NOD32 v.3.0.x on Windows Server 2003

Earlier, when v3.0 was first released we upgraded from v2.7 to this new version on our entire production enviroment. Due to the fact that NOD2.7 had worked flawless, and the good experience with ESET NOD32 AV, we didn't feel the need to set up a test environment, or just upgrade a portion of servers/clients. This new 3.0x version worked great for our client-computers, but sadly our servers now all of a sudden started to act strange.

We experienced random lockups of the servers, which never occured before, and it happend at random to all of our servers (not all at once though). The lockups caused the inflicted server to not work at all, and the deadlock was so brutal that we didn't even get console access to the server. The screen was BLACK, and there was no reaction to mouse/keyboard. The only sign that the server was on was the power-led, the fans humming, and the fact that the server would answer to ping - other than that it was "dead". If rebooted (in fact the only way to shut down the server was to hold the powerswitch for 5sec++) the server would come online, work as normal with no signs in the event-logs etc giving any indication to why it locked up... It would then work for x days and then lock up again. And this was the behaviour of ALL our 35 production servers.

I read in this forum about other people experiencing similar problems with the v.3.0 client, and decided to stay with it for a while and try to help/contribute to solve the problem, try new releases, tips/tricks, suggestions from other users/ESET etc, and we did try several new v.3.0 releases without success - the servers still locked up - maybe a tad more seldom than before - but still an annoying problem, and finally at one point my boss had enough and told me to revert back to NOD32 v2.7 - our endusers was furious with all the problems - and magically, after reverting, all lockup's went away. Since that day we have not had a single unexplained lockup of any of the servers.

Is this problem adressed in the latest release? If i upgrade from 2.7 to 3.0.672 on all our servers, will I still get the same problems?

I would very much like to upgrade since we also upgraded the mirror-server when we first started to use 3.0.x and the reverted 2.7 servers cannot use the 3.0 mirror causing theese servers to now download directly from ESET every time - not the biggest of issues, but still a waste of bandwith. Also having the same version all over eases the maintenance and necesseray technical documentation of our network etc.

But, alas, I will not try to install 3.0.672 on even a single production server until someone can confirm that the majority of theese issues are gone in that version. - Or know why theese happen and some workarounds to stop them from occuring. I have no time to setup and maintain a test-server environment with NOD 3.0 installations - so have to install on more or less importent production-servers, and that's why, I ask beforehand, if this problem have been solved.


--
An10Bill

 

did you apply the recommended settings for servers?

 

As far as I know the majority of theese settings (disable HTTP checking and removal of SCAN ALL FILES) was done at one point trying to follow up and test some responses in other treads regarding such lockups and similar problems.

Some servers, did have exclusions set up (backup and database-server), and other servers did not have any exclusions - and they all hung at several occations - I can't say the ones with exlusions hung more or less than the ones without. So this didn't seem to have any impact really.

But a best-practise "exclusion-list suggestion" from ESET on what files to exclude i.e on a Domain Controller, IIS-server and other server-installations/configurations would sure be nice so one don't have to play "trial and error" to sort this out when installing/configuring NOD for a server - nevertheless, I don't think this would have solved the problem I experienced then due to the fact that this happend to ALL my servers, everything from normal FILE-servers, IIS-servs, Domain Controllers, BU-servers, the NOD RA server, WSUS server etc.... They were all affected regardless of configured exclusions....


--
An10bill

 

I don't think ESET ever had a clue what was causing the issue. They suspected UPHC service but users reported mixes results with ESETs findings. I haven't had any lockups on my 2003 servers for months. I'm currently on 3.0.667.

 

We stayed away from Nod32 3 for servers because of this same issue.

However, now we have 3.0.672 on around 40 servers. So far so good.

We did not disable scanning of network drives. We have servers that do not have antivirus (NAS, AS/400, others for which no antivirus exists) and we want those files scanned.

We have scan all files checked.

Our domain default is no Outlook integration due to a conflict with Kerio KMS, so that is off on everything.

POP3 checking is on. It is used on one server, as nothing else uses POP3 other than one server which does a POP3 to IMAP download for some users.

We did have to disable web protection on a few servers.

For the most part, we had a less unique setup with NOD32 3.x on servers than was the case for 2.7 where we had things like IMON and DMON not installed.

my .02

 

the bug affecting windows servers was corrected in 3.0.657 (or was it 3.0.650?).
anyway, we're running 3.0.657 on our servers w/o any problems for quite some time already and didn't feel the need to try the newer versions yet.