NOD32 v3.650 fails Microsoft updates

[twl845]

I have not been able to receive Microsoft updates since the beginning of April. They fail. Today I attempted to install XP sp3 and it failed. Checking with Microsoft support, it was suggested that the problem could either be my FW or AV not permitting changes. I first shut down my FW, and tried again, but that wasn't it. I then disabled my NOD32 v3.650, and tried to do the update and it was successful. Checking when I upgraded Nod to v3.650, I discovered it was April 4th, exactly when the Microsoft updates started failing.
What do I have to disable or what setting do I have to change in NOD to correct this? Thanks. :)

[ASpace]

Very strange . I would say that svchost.exe is blocked and that is why you can't get your updates.

I have no such problem with computers running XP or Vista and never seen any problem with this.

You can try to exclude svchost.exe from communication so that its traffic is not scanned at all. Please , check your firewall again :)

[Joan Archer]

I never had any problems installing SP3 with NOD32 v3.0.650.0 running, in fact I didn't turn anything off. ;)

[BeanCounter]

{QUOTE-> I never had any problems installing SP3 with NOD32 v3.0.650.0 running, in fact I didn't turn anything off. ;) <-QUOTE}

Same here. I have installed SP3 on 3 computers with 3.0.650.0 running and I have not experienced any problems.

[twl845]

{QUOTE-> Very strange . I would say that svchost.exe is blocked and that is why you can't get your updates.

I have no such problem with computers running XP or Vista and never seen any problem with this.

You can try to exclude svchost.exe from communication so that its traffic is not scanned at all. Please , check your firewall again :) <-QUOTE}
I found svchost checked, so I unchecked it. Now I'll have to wait for the next windows update to see if it flies. If not, I'll put in the x as you suggested. Thanks.

[ASpace]

{QUOTE-> I found svchost checked, so I unchecked it. Now I'll have to wait for the next windows update to see if it flies. If not, I'll put in the x as you suggested. Thanks. <-QUOTE}

No , you must make it with x if you want it not scanned . If your protocol filtering is set to "Ports and applications..." , no matter you have unchecked it , it will still be scanned because the ports svchost will use to communicate will be scanned . Making it with x will for sure exclude it

[twl845]

{QUOTE-> No , you must make it with x if you want it not scanned . If your protocol filtering is set to "Ports and applications..." , no matter you have unchecked it , it will still be scanned because the ports svchost will use to communicate will be scanned . Making it with x will for sure exclude it <-QUOTE}
OK will do. Thanks.:)

[ablatt]

Why is a critical Microsoft component like svchost.exe selected as a web browser in NOD32 v3.650 by default?

Should everybody leave it selected or should we all put an X beside it?

[ASpace]

It isn't selected as a web browser. It is in the list because it has (at least once) used a http port to communicate . By default ESET products scan http traffic . Placing a x will make the program not scan the svchost's traffic no matter the port or other settings .

I have suggested that so that we eliminate any possibility where NOD32 might interfere with the updates . You don't need to prevent NOD32 from scanning the traffic unless you have problems. I don't have problems . Thousands of other users don't have problems , too.

[Joliet Jake]

{QUOTE-> It isn't selected as a web browser. It is in the list because it has (at least once) used a http port to communicate . By default ESET products scan http traffic . Placing a x will make the program not scan the svchost's traffic no matter the port or other settings .

I have suggested that so that we eliminate any possibility where NOD32 might interfere with the updates . You don't need to prevent NOD32 from scanning the traffic unless you have problems. I don't have problems . Thousands of other users don't have problems , too. <-QUOTE}


Mine has never appeared in there.

[alglove]

See my earlier post here: http://www.wilderssecurity.com/showthread.php?t=206329

Basically, I have found that if svchost.exe is scanned in "Active mode" (the next section down in the configuration menu), then Windows Updates fail. Make sure that svchost.exe in unchecked in the "Active mode" section.

By the way, you may still leave svchost.exe checked in the "Web browsers" section.

[twl845]

{QUOTE-> See my earlier post here: http://www.wilderssecurity.com/showthread.php?t=206329

Basically, I have found that if svchost.exe is scanned in "Active mode" (the next section down in the configuration menu), then Windows Updates fail. Make sure that svchost.exe in unchecked in the "Active mode" section.

By the way, you may still leave svchost.exe checked in the "Web browsers" section. <-QUOTE}
Thanks for the info. I also had your problem with the 3 updates, which I commented on in your other thread. ;D

[Philippe_FR22]

{QUOTE-> Very strange . I would say that svchost.exe is blocked <-QUOTE}

Hello,
Is there event log or something like that (at NOD32 level or Windows level) that could confirm that svchost.exe (or windows update process) was blocked or was not able to download updates (or contact server?) ?

Regards

[alglove]

{QUOTE-> Hello,
Is there event log or something like that (at NOD32 level or Windows level) that could confirm that svchost.exe (or windows update process) was blocked or was not able to download updates (or contact server?) ?

Regards <-QUOTE}
The closest thing is in the Windows Update history. The failed updates have a red "X". If you click on the "X", you will see an error code of 0x80072F78, which means "ERROR HTTP INVALID SERVER RESPONSE".

There is no sign anywhere else (that I can find) that something went wrong.

[twl845]

{QUOTE-> The closest thing is in the Windows Update history. The failed updates have a red "X". If you click on the "X", you will see an error code of 0x80072F78, which means "ERROR HTTP INVALID SERVER RESPONSE".

There is no sign anywhere else (that I can find) that something went wrong. <-QUOTE}
I did updates today twice with no problems after unchecking svchost.exe. Thanks again guys. ;D

[ASpace]

Good job! Thanks for letting us know :thumb:

[silx]

Hi,

But, if you don't have any problems with windows update or anything else, is recommend exclude or not svchoest.exe from "web browsers"?!

thanks.

[twl845]

{QUOTE-> Hi,

But, if you don't have any problems with windows update or anything else, is recommend exclude or not svchoest.exe from "web browsers"?!

thanks. <-QUOTE}
Look up in post #11.

[silx]

Yeah twl845, I saw post number 11.

But I'am curious about implications on activate or don't activate this process...on tab "web browsers"...

[silx]

I looked again "protocol filtering" and read again post number 6 of HiTech_boy's and understood.

Thanks.

[twl845]

{QUOTE-> I looked again "protocol filtering" and read again post number 6 of HiTech_boy's and understood.

Thanks. <-QUOTE}
OK, great. :)