr]

What are the impacts if I delete instead of sending to the chest?

[DavidR]

Obviously the file no longer exists if you delete it, and have zero options left. What if it wasn't a good detection, how are you going to recover from having deleted it, or even how are you going to even check if the detection was good or not if you don't even have the file ?

If you send it to the chest you have other options, such as restoring it if the detection proves not to be good. All anti-viruses suffer from false positives, some more than others so it is always best to 'first do no harm' and just move it to the chest as I said.