E9) Some people say that disinfecting files is a bad idea.  Is that
    true?

Disinfecting a file is completely "safe" only if the disinfecting
process restores the non-infected state of the object completely.  That
is, not only the virus must be removed from the file, but the original
length of the file must be restored exactly, as well as its time and
date of last modification, all fields in the header, etc.  Sometimes
it is necessary to be sure that the file is placed on the same
clusters of the disk that it occupied prior to infection.  If this is
not done, then a program which uses some kind of self-checking or
copy protection may stop functioning properly, if at all.

None of the currently available disinfecting programs do all this.
For instance, because of the bugs that exist in many viruses, some of
the information of the original file is destroyed and cannot be
recovered. Other times, it is even impossible to detect that this
information has been destroyed and to warn the user.  Furthermore,
some viruses corrupt information very slightly and in a random way
(Nomenklatura, Phoenix), so that it is not even possible to tell which
files have been corrupted.

Therefore, it is usually better to replace the infected objects with
clean backups, provided you are certain that your backups are
uninfected (see D10).  You should try to disinfect files only if they
contain some valuable data that cannot be restored from backups or
compiled from their original source.


.