Extra settings for Nod32 v2.7 - revised 22-12-2006

[Blackspear]

1. Click “Yes” to save the modifications to the “Control Centre Profile” that you have just made.


.

[Blackspear]

UPDATE

1. Click on “Update”.

2. Click on “Setup”.


.

[Blackspear]

1. Please LEAVE Location Server as “Choose automatically”, I say this for many reasons:

* If a particular server is down, NOD32 will NOT be able to roll on to the next server.
* Experience shows us that you will have fewer or no problems with updating using this setting.
* Let Eset do their job and balance loads on the servers.

2 and 3. Your Username and Password will appear here if you have followed this tutorial from the beginning.


Do not try to use a Username and Password that you have created, ONLY a UN and PW provided by Eset will work.


See HERE for instructions on how to enter a Username and Password correctly.


4. Click on “Change”.


.

[Blackspear]

1. It is advisable that you choose the Radio Button that has NOD32 “Perform program component upgrade if available” and “Offer computer restart if necessary”.


NOTE: due to the size of some/all engine updates, you may NOT want this setting if you are on a Dialup Internet Connection.


2. Click on “OK”.


.

[Blackspear]

1. Click on “Advanced”.


.

[Blackspear]

1. This is where you can set your type of connection if NOD32 hasn’t already picked it up.

Please Note: WIRELESS broadband users, it is advisable to choose the “Dial-up” radio button, this will have NOD32 wait for a connection to be established before attempting an update.

2. Click on Proxy server “Setup”.


.

[Blackspear]

1. This is where Proxy Server settings are placed.


Do NOT place a tick in this box UNLESS you are using a Proxy.


2. Click on “OK”.


.

[Blackspear]

1. Click on “Setup”.


.

[Blackspear]

1. Make sure this Radio Button is checked.

2. Click on “OK”.


.

[Blackspear]

1. Click on “OK”.


.

[Blackspear]

1. Click on “OK”.


.

[Blackspear]

1. Your various Log files can be found here. Should you need to, you can click on an entry in the right hand Window, then click on “Copy selected”. You can then paste what you have copied into Notepad, or Microsoft Word etc.


.

[Blackspear]

1. This is one of the places where you can Submit your Quarantined files to Eset.

The actual storage folder for Quarantined files can be found in C Drive> Program Files> Eset> Infected.

ONLY after your first infection has been actually quarantined will this folder be created.


.

[Blackspear]

SCHEDULAR / PLANNER

1. Click on “Schedular/Planner”.

2. Click on “Add”.


.

[Blackspear]

1. Click on the arrow to see a drop down box.

2. Choose “NOD32 Kernel – Execution of an external application”.

3. Click on “Next”.


.

[Blackspear]

1. Choose a name for your task.

2. Choose a Radio Button that suits your needs.

3. Click on “Next”.


.

[Blackspear]

1. Choose a time to run your task.

2. Place a tick in a day or days that you want to run your task.

3. Click on “Next”.


.

[Blackspear]

1. Choose a Radio Button that suits your requirements.

2. This will prevent overlaps of a Scheduled Task if you choose the Radio Button in the screenshot.

3. Click on “Next”.


.

[Blackspear]

1. Click on “Finish”.


.

[Blackspear]

1. Click on “Browse”.

2. Browse to where NOD32 is installed, typically where you see in this screenshot.

3. Click on the Eset folder.

4. Click on “nod32.exe” or NOD32 if you are not displaying extensions, both are the same file.

5. Click on “Open”.


.

[Blackspear]

1. This is what you should see now.

2. Do the same for the work directory, except only go as far as the Eset folder. This step is a MUST for Windows 98 and Vista.

3. Place in the “Command line” all appropriate “Switches” that suit your requirements.

4. Click on “OK”.




From what I can see, the following switches should give the greatest and maximum strength scan:

/adware /ah /all /antistealth+ /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /ntfs+ /pack+ /quarantine /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /unwanted /wrap+

For NOD32 version 2.5 use:

/adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /ntfs+ /pack+ /quarantine /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+




Your scan settings will start with:

C:\ (single space) /switches go here - see screenshot




Or


Copy and Paste the following directly into your settings:


C:\ /adware /ah /all /antistealth+ /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /ntfs+ /pack+ /quarantine /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /unwanted /wrap+

For NOD32 version 2.5 use:

C:\ /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /ntfs+ /pack+ /quarantine /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+




Or


To scan MORE than ONE HARD DRIVE do NOT use C:\

Instead, use the following:


/local /adware /ah /all /antistealth+ /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /ntfs+ /pack+ /quarantine /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /unwanted /wrap+

For NOD32 version 2.5 use:

/local /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /ntfs+ /pack+ /quarantine /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+



/local = Scan all local drives

/adware = Enable detection of adware, spyware and riskware
/ah = Enable advanced heuristics
/all = Scan all files regardless of their extension
/antistealth- = Disable Rootkit detection
/antistealth+ = Rootkit detection
/arch+ = Enable archives (ZIP, ARJ and RAR) scanning
/clean = Clean infected objects (if applicable)
/cleanmode = Enables cleaning mode (the actions taken will depend on the action settings)
/delete = Delete the infected file
/heur+ = Enable standard heuristics
/log+ = Enable Log file generation
/mailbox+ = Enable scanning mailboxes
/ntfs+ = Alternative NTFS streams
/pack+ = Enable internal runtime packer files scanning
/quarantine Copy infected file to quarantine before taking further action (clean/delete)
/scanboot+ = Enable boot sectors scanning
/scanmbr+ = Enable MBS scanning
/scanmem+ = Enable scanning memory
/scroll+ = Enable scrolling of the Log
/sfx+ = Enable scanning self-extracting archives
/unwanted = Enable detection of potentially unsafe applications
/wrap+ = Enable text wrapping in the Log file




GENERAL
/break- = Disable testing intermission
/break+ = Enable testing intermission
/expire- = Disable the program expiration notice
/expire+ = Enable the program expiration notice
/help = Display the list of program switches
/list- = Include in the Log only the objects infected
/list+ = Create the list of all tested objects in the Log
/quit- = Do not quit the program automatically after scanning
/quit+ = Quit the program after scanning
/scroll- = Disable scrolling of the Log
/scroll+ = Enable scrolling of the Log
/selfcheck- = Self-test disable
/selfcheck+ = Self-test enable
/sound- = Sound warning disable
/sound+ = Sound warning enable
/subdir- = Disable the sub-directories scanning
/subdir+ = Enable the sub-directories scanning



DETECTION
/adware = Enable detection of adware, spyware and riskware
/all = Scan all files regardless of their extension
/antistealth- = Disable Rootkit detection
/antistealth+ = Rootkit detection
/arch- = Disable archives scanning
/arch+ = Enable archives (ZIP, ARJ and RAR) scanning
/ext=<LIST> = Add a new extension into the list of tested files. (Multiple entries permitted, e.g., /ext=EXT1,EXT2
/heur- = Disable heuristic analysis
/heur+ = Enable heuristic analysis
/local = Scan all local non-removable media
/mailbox- = Disable scanning mailboxes
/mailbox+ = Enable scanning mailboxes
/network = Scan all network disks
/ntfs+ = Alternative NTFS streams
/pack- = Disable the runtime packer files scanning
/pack+ = Enable internal runtime packer files scanning
/pattern- = Disable testing using virus signatures/patterns
/pattern+ = Enable testing using virus signatures/patterns
/scanboot- = Disable boot sectors scanning
/scanboot+ = Enable boot sectors scanning
/scanfile- = Disable scanning of the files
/scanfile+ = Enable scanning of the files
/scanmbr- = Disable MBS scanning
/scanmbr+ = Enable MBS scanning
/scanmem- = Disable scanning memory
/scanmem+ = Enable scanning memory
/sfx- = Disable scanning self-extracting archives
/sfx+ = Enable scanning self-extracting archives
/unwanted = Enable detection of potentially unsafe applications



HEURISTIC ANALYSIS
/ah = Enable advanced heuristics
/heur- = Disable standard heuristics
/heur+ = Enable standard heuristics
/heurdeep = Set deep heuristic sensitivity - technically Deep Heuristics no longer exists as it has a higher chance of producing False Positives.
/heursafe = Set safe heuristic sensitivity (minimize false alarms)
/heurstd = Set standard heuristic sensitivity



PROTOCOL
/log- = Disable Log file generation
/log+ = Enable Log file generation
/log=<FILENAME> = Set the Log file name (e.g.: /log=NOD.LOG)
/logappend = Enable Log file append option
/logrewrite = Enable rewriting of the Log file
/logsize=N = Set Log file to the maximum size of N KB)
/wrap- = Disable text wrapping in the Log file
/wrap+ = Enable text wrapping in the Log file



CLEANING
/clean = Clean infected objects (if applicable)
/cleanmode = Enables cleaning mode (the actions taken will depend on the action settings)
/delete = Delete the infected file
/prompt = Offer an action upon virus detection
/quarantine Copy infected file to quarantine before taking further action (clean/delete)
/rename = Rename the infected file

Note: If the switches: /prompt, /rename, /delete/ or /replace are used concurrently with the /clean switch, the corresponding action will be carried out only if the virus cannot be cleaned. The further a parameter is listed, the higher priority it has. For instance, using the "/clean /delete /prompt " parameters will result in that the "/prompt " parameter will supersede the "/clean /delete" parameters.



TEST SCHEDULING
/daily = Automatic testing on a daily basis
/period=N = Automatic testing once in N days
/weekly = Automatic testing on a weekly basis



NETWORK (Windows versions only)
/centralpath=<PATH> = Specifies the name of the directory for Centralized Update files
/msg="<MESSAGE>" = Specifies the message to be sent upon virus deletion.
/recipient=<LIST> = Specifies the recipients of the network messages (server/s, group or workstation name). Multiple entries are permitted, e.g., /recipient=SERVER1,SERVER2


For further discussions on Command Line Scanning see the following thread


.

[Blackspear]

1. Remain in the Schedular/Planner module.

2. The “Scheduled scan” that you have just set up will now appear here.


.

[Blackspear]

1. Right Click on your new scheduled scan this will pop up a small window as seen in the screenshot.

2. Click on “Run now”. If your settings are correct you will see the next screenshot as the scan starts.


.

[Blackspear]

1. Click on “Yes”.


.

[Blackspear]

[4] LOCKED FILES

1. This will show drives that are in the process of being scanned.

2. [4] Locked Files are password protected or Windows System Swap Files, it is unlikely for such a file to be infected, however the possibility still remains.


.