Profiles change for no reason on XP

I'm having a problem with my profiles changing without my changing them on my XP box. I don't know how this happens. What changes is that in "objects to scan" runtime packers and archives becomes UNCHECKED somehow and "Heuristic sensitivity" changes from deep, which I have checked, to standard. Under "Extensions" the scan all files box which I have checked becomes mysteriously unchecked.

I also periodically get a message box, after using the adv. heuristics command line scanning, saying that there have been changes to the profile and the message asks if I want to save the changes. I have no idea why I get this box. I have made no changes. All I have done is scan from the command line. So, I click "no" to the save changes question.

I have a current thread here on Quarantine where I was criticizing the lack of command line scanning in zipped files. Well, what had happened was that these changes to the profile I have for command line scanning had mysteriously occurred and I didn't realize it although I should have because these weird unauthorized changes keep happening. So, of course NOD didn't scan inside the zip file. Just now I reset my profile for command line scanning to how it should be (and saved the changes) and I scanned that same zipped file I mention in the Quarantine thread and the virus was detected.

What do I do so that my profiles, both for command line scanning and for full on demand scan, don't keep changing themselves?

 

Hi Mele20

When u get that save changes box, u have made some kind of change.

If u select NO it will go back to your old settings. In other words if u check runtime packers but say no to new changes, it will not be saved and will be unchecked.

If u make changes and select yes your settings will be saved until u change them again yourself.


Hope this helps.



snowbound

 

Hi Mele,
if you don't have the latest version installed (2.000.9), please download it from our website. It should no longer show up the window prompting you to save changes whenever you run NOD32 scanner from the command line.

 

Yes, I don 't have the latest version of NOD. I'll down load it.

Will this new version stop whatever is causing the changes to occur in my profile?

Actually, after thinking about it more, I believe those changes are occurring ONLY in the profile that I use for adv. heuristics command line scanning. I also think those changes are happening after I get that box prompting me to save changes I haven't made. The changes that occur without my making any changes are a reversion to DEFAULT choices for scanning.

I've only had NOD32 on this new XP box since January 18 and I have had my profile changed by something (a bug I assume) at least FOUR TIMES in two weeks.

This has really confused me because I have used adv. heuristics command line scanning very frequently on my W98SE box ever since Paolo offered us the shell extension and I never, ever had my command line profile changed by some bug in NOD!


Edited to say that after I uninstalled NOD32 and went to download the latest version, I cannot do so! When I first tried the download was slow...dial up slow and I am on 3ms down on cable modem. So, I canceled. I then tried other download sites and cannot start a download at any of them. I came back to the US site and now I cannot start a download there either.

Edited again to say that evidently the problem was the beginning of some speed problem and not a problem with the NOD download sites. Just after posted this, all web browsing slowed dramatically so I just did some speed tests and I am suddenly barely surfing above dialup speed! I haven't had speed problems in ages. Maybe when I figure this out...could be my router...then I can download NOD at a more normal speed. IThis would happen right when I need to download something!)

 

If there is a problem downloading NOD32 due to a temporary server overload, I suggest you try to download it later.

 

Mele20,

The prompt is caused by the issue discussed here previously (shext switch):

http://www.wilderssecurity.com/showthread.php?t=17338

As long as you leave the "shext" switch in the registry for the AH scanner extension, you will get the prompt to save (the prompt is not always necessarily about Action settings changes either, it can simply be a change to the Targets, the latter being the highly annoying part). Remove it and you won't get a prompt. You will always be prompted about changes using the standard context menu scanner as I am unaware of a way to "remove" the "/shext" functionality.

**One PARADOX: the loss of settings sounds like what happens when you DON"T have the "/shext" switch in place while using the AH scanner extension. Here's what happens, for example, with the resetting of DEEP heuristics to STANDARD:

The AH extension is a "command line scanner". It takes it's instructions from the command line switches you apply to it (again, see link above for defaults). The actions cannot be set via the GUI when the "/shext" switch is not employed. So, when you change to DEEP by checking the check box on the GUI, it initially appears like you have succeeded in making the change. However, next time the AH extension is run, it only runs the command switches given it in the registry. The only way to make that setting stick is to add the switch "/heurdeep" to the registry entries in:

Key - HKEY_LOCAL_MACHINE\SOFTWARE\NODSE
Value - Params

Once you make the registry change, it will appear in the GUI because the GUI reflects the settings in the registry, but you cannot actually set them from the GUI.

If an AH extension command line switch is unavailable for a particular action, such as is the case for Quarantine (at least no documented switch I am aware of), no amount of checking of Action Tab GUI Quarantine boxes or wishful thinking will help...no command line switch, no action. As such, the Quarantine box on the AH extension scanner will always appear "grayed out" when using the pure command line AH extension.

____________

Marcos,

I don't quite understand your comment about NOD32 not prompting for changes anymore under 2.000.9 when using the command line. The standard context menu scanner supplied with NOD32 is Profile driven via GUI settings as opposed to command line driven...what am I missing here? (I don't have 2.000.9 yet so i can't test for myself).

 

I'm very sleepy...so brief response. Hope I make sense. I do have the shext switch. I also am seeing the prompt to save after adv. heuristics command line scanning of a file. This is using the latest version of NOD32. So, that behavior has NOT stopped as Marcos suggested it would. However, the behavior does NOT occur on every file scanned in this manner. It does occur on standard right click scanning like you say it does. The prompt to save occurs ONLY on certain files. The same files every time and on other files it does NOT occur. So there is something about certain files that appears to cause the prompt. These files are not of just one type either..some are zip, some exe and other extensions. Some zip and some exe do NOT bring on the prompt.

So the latest version of NOD has not stopped this irritating intermittent behavior. However, so far, I have not seen any changes to my profiles. I click "no" to the prompt box and then I check and there are no changes to my profiles. With the earlier version of NOD32, I think that is when the changes were occurring that set my profile for scanning from the command line back to default. I do note that I am scanning from the context menu even when I use adv. heuristics. That of course, should not be the case. Before I got the latest version of NOD32, the scanning was from command line when using adv. heuristics. So that has changed with this new version.