Cleanup... not an easy question, I must say.
Well, the only 100% reliable method working in 100% of cases is restoring the files from backup. That's the fact... and I dare say this was avast! philosophy for most of the time.
When avast! Virus Cleaner was created, it has changed a little... but still the main priority is the detection, not cleaning. If the user never gets infected, it's not necessary to clean the virus. Therefore, I find the idea of not including the unable-to-clean viruses into the database VERY bad - the antivirus protection is not just about cleaning, it should prevent the virus from entering the computer at first! (which it won't, if the samples aren't in database - and it doesn't matter that the scanner is on-demand only; you use it to scan the file before you start it, don't you?). Buf of course, it's a matter of opinion.
As for the cleaning methods: avast! Virus Cleaner is capable of cleaning some file infectors (inluding Parite). I don't know if you'd call the method "generic", I'd rather call it "virus specific", but I think it's the usual method. The program simply has a special piece of code for every virus; this code "reverses" the changes done by the virus (which may not be very trivial; the virus may protect the original data by various scrambling methods).
One of the disadvantages of this method is that in general, it won't guarantee that the repaired file is exactly the same as the original. The viruses often overwrite some "unimportant" part of the infected file - and this information is simply lost. The cleaning program, not having the original information, is unable to turn the file back to its original state. Sure, the lost info is usually not important (maybe just some kind of timestamp), so the file is "successfully" repaired and it works... in 99.9% of the cases. But it's important to realize that it's not 100%. Some programs may behave strangely after infected and repaired (such as Notepad after Elkern infection; you won't notice until you start 2 instances of it... because the section properties were changed to "shared"). Or, you may have a copy-protected program that checks the checksum of its own executable... and will trigger some kind of anti-pirate protection measures if you run the repaired exacutable.
That's why such kind of healing is questionable... strange problems may appear later as a consequence. Restoring the files / system from backup is certainly time consuming, but avoids such kind of troubles.
VRDB is certainly nice... but it's got also limitations. First, the information about the original files has to be stored in the database, i.e. installing the antivirus on a computer that's already infected won't be very helpful. Second, VRDB stores "important" parts of the executables. While it may have been very successful in DOS times, Windows executables have much more potential virus targets. So, there certainly are viruses whose infection VRDB won't be able to fix, because the target file part is not stored in the database. Of course, it's possible to store some more info in VRDB... but it's simple not possible to store everything - that would require duplicate all the executable files on your disk, and I guess you don't want VRDB to occupy gigabytes.
As I said, I'll try to improve the VRDB for the future release (store more information without increasing the size much). I have already started, but I'm not sure if it will be finished soon enough to make it to avast! 4.5; well, if not, it will simply be included in the following update. I believe it will be much better, but don't expect miracles
As for the Cleaner included in avast!, the connection is currently very simple. When a Cleaner-supported virus is found, avast! offers you to "Remove the virus completely from the system". If you select this choice, the usual Cleaner window pops up and starts its scan. That's it - there's no connection to the "Repair" button (yet). You may find it strange, but it's the safest method. avast! Virus Cleaner tries to remove all the possible traces of the worm/virus from the system - and to do that, it simply has to scan the whole system: memory, drives, registry. Passing it a single filename, detected by avast!, is often not an option. I will try to extend the interface somehow (such that the Cleaner
is used when you press the "Repair" button), but it will probably be limited somehow.
