NOD32 and WinRAR v3.42 (extracting errors)

[N1G0W]

Hi

I use the NOD32 trail v2.12.3 and i must say "i have never used a better AV product then NOD32" and believe me i have tryed alot of AV products.

But i have just one big problem, i use WinRAR v3.42 to archive my DATA,
but when i try to extract *.exe files i get an error:

"Cannot move setup. File is in use by another user or program. Close all programs that might be in use, and try again."

*I have a Dutch WinXP OS, so i tryed to translate the error message as good as possible.

The only way to extract my files is to disable "Resident module (AMON)"
But it is verry a annoying problem :(


As i said above i use WinXP Home SP1, but i have the same problem on a WinXP Pro SP2 machine.

Trial version
Days left: 16

NOD32 Antivirus System information
Virus signature database version: 1.965 (20050106)
Dated: donderdag 6 januari 2005
Virus signature database build: 5127

Information on other scanner support parts
Advanced heuristics module version: 1.011 (20041126)
Advanced heuristics module build: 1067
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1.025 (20041221)
Archive support module build version: 1106

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.3
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.3
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.3

Operating system information
Platform: Windows XP
Version: 5.1.2600 Service Pack 1
Version of common control components: 5.82.2800
RAM: 256 MB
Processor: Intel(R) Pentium(R) 4 CPU 1.60GHz (1600 MHz)


I am serious thinking of buying this product, but not if this problem isn't fixed.

[Sweetie(*)(*)]

Hi, is it just the 1 file or all the compressed files?

I have had the same problem before, but only rarely while using winzip, i believe it was just a bad file, eg not compressed properly.

[ChaosBlizzard]

I am having the same file with extracting files and overwritting others too. I was trying to install a game patch for StarCraft and the installation would fail everytime, until I disabled AMON. Then it went through with no problem.

Eset has to figure out a way to stop blocking the things the user wants, no other AV does this....

What scanning it before execution isn't good enough anymore? Or scanning the files that come out of the archive isn't good enough? It has to stop what your doing and not allow it?

[Jer]

I too have had an issue with this involving 7-Zip. I can't install it unless I turn AMON off. If I try to install it with AMON on a message box pops up stating "INF Install Failure. Reason: Access Is Denied."

[Atangel]

No Issues here that I've noticed. AMON completly tweaked out, Winrar 3.42. Just tried it again (put an exe in a rar, extracted it without issue).

However, retail NOD32 2.12.2

NOD32 Antivirus System information
Virus signature database version: 1.965 (20050106)
Dated: Thursday, January 06, 2005
Virus signature database build: 5126

Information on other scanner support parts
Advanced heuristics module version: 1.011 (20041126)
Advanced heuristics module build: 1067
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1.025 (20041221)
Archive support module build version: 1106

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.2
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.2
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.2

Operating system information
Platform: Windows XP
Version: 5.1.2600 Service Pack 2
Version of common control components: 5.82.2900
RAM: 511 MB
Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz (2386 MHz)

[ronjor]

I'm using Winrar 3.42 with NOD32 and can extract exe files with no problems.

[ChaosBlizzard]

I am using the Commercial Version and have had several problems with extracting from not just RAR files but program update file which are packed.

My information:
NOD32 Antivirus System information
Virus signature database version: 1.965 (20050106)
Dated: Thursday, January 06, 2005
Virus signature database build: 5126

Information on other scanner support parts
Advanced heuristics module version: 1.011 (20041126)
Advanced heuristics module build: 1067
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1.025 (20041221)
Archive support module build version: 1106

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Administrative tools
Version: 2.12.3
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.3
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.3
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.3

Operating system information
Platform: Windows 2000
Version: 5.0.2195 Service Pack 4
Version of common control components: 5.81.4916
RAM: 512 MB
Processor: x86 Family 6 Model 8 Stepping 10 (998 MHz) -Two 1.0GHz P3's, which NOD32 doesn't report!

[Atangel]

{QUOTE-> I'm using Winrar 3.42 with NOD32 and can extract exe files with no problems. <-QUOTE}
Are you using 2.12.2 or 2.12.3?

2.12.3 is what you get if you use the trial version, but does not come down through update for current subscribers, right? (that will happen with 2.12.4)

I wonder if this is one fix that will show up in 2.12.4

[ronjor]

You can download 2.12.3 from the web site. NOD won't automatically upgrade from 2.12.2 You can install 2.12.3 over 2.12.2.

http://www.nod32.com/scriptless/download/download.htm

[Atangel]

Thanks.. think I'll wait :) So you are also using 2.12.3?

[ronjor]

Been using it since it came out. No problems. :)

[ChaosBlizzard]

Um, yes, if everyone ready my system information they would know I am using 2.12.3. I still had interference with unpacking files from various software patches....

I don't see why NOD32 stops files from working. As it already scans them when you download them off the Internet, then it scans them again with AMON. So that isn't enough? It has to prevent the package from running too?

[Shaman]

Hi,

I had many problems like this with nod 32, for instance moving a 7zip exe file with windows explorer, or installing a patch for warcraft.
The reason is nod opens the file to scan it, it take some time to do the job, and in case of moving a file windows cannot because nod has still it opens.

In the case of winrar, it's because winrar extract to temp dir then move files. You can use winrar's extract button to directly extract to a dir. Drag and drop will cause the problem.

Sure NOD has a problem here, not seen with other AV. Hope they will correct it, but i doubt...

cu

Shaman

[N1G0W]

{QUOTE-> Hi, is it just the 1 file or all the compressed files?

I have had the same problem before, but only rarely while using winzip, i believe it was just a bad file, eg not compressed properly. <-QUOTE}


First of all thanks for all the reply's


Oke i have the problems with alot of *.exe files, its kinda weird because
when i extract the file for the first time i get the error, when i try a second time
it extracts just fine, and sometimes it extracts after a third time. And sometimes i need to disable the "Resident module (AMON)" to be able to extract the file.
And it also dont matter if the *.exe file is 100MB or just a few kb's.
Really annoying.

Btw its not all my *.exe files that wont extract, but the most of them.
Some *.exe files extract just fine.

And yes WinRAR extract the files to a TEMP dir first, and it dont matter if i use the WinRAR extract button or just drag/drop.

I also have winzip, but i dont have seen the error using winzip yet.
I use winrar much more then winzip.

[sir_carew]

That's very odd. I've no problems with WinRAR and any other utility like that. (I use WinRAR all days).
Here's my system information:

NOD32 Antivirus System information
Virus signature database version: 1.966 (20050108)
Dated: Sábado, 08 de Enero de 2005
Virus signature database build: 5129

Information on other scanner support parts
Advanced heuristics module version: 1.011 (20041126)
Advanced heuristics module build: 1067
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1.025 (20041221)
Archive support module build version: 1106

Information on installed components
NOD32 for Windows NT/2000/XP/2003 - EMON
Version: 2.0.0
NOD32 For Windows NT/2000/XP/2003 - Administrative tools
Version: 2.12.3
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.3
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.3
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.3

Operating system information
Platform: Windows 2000
Version: 5.0.2195 Service Pack 4
Version of common control components: 5.81.4916
RAM: 376 MB
Processor: AMD Duron(tm) processor (1102 MHz)

[ShunterAlhena]

I have a similar problem as well. (NOD32 Commercial version, WinRAR 3.42.)
When I open an archive and try to drag&drop something out of it into an Explorer folder, desktop etc I get "File is used by another user or program. Close all programs that might use it, and try again." or a very similar message (in Hungarian).

I found a workaround tho, using Total Commander ;) Anyways, i hope that Eset can eliminate the problem.

System information:

NOD32 Antivirus System information
Virus signature database version: 1.966 (20050108)
Dated: 2005. január 8.
Virus signature database build: 5129

Information on other scanner support parts
Advanced heuristics module version: 1.011 (20041126)
Advanced heuristics module build: 1067
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1.025 (20041221)
Archive support module build version: 1106

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.3
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.3
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.3

Operating system information
Platform: Windows XP
Version: 5.1.2600 Szervizcsomag 2
Version of common control components: 5.82.2900
RAM: 1023 MB
Processor: Intel(R) Pentium(R) 4 CPU 2.60GHz (2598 MHz)

[tosbsas]

OS: win2k sp4
Nod 32: 2.12.3
Winrar: 3.42

No problems of this kind at all

Ruben

[Notok]

Do you have the latest version of WinRAR? I was having a problem with this for a while, but it seems to have "gone away" I think I resolved it by either troubleshooting something else or during the course of updates...

[Atangel]

{QUOTE-> Do you have the latest version of WinRAR? <-QUOTE}

It seem people suffering from this are already using 3.42...

[N1G0W]

{QUOTE-> It seem people suffering from this are already using 3.42... <-QUOTE}


I also noticed the problem when using WinRAR v3.41

[Notok]

Are you guys running any other scanners, such as an anti-trojan? I found things to work a little better (in general) if you exclude the other scanner's .exe.

[rumpstah]

Something to ponder.

I would not be surprised if the people having issues have other security/utility type software running (thus a conflict occuring). Turning off one (in this case one that is identifiable - AMON) causes the issue to resolve itself.

Logic would dictate that everyone using WinRAR (I am also a WinRAR user - 3.42) would experience the same (which I am not and others are not). Probably everyone @ Eset (since that appears to be their archiving utility of choice) would have this issue.

It would probably be fixed toot sweet if that were the case. ;)

Maybe someone can attempt to identify some security/utility app on their system when shut off (or setting changed) enables the extracting function of WinRAR.

[ChaosBlizzard]

I have NO other active security program other than Sygate personal firewall, nod32 seems to agree with it just fine. Keep in mind that is the free version.

All other security measures are through NAT and SPI via my router.

It must be something else.

[N1G0W]

The only active security app on my system is NOD32.

[rumpstah]

How about the second part:

Maybe someone can attempt to identify some security/utility app on their system when shut off (or setting changed) enables the extracting function of WinRAR.

Shutting down all resident programs one at a time (especially systray items) and then attempting the extraction/drag & drop routines.

[ChaosBlizzard]

I assure you, I have nothing else pertaining to security running in my process list. If something is "shut off" it isn't running in resident memory. Therefore it couldn't be affecting NOD32.

[rumpstah]

Hi ChaosBlizzard:

If you are not running a security app, then we believe you. ;)

The second part is a utility application (not security). To find the culprit, shutting down any resident utilities (some may reference as an application where applicable) will at least attempt to find a resolution.

Without having a (i.e.) Belarc log, one can only guess as to what could be the root cause on the affected systems. What one may rule out on a system (i.e. should have nothing to do with it -video utility) could very well be the cause as others have found.


{QUOTE-> I assure you, I have nothing else pertaining to security running in my process list. If something is "shut off" it isn't running in resident memory. Therefore it couldn't be affecting NOD32. <-QUOTE}

[ChaosBlizzard]

{QUOTE-> Hi ChaosBlizzard:

If you are not running a security app, then we believe you. ;)

The second part is a utility application (not security). To find the culprit, shutting down any resident utilities (some may reference as an application where applicable) will at least attempt to find a resolution.

Without having a (i.e.) Belarc log, one can only guess as to what could be the root cause on the affected systems. What one may rule out on a system (i.e. should have nothing to do with it -video utility) could very well be the cause as others have found. <-QUOTE}

No I would know if a "Utility" was residing in my system memory. There isn't anything that could cause a direct interaction with WinRAR in the system. This isn't mainly WinRAR for me. I was uncompressing a game patch and NOD32 denied that file the right to write to the game folder.

Also, I tried cutting a file to a program folder to replace an older alpha version of that program, the action was denied. This has never happened before the use of NOD32. Perhaps this is a desired affect by the Eset Company?

[rumpstah]

Hi ChaosBlizzard:

Out of curiousity, how many different antivirus programs have you had installed on this system without doing a complete reinstall of the OS?

This is reminiscent of an uninstalled, but not completely removed antivirus program. You may want to find manual cleaning procedures if you had previous solutions.

An ActiveX control dropped by another antivirus program can cause these types of conflicts.

Lots of factors here. Baby steps. ;)

It is most likely a rogue piece of software yet to be identified.

{QUOTE-> No I would know if a "Utility" was residing in my system memory. There isn't anything that could cause a direct interaction with WinRAR in the system. This isn't mainly WinRAR for me. I was uncompressing a game patch and NOD32 denied that file the right to write to the game folder.

Also, I tried cutting a file to a program folder to replace an older alpha version of that program, the action was denied. This has never happened before the use of NOD32. Perhaps this is a desired affect by the Eset Company? <-QUOTE}

[N1G0W]

Well as i already said that i have the same problems on "WinXP Home SP1" the machine i am using right now, and on a "WinXP Pro SP2" wich is fresh installed.

The first app that i installed on that "WinXP Pro SP2" machine was NOD32,
after install of NOD32 i installed winrar v3.42, then i dropped alot of winrar files on this machine wich contain all sorts of progs to install, but even on this fresh installed "WinXP Pro" i noticed the same extraction errors.

[N1G0W]

Fixed ;D

Ok i maybe forgot to mention that i tweaked NOD32 using this FAQ:
http://www.wilderssecurity.com/showthread.php?t=37509


Then i saw this topic and it fixed my problem:
http://www.wilderssecurity.com/showthread.php?t=64200


So in short terms: I turned off the "Methods on create" options.

[webyourbusiness]

I too have noticed this problem - but if you open the winrar and use the extract to folder option, it is generally not a problem.

I too am running winrar 3.42 on top of NOD32 2.12.3 enterprise - it's VERY consistent - the error is that the file is in use by another user, and I know for a FACT that it is not - I can reboot and first operation is to attempt the extract - again, error on extraction.

I never considered NOD32 as the cause - but now you come to mention it....