PDA

View Full Version : MBR scanning


hojtsy
July 3rd, 2007, 06:21 PM
Uppon starting the on-demand scanner of Nod32 2.7, I get the warning:
{QUOTE-> MBR sector of the 1. physical disk contains probably unknown TSR.BOOT virus [7]. <-QUOTE}
I am quite convinced that the MBR is modified by Paragon Backup to allow booting from Backup Capsule.
I have a few problems with this:
- The scanning log tab which displays this warning immediately gets hidden after the warning is printed. The warning could hardly be noticed, which is a Bad Thing.
- Wouldn't it be possible to recognize Paragon Backup in the MBR and Backup Capsule, and not display this false alert?
- How do I exclude the MBR from the scanning? I would like to scan MBR on the other discs.
- The AMON settings dialog claims that it can exclude Boot sectors, but I don't see how. Are the AMON exclusions honored in on-demand scanning?

Thanks

sparx
July 3rd, 2007, 08:52 PM
Yeah, it's possible that NOD32 is detecting it as a false positive due to your backup software. You can disable scanning of boot sectors by clicking on 'Setup' in the scan window and uncheck 'Boot Sectors'.

ThunderZ
July 3rd, 2007, 11:30 PM
Before disabling anything I would suggest submitting them to ESET. I doubt you are the only Nod\Paragon user with in these Forums but no other problems have been reported. Then again MBR infections are pretty rare anymore so I am thinking FP as well.

hojtsy
July 4th, 2007, 01:41 AM
{QUOTE-> Yeah, it's possible that NOD32 is detecting it as a false positive due to your backup software. You can disable scanning of boot sectors by clicking on 'Setup' in the scan window and uncheck 'Boot Sectors'. <-QUOTE}
So it is not possible to exclude only this disk from boot sector scanning, and continue to scan the boot sector of my other discs?

Marcos
July 4th, 2007, 03:21 AM
Please drop an email to support[at]eset.com with this thread's url in the subject.

Breakwater
July 20th, 2007, 03:46 AM
hojtsy, I'm really curious what the outcome was of your inquiry. Your questions are similar to ones that I have had. Have you been in communication with ESET on this?

Stephanos G.
August 17th, 2007, 03:58 PM
I have the same alert and i'm sure that is because of the Paragon Back up. I use the back up capsule.

Brian N
August 17th, 2007, 05:51 PM
I still get that warning when my digital camera is attached to the pc :)
Just an FYI.