Strange NOD32 alert

[Danutak]

Every day, a few times a day Ghost Flag @ ESET
It never stoped for me
V5, w7, 64

[robin58]

Poison, I'm seeing the same as you. In fact I have uninstalled and reinstalled version 5.0.95.0 both using the live installer and manual install version, and regardless of this simply right-clicking on ANY of the Eset files and selecting properties show it to be version 5.0.94.0 even with Eset telling me it's up to date. I discovered this while searching for potential issues to figure out why I was getting these Ghost popups never realizing this had been an on-going issue. FWIW my Ghost popups never started until I went from 5.0.93.0 to this alleged latest version.

[ProTON]

Heads up everyone! I just noticed that at least Home version of ESET antivirus has this in the changelog of the newest release:

"Fix: Irrelevant notification bubble is being shown when no action is required"

I still didn't had time to test it extensivelly but can someone from ESET (or not) confirm that this fixes the issue of this thread? And if yes, will the fix be backported to the Endpoint edition?

[ProTON]

UPDATE: No, new version didn't fix the problem for me. Also one more new thing. I left the computer for 3 days on and after comming back I've got 3 ghost messages one after another. Interesting.

[layman]

Originally Posted by ProTON

UPDATE: No, new version didn't fix the problem for me. Also one more new thing. I left the computer for 3 days on and after comming back I've got 3 ghost messages one after another. Interesting.

Two of my NOD32 machines are on a KVM switch. They are rarely rebooted. I get the ghost message at least once per machine per day on the first occasion I toggle to the machine.

I assume this annoyance remains uncorrected for the simple reason that the root cause is unknown. This is a relatively minor issue, unlike the drastic USB mount problem. Both, however, raise questions about ESET's trouble-shooting competence, and they serve to undermine confidence in the product more generally. If ESET is unable to diagnose minor defects such as this, how can customers have a high degree of confidence in more critical aspects of the product? Minor bugs are serious in their own way, fer shur. Some folks have posted here that this is merely a "cosmetic" issue. That is true insofar as the effect of an incidence is negligible, but ESET would be unwise to let this bug languish for that reason, because unresolved issues like this cast doubt on the professional caliber of ESET's development shop. It's wise to assign resources to resolving an annoying issue such as this, rather than plowing ahead with work on major releases that cart the annoyance down the road.

[rnfolsom]

Layman:

An excellent post. I fervently hope that someone at Eset pays attention.

But the whole issue is mysterious. It goes back at least as far as the earliest 4.x versions of NOD32. I'm still running NOD32 4.2.71.2 on a WinXPsp3 Dell Latitude C840 laptop, while my wife is running NOD32 4.2,71.2 on a Win2kSp4 IBM A31 laptop, and neither of us have ever experienced this strange alert. Our hardware is at least 7 years old or thereabouts. And we have no Microsoft application software (other than our operating systems, and --- in my case --- MS Office 2003 and 2007 viewers). We both write a lot, using Mozilla SeaMonkey 2.0.14 (current version is 2.12) for email and blogs, and WordPerfect 12 (wife) and X3 (me) for more formal writing.

So I'm suspecting that the Strange Alert is caused by some conflict between NOD32 and more modern hardware or software. I hope that Eset starts accumulating data on Strange Alert incidents, including data about software and hardware on the troubled computers.

Roger Folsom

[ProTON]

Three years later, we at the version 6.0 now and the issue is still there. Seriously?

[SweX]

Originally Posted by ProTON

Three years later, we at the version 6.0 now and the issue is still there. Seriously?

Might be best if you could post a screenshot of the popup you're seeing.
As you are the first one to report this on V6 afaik

[Marcos]

Originally Posted by ProTON

Three years later, we at the version 6.0 now and the issue is still there. Seriously?

In order to fix the issue, the notification feature has been completely revamped in v6. Maybe there's an actual reason for the notification to pop up on your computer then.

[ProTON]

I will make a screenshot later today. But generally it doesn't show anything new. I just logged in to the computer which was left powered on for couple of days. Double clicked on ESET icon, then in ESET GUI clicked on big checkmark in the top right corner and tried to choose "About" item. The ghost notification appeared as soon as I clicked on checkmark sign and disappeared couple of seconds later.

[robin58]

Originally Posted by SweX

Might be best if you could post a screenshot of the popup you're seeing.
As you are the first one to report this on V6 afaik

Well seeing as NOD only notified me yesterday that there was an update available and assuming I wasn't singled out for late notification by my installation, I don't exactly find it unusual that there aren't a slew of complaints about it yet.

Originally Posted by Marcos

In order to fix the issue, the notification feature has been completely revamped in v6. Maybe there's an actual reason for the notification to pop up on your computer then.

That's not the kind of response I'd expect from Eset basically saying "It's not us it's you". There is an issue.

Originally Posted by ProTON

I will make a screenshot later today. But generally it doesn't show anything new. I just logged in to the computer which was left powered on for couple of days. Double clicked on ESET icon, then in ESET GUI clicked on big checkmark in the top right corner and tried to choose "About" item. The ghost notification appeared as soon as I clicked on checkmark sign and disappeared couple of seconds later.

I am beginning to wonder whether this only occurs with computers that are on 24/7. And if so it might be a clue.

Is it possible that this popup appears because at some point while unattended the program searches for an update, finds one but stalls while downloading only later to successfully update? Would/could that leave the balloon notification there to be seen when one logs back into the computer?

[ProTON]

I can confirm that the issue is more prominent with computers that are left logged on (but locked) 24/7. Basically the more days the PC is on, the more chance is to see the ghost notification twice or more times in a row.

[rnfolsom]

Originally Posted by robin58

. . . I am beginning to wonder whether this only occurs with computers that are on 24/7. And if so it might be a clue.

Is it possible that this popup appears because at some point while unattended the program searches for an update, finds one but stalls while downloading only later to successfully update? Would/could that leave the balloon notification there to be seen when one logs back into the computer?

Robin58:

I think you may be on to something. Although I review this thread fairly frequently, I don't recall anyone --- neither people who have never seen the "Strange NOD32 Alert" nor people who have seen it --- reporting whether or not their computers run 24/7.

Personally, neither my wife nor I ever have seen this "Strange NOD32 Alert." The reason may be what you suggest: All of our computers (and also our wired router and our wired internet connection "modem") are shut down at night. After shutting down our computers, we shut down all of the other computing hardware by the simple technique of turning off the "battery box" (aka "Uninterruptable" power supply) that protects all of our computing hardware.

But there may be an additional protection that we have: Our NOD32 settings (I think always) require permission before any signature update is downloaded and installed. [In NOD32 v5.2.9.1, that requirement is at Setup > Enter Advanced Setup > Update > Update > Advanced Update Setup Button > Update file size > Ask before downloading update Checked > Ask if an update file is greater than 1kb.] And Aryeh Goretsky has told me (in another thread that I now can't find) that all signature updates are greater than 1kb.

Robin58, I really think you may have found a clue to the source of the "Strange NOD32 alert" issue. If so, congratulations!

R.N. (Roger) Folsom

----------------------------------------------------------------

BACKGROUND
Our hardware is fairly elderly: My wife's laptop is an IBM A31; mine are a Dell Latitude C840 and C800. Our Eset NOD32 Antivirus history is v2.x, followed by jumping past v3.x to v4.x (through v4.2.71.2, which I think was the last 4.x version), and now using v5.2.9.1. The 2.x and 4.x versions ran under Win2kSp4, and we now use WinXPsp3 with NOD32 v5.2.9.1 (and plans to install a later 5.2.15.1 version, although right now I can't find it on Eset's website).

All of our computing hardware connections use Category 5 or higher wiring; nothing is wireless.

[bcronin]

For what its worth, I saw the alert fairly frequently in v4, less-so in v5 and not at all (yet) in v6. My computers do not run 24/7, but they are rarely rebooted. I generally just put them to sleep. It is not unusual for them to not be rebooted for weeks and weeks.
--
bc

[ProTON]

The screenshot of ESET NOD32 Antivirus 6 showing ghost notification attached. As you can see the ESET GUI shows maximum security, but the notification says there is a problem.

I still have to see automatic ghost notifications which appeared without user interaction in v4 and v5. In v6 I can only reproduce it by manually clicking on various main items in the GUI. But the issue is still there.

[robin58]

I still see the same thing occasionally ProTON on a W7-64bit computer that runs 24/7, but after monitoring the computer's behavior I think, at least in my case, I have pretty much concluded it's simply from either an aborted/interrupted virus signature updates or occasionally I've noticed NOD32 seems to be aware earlier of required Windows system updates than my autoupdate is noticing. I have my system updates set to run at night and I guess for a period of time NOD32 knows I am not up to date. Then when I log in, if it's after the autoupdate has run, the warning bubble will be there, but obviously what it was alerting me to has been taken care of.

[ProTON]

Nevertheless it's still a bug.

[rnfolsom]

Originally Posted by robin58

. . . Occasionally I've noticed NOD32 seems to be aware earlier of required Windows system updates than my autoupdate is noticing. I have my system updates set to run at night and I guess for a period of time NOD32 knows I am not up to date. Then when I log in, if it's after the autoupdate has run, the warning bubble will be there, but obviously what it was alerting me to has been taken care of.

Robin58:

Thanks for mentioning the possibility that NOD32 might occasionally cause a "Strange NOD32 alert" in response to NOD32 noticing that a system [Windows] update was available. If so, that is another setting that my wife and I have that might contribute to our never having seen a "Strange NOD32 alert." In NOD32 we have Tools > System Updates deactivated and Automatic Updates set to "Notify me but don't automatically download or install them," because we normally don't install any update until Windows Secrets' Susan Bradley has checked them out and reports her recommendations on the Thursday morning after update Tuesday. (Of course if an update arrives on an unscheduled date, we consider installing it.)

R.N. (Roger) Folsom

[haerdalis]

I have the same annoying issue since..forever.. NOD32 AV 6.0.316

It's just about the only message I ever see from the AV, other than the occational message about it updating itself.

Actually, that message itself is pointless.
If it wants attention, then it should tell why it wants attention.

Btw, this computer isn't always on, most of the time it isn't on for 24 hours in a row.

[siljaline]

This annoyance and ongoing issue should be on the Future Changes to EAV
http://www.wilderssecurity.com/showthread.php?t=197994 request list.

[JRCATES]

Originally Posted by siljaline

This annoyance and ongoing issue should be on the Future Changes to EAV
http://www.wilderssecurity.com/showthread.php?t=197994 request list.

LOL...I remember commenting on this problem in this thread, and so I went back through it to see when it was that I commented on it. It was October 10, 2010. That was over two and a half YEARS ago!

To see that it is STILL happening is more than a bit disappointing. Hopefully ESET will improve their product...but if a problem like this persists for over two and a half years, it makes you wonder if it will EVER be fixed!

[Janus]

Originally Posted by JRCATES

LOL...I remember commenting on this problem in this thread, and so I went back through it to see when it was that I commented on it. It was October 10, 2010. That was over two and a half YEARS ago!

To see that it is STILL happening is more than a bit disappointing. Hopefully ESET will improve their product...but if a problem like this persists for over two and a half years, it makes you wonder if it will EVER be fixed!

Hello

Well JRCATES, it is at least nice to know ,that some things will remain constant, in this World.

Best regards, Janus

[Marcos]

Originally Posted by JRCATES

LOL...I remember commenting on this problem in this thread, and so I went back through it to see when it was that I commented on it. It was October 10, 2010. That was over two and a half YEARS ago!

This issue was fixed quite a long time ago.

To see that it is STILL happening is more than a bit disappointing. Hopefully ESET will improve their product...but if a problem like this persists for over two and a half years, it makes you wonder if it will EVER be fixed!

The current issue is related to a Windows bug for which we'll have to make a workaround so that notifications are not triggered when the bug manifests.

[JRCATES]

Originally Posted by Marcos

This issue was fixed quite a long time ago.

Not for version 4.2, which is what I have on another machine at the moment.

And not according to the posts I'm seeing dated as recent as yesterday.

[SweX]

Originally Posted by JRCATES

And not according to the posts I'm seeing dated as recent as yesterday.

Yes it is fixed by ESET in their software i.e NOD32/ESS.

But....

Originally Posted by Marcos

The current issue is related to a Windows bug for which we'll have to make a workaround so that notifications are not triggered when the bug manifests.