What Gives?

[Alwill]

Last night (10 March) at approx 10pm (OZ time) which would have been 6am
10 March NY time, I received an NOD update 1.1437 which I dutifully posted (a copy/paste job of NOD Information), in the BBR Security Forum.

Subsequently, there were some queries from other members as to the date of the update which clearly showed Friday 10 March in the internal updater's details viz:

"NOD32 antivirus system information
Virus signature database version: 1.1437 (20060310)
Dated: Friday, 10 March 2006
Virus signature database build: 6896"

About 30 minutes ago I went to the eset website http://www.eset.com/support/info.php and confirmed that this particular update had been released on 10 March:

"NOD32 - 1.1437 (20060310) / posted 12:13)
Virus signature database updates:etc, etc, etc.."

When I returned to the website about 15 minutes later this update had been pulled and no longer appears, with the updates now jumping from1435 to 1438.

Could someone kindly advise just what happened.

[ronjor]

http://www.eset.com/support/info.php has not been updating correctly for a couple of days. Server problems may be part of the reason.

[NOD32 user]

You could try NOD32SSE for signature information -->HERE (http://nod32sse.hotserv.dk/)<-- if you haven't already see in.
fyi site is not maintained by ESET

[Alwill]

Thank you Ron but does the problem also extend to updates actually installed by the internal autoupdater particularly as regards 1436 and 1437 which were pulled from the eset website?


Thanks also NOD32 user; the website you linked is a bit behind the times inasmuch as it is still showing 1436 and 1437 but not the latest update 1438-- as you say it is not an official eset site.

[Marcos]

The update 1.1438 was released just a couple of minutes ago, just the information has not refreshed yet.

[Brian N]

{QUOTE-> Thanks also NOD32 user; the website you linked is a bit behind the times inasmuch as it is still showing 1436 and 1437 but not the latest update 1438-- as you say it is not an official eset site. <-QUOTE}
I need to sleep sometimes you know ;) And so does Pykko btw

[pykko]

:wacko: *puppy* Very sleepy these days. ;D

The trigeminal nerve is too hard.... 16 pages to learn... :gack:
ESET has too many updates these days...can't keep the track on them. :D

[Alwill]

Ah ha! so we now have the perps identified ;)

[mrtwolman]

{QUOTE-> :wacko: *puppy* Very sleepy these days. ;D

The trigeminal nerve is too hard.... 16 pages to learn... :gack:
ESET has too many updates these days...can't keep the track on them. :D <-QUOTE}

Stop kidding. Just you wait for facialis or vagus :) Or the limbic system :) btw, do you know what is tra-tra-ca-ha-sca-lu-tri-pi good for ? ROTFL

[pykko]

the facilais is a piece of cake. ;D The tra-tra-ca-ha-sca-lu-tri-pi scares me. :o

[mrtwolman]

{QUOTE-> the facilais is a piece of cake. ;D The tra-tra-ca-ha-sca-lu-tri-pi scares me. :o <-QUOTE}
trapesium ...... hamatum scaphoides lunatum... piriformis .... just go after ossarum membri superioris liberi and take the distal direction from the humerus, skip ulna and radius and you will hit the mark where to search for....

[pykko]

mrtowlman you really know some anatomy. ;D Do u take private classes to kill your time? :P

[nameless]

{QUOTE-> When I returned to the website about 15 minutes later this update had been pulled and no longer appears, with the updates now jumping from1435 to 1438. Could someone kindly advise just what happened. <-QUOTE}
Maybe update 1437 was pulled because of the problematic signature that was introduced in it:

http://www.wilderssecurity.com/showthread.php?t=123548

[webyourbusiness]

as no-one from eset confirmed this as a false positive, I would doubt that the update was pulled. Even if it was an fp - you can expect a subsequent update to FIX it - updates using signatures are not pulled, they are FIXED with the next update after the fix is known.

[nameless]

It was a false positive. I had a slew of them myself--at least half a dozen. And with the 1438 update--POOF! no more HitHopper detections. Eset is just an extremely secretive, closed-mouth, we-won't-get-back-to-you organization.

It's entirely conceivable for an update to be pulled, depending on their priorities. If enough customers were negatively impacted by FPs, and it overbalanced the criticality of any new, valid malware that was covered in the affected update, it seems totally feasible to me that they'd pull it.

[webyourbusiness]

conceivable and how it works in practice, or even how it has worked in the past from Eset is a TOTALLY different matter. They do not pull updates, they issue a NEW update.

[nameless]

Well, regardless of what they normally do, I doubt either one of us are in a position to know for sure whether they pulled 1437 or not. (I do know that they fixed the FP issue with the 1438 update, and 1437 is conspicuously missing from http://www.eset.com/support/info.php )

[webyourbusiness]

it's not missing here though...

http://www.nod32.sk/sk/podpora/aktualizacia-1-1437-20060310?lng=en

[The Hammer]

{QUOTE-> it's not missing here though...

http://www.nod32.sk/sk/podpora/aktualizacia-1-1437-20060310?lng=en <-QUOTE}Or here. http://www.nod32.ch/en/news/update.php 1.1436 is even included.