Intermittent disabling of IMON by PestPatrol

[billaku]

{QUOTE-> PestPatrol sounds good!
So, will probably try ... myself this evening... <-QUOTE}Ok - downloaded and installed:


eTrust PestPatrol Versions Report
This report was generated on: 12/13/2005-9:12:01 PM

eTrust PestPatrol Version: 5. 0. 1. 6 (eTrust EZ Licensing)

SDK Version: 5.6.7.9
PPFILE.DAT Version: 12/13/2005-5:29:18 PM
PPINFO.DAT Version: 12/13/2005-5:29:18 PM
PPLOC.DAT Version: 12/13/2005-5:29:18 PM


First tried setting a delay and IMON did not stay active after every reboot - the few times I tried - could work 100% - but decided to try the PP exclusion method.



Made these PestPatrol settings:


[v] Start Active Protection when my computer starts


Exclusions

Add File/Folder

C:\WINDOWS\system32\imon.dll -- where imon.dll is on my system

[v] C:\WINDOWS\system32\imon.dll -- clicked in the box to check


Save Report

Close



On my WinXP SP2, rebooted 3 times and IMON remained active after each.


Probably feel more confident after 21, 31 reboots.

Right now, PestPatrol ActiveProtection icon shows in SysTray ~ 4 sec. before the NOD32 icon.
Don't know how accurate the icons SysTray appearance is as far as actual load sequence, timing.
Anyway - I have no delay set.


edit: For '?' in title due to mata7's following post.
- - - - Uninstalled PP - will reinstall this evening and see if can use due to licensing requirement - cancelled, 'terminated' license - - - - if then can, will try the PP udpdate and see what happens here.

[mata7]

i fallow you guide and now IMON Don't get Disabled, but if you update PPatrol IMON Just stop working "at least for me" IMON Will stay on the last scan task "let say scan google.com" and then i wont scan nothing more, i have to stooped the reactivate again

please check if this happen to you

btw Thanks nice guide

this is what i mean after i update PPatrol imon stay like this and dont scan any more site

http://img.photobucket.com/albums/v330/MATA7/1.jpg

[billaku]

{QUOTE-> ...

this is what i mean after i update PPatrol imon stay like this and dont scan any more site

http://img.photobucket.com/albums/v330/MATA7/1.jpg <-QUOTE}PP reinstalled.

During install, PP updates all its updateable files, so files currently up-to-date.

What I get in IMON when check for PP updates:
/eTrustPPStd/updates/ezlic/en/ppmaster.dat


Your graphic shows:
/eTrustPPStd/updates/ezlic/en/cavres.dll

I don't have cavres.dll on my computer.

Looks like it is a eTrust EZ Antivirus file:
http://www.911cd.net/forums/index.php?showtopic=9715
http://www.tomcoyote.org/forums/lofiversion/index.php/t46468.html
http://www.techsupportforum.com/resolved-hjt-threads/62657-trouble-accessing-internet-help.html


What you stated:
Were some files updated?
Or checked for updates and all files up-to-date?

Would PestPatrol update eTrust EZ Antivirus cavres.dll?
Is that why /eTrustPPStd/updates/ezlic/en/cavres.dll is showing in the graphic?


When I check for updates and get
'eTrust PestPatrol is up-to-date' in PestPatrol
and
/eTrustPPStd/updates/ezlic/en/ppmaster.dat in IMON
IMON stays active.

If I go to this forum, it shows:
http://www.wilderssecurity.com/favicon.ico
Then if I go to this thread it shows:
http://www.wilderssecurity.com/showthread.php
and the scanned file count in IMON keeps increasing.


So, right now:

1. Wondering about cavres.dll
Guess you have eTrust EZ Antivirus?
Or cavres.dll still on sys from an install.

Wonder what would happen if you would also exclude cavres.dll in PP?

2. Will have to wait until there is a PP update for my PP files to see if IMON stays active after such an update.


On my sys:
imon.dll still excluded in PP. IMON still stays active after reboots with
[v] Start Active Protection when my computer starts (checked in PP Active Protection settings)

[billaku]

{QUOTE-> So, right now:

1. Wondering about cavres.dll
Guess you have eTrust EZ Antivirus?
Or cavres.dll still on sys from an install.

Wonder what would happen if you would also exclude cavres.dll in PP?

2. Will have to wait until there is a PP update for my PP files to see if IMON stays active after such an update.


On my sys:
imon.dll still excluded in PP. IMON still stays active after reboots with
[v] Start Active Protection when my computer starts (checked in PP Active Protection settings) <-QUOTE}Got a PestPatrol update: ppclean.exe, etc.

Entry in IMON immediately after: /PPSDK/Components/ppsrindex.dat

IMON stayed active.


Did note yesterday though, IMON not active *every* time after reboot.

IMON active today after computer on, through the update.


Wonder if Eset could consult with ComputerAssociates on the intermittent disabling of IMON by PestPatrol even with imon.dll excluded in PestPatrol?


Upon some reboots, IMON disabled. Now experiencing this from time to time.
Also so far, once re-enable IMON, it stays enabled after additional reboots.

So far, seems like it is enabled when computer first turned on.
So far, seems to happen once after ~ first computer reboot.
Then, after re-enable again, stays enabled until ~ first computer reboot, program install, similar.
Seems like what is going on, sequences.

[Blackspear]

Hi billaku, as your new thread was a basic continuation of this thread I have merged the 2 together.

Cheers

Blackspear.

[billaku]

{QUOTE-> Hi billaku, as your new thread was a basic continuation of this thread I have merged the 2 together.

Cheers

Blackspear. <-QUOTE}PM sent requesting change in title of this thread to:
Intermittent disabling of IMON by PestPatrol

- as it now turns out that is what is happening even with imon.dll excluded in PestPatrol - for me upon computer startup or reboot.

[Blackspear]

{QUOTE-> PM sent requesting change in title of this thread to:
Intermittent disabling of IMON by PestPatrol

- as it now turns out that is what is happening even with imon.dll excluded in PestPatrol - for me upon computer startup or reboot. <-QUOTE}Thread title changed.

I have asked for someone from Eset to take a look at this thread.

Cheers ;D

[billaku]

{QUOTE-> Got a PestPatrol update: ppclean.exe, etc.

Entry in IMON immediately after: /PPSDK/Components/ppsrindex.dat

IMON stayed active. <-QUOTE}PestPatrol updates again today.

After PP updates, IMON remained, still enabled.


So, 2 out of 2 PP updates did not dis-enable IMON.


Also, when turned on computer, IMON enbabled.
After PP update, rebooted once, IMON still enabled.
So?
HELP CA! (Computer Associates) - to keep IMON enabled - PP not interfere with IMON.

[mata7]

nice to see that work for you, i got no luck and i only use one AV nod32 And i got same version of PPatrol that u got

[billaku]

{QUOTE-> nice to see that work for you, i got no luck and i only use one AV nod32 And i got same version of PPatrol that u got <-QUOTE}Well, I still get IMON disabled from time-to-time when computer starts up, reboots.

Do not see that NOD32 has option to start Minimized, not start Minimized.

Would be nice if had option to startup with NOD32 'Not Minimized'.

Then would see if IMON active or not, not have to remember to check - until ESET can clearup with ComputerAssociates, hopefullly.

[pykko]

Well...my oppinion is that is useless to have PestPatrol together with NOD32... NOD has a good protection against all kind of other malwares (dialers, adwares, spywares, etc) :)

[billaku]

{QUOTE-> Well...my oppinion is that is useless to have PestPatrol together with NOD32... NOD has a good protection against all kind of other malwares (dialers, adwares, spywares, etc) :) <-QUOTE}NOD32 may have "... good protection against all kind of other malwares (dialers, adwares, spywares, etc)", but not total:

PestPatrol detected 'CWS.LoadAdv.400' a few times before finally, evidentally cleaned from system for now.
This is supposedly a 'Hijacker'.

NOD32 didn't indicate anything re 'CWS.LoadAdv.400' in same time frame.

Same re 'MidAddle'. PestPatrol yes, NOD32 no: 'Adware'.

I continually check that IMON and NOD32 other protections enabled - for now - 'til maybe 'issue' is resolved.

[mata7]

but How this can be resolved if no1 from Eset is paying attention to this problem, i mean look how many day this thread have and no1 cares, i don't like that :(

[billaku]

{QUOTE-> but How this can be resolved if no1 from Eset is paying attention to this problem, i mean look how many day this thread have and no1 cares, i don't like that :( <-QUOTE}Hi mata7,

I really think it is more a CA, ComputerAssociates, issue: PestPatrol interfering with NOD32 - no?

*If* something like that is the case, that would involve Eset getting with big ol CA and request they address - again, no?

In either case, imagine would take a bit of time.
Would be nice to get updates from time to time - even if 'working on it', 'still working on it'.

Have not heard if 'working on it', though - your point.

-- Bill

[Bandicoot]

This is an issue of a CA product disabling security related software. This is not something that "reasonably well designed" security software should be doing. The entire point of installing security software is to enhance security, not to reduce it. Currently no anti-spyware/anti-adware products detect all threats; there are some threats that some products miss and
others detect. If you check http://www.westcoastlabs.org/cm-av-list.asp?Cat_ID=8 you will find that CA
has not even achieved Checkmark Certification for spyware detection... but NOD32 has.

Our developers are looking into how to prevent this behavior from happening, but as with all malicious software, if a user chooses to install it then it is possible to defeat most any protective measures.

The recommended solution is to demand that CA either fix the problem or refund your money for the product. There are free solutions that do a better
job of augmenting protection instead of decreasing it: The MS anti-spyware beta, LavaSoft Adaware, and Spybot S & D are all viable replacements for a product that offers a net decrease in security. I would fairly miffed with CA, to say the least, if they did this to my computer.

Bandicoot.

[pykko]

You're absolutely right Bandicot! I never liked PestPatrol.....giving a lot of false alarms and not so easy to use and configure.

[halcyon]

What's the 411 on this? I'm still getting Imon disabled by PP update and PP update not working ("update cancelled due to user action or error!").

[RAV]

I don't like PP either, but it sure looks like CA's PP is checkmark certified to me. I use Ewido free instead of PP, certification or not.

http://www.westcoastlabs.org/cm-av-products.asp?Comp_ID=8&Cat_ID=8

[NOD32 user]

{QUOTE-> I don't like PP either, but it sure looks like CA's PP is checkmark certified to me. I use Ewido free instead of PP, certification or not.

http://www.westcoastlabs.org/cm-av-products.asp?Comp_ID=8&Cat_ID=8 <-QUOTE}As you can see clearly above, Bandicoot made his post on the 24th of December 2005. So far as it is possible for me to tell, the earliest checkmark certification for CA PP was not until late January 2006.

I have never use CA's PP and so have no objective opinion of it to offer but would say that for as long as the things Bandicoot based his comments on remain true, I will agree with him as to his suggested recourse.

And I do like NOD32 ;D

Cheers :)