What is Auto Cleanup

Hello Jason,

to quote from Version 9.7 (and lower) Anti-Virus and HIPS settings: guide to on-access settings: Obviously, you may want to set this to automatically clean up any malware that is found, but we've left it to you to decide [...] When the on-access scanner automatically cleans up items that contain a virus or spyware, it will delete any items that are purely malware and it will try to disinfect any items that have been infected. These disinfected files should be considered permanently damaged, as the virus scanner cannot know what the file contained before it was damaged: it can only clean out the code that was injected by the virus.

This has been reformulated in Recommended on-access scanning settings for 10.x: In Endpoint 10 the setting 'Automatically clean up items that contain a virus/spyware' for on-access scanning is enabled by default.  Having this option enabled means there is less administrative work in dealing with malware reported to the console [...]

I've found it to be quite safe as the few false positives were all generic detections for which no automatic cleanup will be attempted. Please note that there's also the If you do not use automatic cleanup, or if automatic cleanup is not possible setting which affects the final outcome. This should be left Deny access only.

There's an extra set of options if you also scan for suspicious files as they are never cleaned up automatically.

Christian

Hello Jason,

to quote from Version 9.7 (and lower) Anti-Virus and HIPS settings: guide to on-access settings: Obviously, you may want to set this to automatically clean up any malware that is found, but we've left it to you to decide [...] When the on-access scanner automatically cleans up items that contain a virus or spyware, it will delete any items that are purely malware and it will try to disinfect any items that have been infected. These disinfected files should be considered permanently damaged, as the virus scanner cannot know what the file contained before it was damaged: it can only clean out the code that was injected by the virus.

This has been reformulated in Recommended on-access scanning settings for 10.x: In Endpoint 10 the setting 'Automatically clean up items that contain a virus/spyware' for on-access scanning is enabled by default.  Having this option enabled means there is less administrative work in dealing with malware reported to the console [...]

I've found it to be quite safe as the few false positives were all generic detections for which no automatic cleanup will be attempted. Please note that there's also the If you do not use automatic cleanup, or if automatic cleanup is not possible setting which affects the final outcome. This should be left Deny access only.

There's an extra set of options if you also scan for suspicious files as they are never cleaned up automatically.

Christian