NOD32 2.7 and Vista - Anti Stealth Technology

[Kielty]

I have v 2.7 installed on my vista 32 bit machine and noticed that when scanning files it states that the anti stealth technology is operating in limited mode and requires admin priveleges. I do have admin privileges why is this?

[Marcos]

If you have User Account Control enabled, you'll need to escalate rights when running the on-demand scanner unless you are logged in as a domain administrator.

[Kielty]

Sorry, i don't understand. I have user accounts enabled and my account is showing as administrator. Do i need to do something else?

[mata7]

i have the same problem, and i logged as adminstrator and also i have oder errors

http://img.photobucket.com/albums/v330/MATA7/nod45.png

[Marcos]

Does turning off User Account Control make a difference?

[Marco_CH]

this error has been discussed already on this board and there is still no solution to that? i got the same problem. running on admin account too.

[Kielty]

Yes, disabling UAC solves the issue. Will there be a fix for this?

[Badgerman]

I only get this error when I run NOD32 from the context menu. If I do a regular scan I don't get the error.

[CJsDad]

I dont think the UAC has anything to do with it and I am using this PC as an administrator.
I've had the UAC turned off since I started using Vista and just to be sure I went and turned it back on, rebooted my computer and ran a scan with NOD32, no message about not having administrator privileges.
The only program effected on my PC with the UAC turned on is BOClean, it won't update, the computer cant find the updater file.

[trjam]

Mine works fine with Admin rights.

[Kielty]

very strange, with UAC enabled and scanning selected files via the context menu the error message appears and disappears with UAC disabled.

This occurs ONLY when scanning from the context menu not on a scheduled scan or running an in depth analysis.

[mata7]

mine 2, scanning selected files via the context menu i got the error, but if i run a regular scan like deep scan no problem and no MBR Error also

i think the problem is nod and have nothing to do wiht UAC, Cause if the problem is UAC then i will wet the error on any tipe of scan

[marty56]

Same problem.. Using Vista 32bit Business. Only 1 login account which has admin privledges

I dont think disable UAC is a good idea.

There other other programs that have the same type of problem.

This should not be this hard.

I have tried so many AV progarms and NOD32 was this close to being THE program for Vista.

Still its on my short list.

Thank God for trial software and Acronis disk image software

Also you guys need to lose the image verification step in registration. Old guys like me cant read some of those characters.

[jmc777]

Any news on this?

[agoretsky]

Hello,

Although you may be logged in as an administrator, not all programs you execute are going to run with the same rights--as part of Microsoft's least privilege model, applications under Microsoft Windows Vista which are launched from the desktop (a/k/a Windows Explorer, filename: EXPLORER.EXE) run with a lower-privilege token. See Windows Vista User Account Control Step by Step Guide (http://technet2.microsoft.com/WindowsVista/en/library/0d75f774-8514-4c9e-ac08-4c21f5c6c2d91033.mspx?mfr=true) on Microsoft's web site for more information about how this works.

If you right-click on the ESET NOD32 On-Demand Scan icon and select "Run as Administrator" from the context menu, you should now be able to elevate the privilege of the NOD32 on-demand scanner and perform a scan of your disk volumes.

Regards,

Aryeh Goretsky

[gamersmile]

Altough I'm using an XP-SP2 based PC in the company, due to token restrictions set by the MIS manager, I used to see the same prompt msg before.

Yes, I think select "run as administrator" in the context menu would solve the problem.

Cheers :-)

[mata7]

{QUOTE-> Hello,

Although you may be logged in as an administrator, not all programs you execute are going to run with the same rights--as part of Microsoft's least privilege model, applications under Microsoft Windows Vista which are launched from the desktop (a/k/a Windows Explorer, filename: EXPLORER.EXE) run with a lower-privilege token. See Windows Vista User Account Control Step by Step Guide (http://technet2.microsoft.com/WindowsVista/en/library/0d75f774-8514-4c9e-ac08-4c21f5c6c2d91033.mspx?mfr=true) on Microsoft's web site for more information about how this works.

If you right-click on the ESET NOD32 On-Demand Scan icon and select "Run as Administrator" from the context menu, you should now be able to elevate the privilege of the NOD32 on-demand scanner and perform a scan of your disk volumes.

Regards,

Aryeh Goretsky <-QUOTE}

where is the nod32 NOD32 On-Demand Scan icon i cant fiend it

thanks

[Kielty]

{QUOTE-> Hello,

If you right-click on the ESET NOD32 On-Demand Scan icon and select "Run as Administrator" from the context menu, you should now be able to elevate the privilege of the NOD32 on-demand scanner and perform a scan of your disk volumes.

Aryeh Goretsky <-QUOTE}


Not sure what you mean, where is the On Demand Scan Icon?

Can you give me an 'idiots guide' to how this is done?

[agoretsky]

Hello,

Do you have an icon on your desktop named NOD32? If so, what happens if you hold down the Shift key and then right-click on it?

Regards,

Aryeh Goretsky

[Kielty]

No icon on the desktop but i can create one..

[sam101200]

YES, disabling UAC will allow the context menu item to work. And NO, there is NO "ESET NOD32 On-Demand Scan icon" for you to right click and run as administrator. I wish people would just go try it out themselves first before making wild guesses just to prove how knowledgeable they are. Don't post if you don't know what you are talking about and mislead people. This is a bug in Nod32 under Vista with no fix yet, simple as that.

[pain4gain]

{QUOTE-> YES, disabling UAC will allow the context menu item to work. And NO, there is NO "ESET NOD32 On-Demand Scan icon" for you to right click and run as administrator. I wish people would just go try it out themselves first before making wild guesses just to prove how knowledgeable they are. Don't post if you don't know what you are talking about and mislead people. This is a bug in Nod32 under Vista with no fix yet, simple as that. <-QUOTE}

That's a little childish. Why chastise someone who is trying to help? Anyways, I believe he was referring to this.

http://i175.photobucket.com/albums/w121/nod32usa/nodicon-1.jpg?t=1171769675

[Blackspear]

Ladies and Gentlemen back to the topic at hand please, let's leave the personal banter out of this.

Blackspear.

[NadaWTB]

{QUOTE-> Hello,

Although you may be logged in as an administrator, not all programs you execute are going to run with the same rights--as part of Microsoft's least privilege model, applications under Microsoft Windows Vista which are launched from the desktop (a/k/a Windows Explorer, filename: EXPLORER.EXE) run with a lower-privilege token. See Windows Vista User Account Control Step by Step Guide (http://technet2.microsoft.com/WindowsVista/en/library/0d75f774-8514-4c9e-ac08-4c21f5c6c2d91033.mspx?mfr=true) on Microsoft's web site for more information about how this works.

If you right-click on the ESET NOD32 On-Demand Scan icon and select "Run as Administrator" from the context menu, you should now be able to elevate the privilege of the NOD32 on-demand scanner and perform a scan of your disk volumes.

Regards,

Aryeh Goretsky <-QUOTE}


You may be misunderstanding us, we are not talking about scanning the disks, we are talking about when you want to scan a single file using the right click on the file and starting the scan via the context menu. I have tried giving the desktop icon admin rights thru properties and compatability and check the box that says "run as administrtor, but when I try to run NOD32 I get and error "can not execute nod32.exe, I get the same error if I do that with the nod32.exe file in the Eset install folder.

[NadaWTB]

Ok, I disabled the UAC and the error goes away, however disabling a major security feature in Vista to accomplish this is unwise IMHO. If we have to disable the security features in Vista to run programs, then all we end up with is an expensive version of XP with more eye candy. I hope NOD32 can find a better solution than this.

[Marco_CH]

any news on that? As long as this isnt resolved NOD32 is by far not vista compatible - at least only in a limited mode

[fredra]

{QUOTE-> any news on that? As long as this isnt resolved NOD32 is by far not vista compatible - at least only in a limited mode <-QUOTE}
Hi Marco
To my understanding, the install on XP appears to be different from the install on Vista.
http://www.eset.com/download/manuals.php
If you have a look at the install manual, it seem to suggest that you use "expert" or "advanced" when doing the install on Vista to get the functionality of the context menu to work (reference page 24) by giving it administrator permissions.
As far as I know (no flaming please), you can't do a shortcut and properties, advenced to run as administrator, it will not work as intended.
IMHO you need to "uninstall" NOD, then "re-install" (using expert or advanced), then everything should work as in XP.
When posters refer to the "icon" that you need to change the properties, I think they are reffering to an install under expert/advanced which places the icon on your desktop (refer to page 24 in the above manual)
P.S. If you change the compatibility mode, to XP, I don't think it will work either.
Cheers :)

[grnemo]

Doesn't help unfortunately...just did it! Where does the command for the integrated scan command resides? At registry? What can we do to give full access to nod32?

I opened a thread for this matter some hours earlier. Mods you can merge it with this if you agree.

Thx, cheers!

[fredra]

Hi
Have you managed to follow the instructions on page 24(in the manual), then you can right click the icon on your desktop and choose "run as administrator"?
In message #10 (in this thread) the OP "TRJAM" seems to have it working, so maybe he can return and tell you how he got it to work.
P.S. I am not using NOD at the moment, but I will be re-installing NOD in a few days.
Cheers :)

[Marco_CH]

thanks for the help :-)

this is no flame but as long as NOD is that complicated in getting to work ill switch to the freeware avira which will release on april 10th the new vista compatible scanner which has rootkit detection stuff included. seems to be a very interesting program.

its a pity tho because i still have a valid nod license - i think it will end in august or september. i hope eset releases soon a 100% compatible version where i dont have to do complicated installation settings.

[Bubba]

Let'a take any other product discussion to a more appropriate forum Please.

Also....since a posts contents were edited out by a member....the resulting post by another member was left mute. Both have therefore been removed.

Thanks,
Bubba

[grnemo]

I have sent a report at ESET. They are trying to reproduce the error as they said....

[fredra]

{QUOTE-> Let'a take any other product discussion to a more appropriate forum Please.

Also....since a posts contents were edited out by a member....the resulting post by another member was left mute. Both have therefore been removed.

Thanks,
Bubba <-QUOTE}

I am not trying to go against the TOS.
Has this anommaly been rectified or addressed? (I know, someone from ESET mentioned to turn off UAC)
I am not in acceptance of turning off UAC, hence my bringing up the issue again.
Thanks
Cheers :)

[grnemo]

{QUOTE-> I have sent a report at ESET. They are trying to reproduce the error as they said.... <-QUOTE}
To keep you informed about the response I received for my matter they said that this is a normal feature of Vista and that they can't do anything about it, they didn't say If they are planning something at future release, or some special precaution that we should take care during the installation.
They said that when running NOD32 scanner from context menu we don't get MBR scanned as well as antistealth is not activated, but I don't necessarily need to scan MBR when scanning files/folders from context menu (although it is checked by default in the profile).
There is similar situation with antistealth: it is not inevitable to have it activated in NOD32 scan (when run from context menu).
They did make it clear that when we are suspicious about rootkit present in our system we rather run in depth analysis.

However, If someone suffers from the same, and finds a proper resolution at this matter please feel free to share it with us!!!
:thumb: :thumb:

[fredra]

This is VERY interesting indeed ???
I got a different response from them.
I was told that I should UNinstall and REinstall NOD, as this could be caused from a corrupted download.
Their instructions included the caution of making sure that my ID and pswd is absolutely correct.
When I have time within the next few days, I will follow their instructions and add any changes (if any) to this thread.
That is assuming that I am not going against any TOS :P
Cheers :)

[Ngwana]

{QUOTE-> This is VERY interesting indeed ???
I got a different response from them... <-QUOTE}

That is normal, you may get different responses depending on how you reported your case and/or who deals with your case.

I still have an issue with the 'Vista Certified' thing, even the Windows Explorer in Vista has no classification for NOD 32. That is not a big deal but I want to see where Microsoft is going.

[grnemo]

Again, Happy standby-ing ppl ...

[denniz]

I've also got this "problem" and send an mail to Eset about it.

I also send Eset a detailed instruction on how to reproduce the error.

To view the instruction choose either the Word version or the PDF version:

MS Word version: example_of_nod32_error.doc (http://members.home.nl/denmail/example_of_nod32_error.doc)
Adobe PDF version: example_of_nod32_error.pdf (http://members.home.nl/denmail/example_of_nod32_error.pdf)

I hope they come with some kind of fix.

[NOD32 user]

{QUOTE-> ...
I hope they come with some kind of fix. <-QUOTE}
An easy to follow guide to reproduce your issue.

Just out of curiosity, what did Microsoft say?

Cheers :)

[denniz]

{QUOTE-> An easy to follow guide to reproduce your issue.

Just out of curiosity, what did Microsoft say?

Cheers :) <-QUOTE}
Hmm, well I didn't send the mail to Microsoft, only to Eset. I have no reply from them yet. You think I should send it to Microsoft to?

[NOD32 user]

{QUOTE-> Hmm, well I didn't send the mail to Microsoft, only to Eset. I have no reply from them yet. You think I should send it to Microsoft to? <-QUOTE}My feeling is that it may be advantageous to do so for several reasons and I'd certainly be interested to hear their response if you did.

Cheers :)

[denniz]

I seem to have some difficulties locating an e-mail adress to which I can send emails which can include pictures and attachments.

All I can find are standard support forms to supply suggestions and questions, but in those forms I can't include pictures or attachments.

I saw another option for paid email support, but that costs about $86 per question ???

The logical option would be something like support@microsoft.com, but that's just a guess.

Any ideas?

[NOD32 user]

{QUOTE-> I seem to have some difficulties locating an e-mail adress to which I can send emails which can include pictures and attachments.

All I can find are standard support forms to supply suggestions and questions...

Any ideas? <-QUOTE}How about providing them with a link to your post, or a link to your document?

Cheers :)

[ASpace]

@ denniz

Hi !
This is well-known as you may have noticed (lots of posts here about this) . Eset are aware of this but I am sure they are not taking any special precautions because it is not that important .

If you run nod32 to perform full scan within account with Administrator privilages Anti-Stealth technology will run properly with no limitations . Because of UAC and the other new security feautures in Vista , these functions cannot run that way within Standart account .

As I said they are not important because people generally run a context-menu scan to scan simply an archive/folder/set of files . When running Full computer scan Anti-stealth technology will be active to search for active rootkits . It is also active in AMON .

{QUOTE-> I saw another option for paid email support, but that costs about $86 per question

The logical option would be something like support@microsoft.com, but that's just a guess.

Any ideas? <-QUOTE}

There are many way to contact them , they are not that unreachable as it looks like . You can start seeking information about telephones and emails here:
http://support.microsoft.com/common/international.aspx

[softtouch]

{QUOTE->
When running Full computer scan Anti-stealth technology will be active to search for active rootkits . It is also active in AMON . <-QUOTE}

If it activates anti-stealth in amon and on full scan, then explain me why it cant activate it on the context scan? If UAC is the problem, amon and full scan too should not work with anti-stealth.

[NOD32 user]

{QUOTE-> If it activates anti-stealth in amon and on full scan, then explain me why it cant activate it on the context scan? If UAC is the problem, amon and full scan too should not work with anti-stealth. <-QUOTE}It has to do with the parent process or method of execution depending.
AMON is executed in the context of the kernel service, full scan is launched in one of a variety of contexts depending on how it is initiated but the context menu is launched in the context of the logged in user by default and that is where UAC comes in...

Cheers :)

[tisungho]

I found a good step-by-step guide to activate hidden administrator account, hope this helps:

http://www.computerperformance.co.uk/vista/vista_administrator_activate.htm

[gjmveloso]

Any official notice about MBR sector error false alert in all on-demand scanning methods in NOD32?

[denniz]

{QUOTE-> @ denniz
There are many way to contact them , they are not that unreachable as it looks like . You can start seeking information about telephones and emails here:
http://support.microsoft.com/common/international.aspx <-QUOTE}
Yeah I went there, but there is no direct email link that opens up a window in Outlook, just online forms only. But I already send an email to Microsoft to a link I found within Windows Vista itself and copy/pasted the place where they could view the attachement.

As fas as a reaction goes, I've gotten no reaction yet whatsoever from both Eset and Microsoft.


{QUOTE-> I found a good step-by-step guide to activate hidden administrator account, hope this helps:

http://www.computerperformance.co.uk/vista/vista_administrator_activate.htm <-QUOTE}
Interesting link, I'll have a look at it.

[denniz]

Well people, I still got no reaction from Eset or Microsoft, and I don't think I will be getting an answer.

To bad, sad but true! :thumbd:

[Hangetsu]

{QUOTE-> If it activates anti-stealth in amon and on full scan, then explain me why it cant activate it on the context scan? If UAC is the problem, amon and full scan too should not work with anti-stealth. <-QUOTE}

I *think* the reason is because the full scan (if using Blackguard's settings) is spawned by the nod32krn process, which has elevated permissions when it starts at bootup. When you launch an on-demand scan, you're initiating the process yourself as a limited user (which is why certain functions won't work on that type of scan).

Could someone more knowledgeable confirm this?

[softtouch]

This has not much to do with limited account.
Always "user does not have administrator priviledges" bla bla, even I am logged in as administrator... every other program popup UAC if needed, why can Nod32 not do that?

[Hangetsu]

No, I agree with you on that - It would be nice if it gave you the popup. I just think that's the reason why its happening.

Having said that, one reason it may not is for corporate / network customers; I'm pretty sure you can lock Vista down so you don't get UAC messages. If NOD32's on-demand scanning required elevated privileges, it wouldn't run in those circumstances. And if you build in logic to check for both -- Well, now we run into the tradeoff of that kind of flexibility vs. the super-small footprint it has.

[Hangetsu]

Just to be sure though -- Could someone confirm the real-time scanners ARE running Anti-Stealth (i.e. the kernel process) at all times? When I run an on-demand scan I'm just looking for viruses in files. My real-time and full scans are where I want to check for spyware etc; If its doing that (which I hope someone can confirm) in Vista I'm golden.

[ASpace]

{QUOTE-> Just to be sure though -- Could someone confirm the real-time scanners ARE running Anti-Stealth (i.e. the kernel process) at all times? When I run an on-demand scan I'm just looking for viruses in files. My real-time and full scans are where I want to check for spyware etc; If its doing that (which I hope someone can confirm) in Vista I'm golden. <-QUOTE}

Yes , it does . Anti-stealth technology runs perfectly in AMON and in the full on-demand scanner . It does scan even for (active and passive) rootkints in real-time .