Running NOD in Real-Time and KAV in On-Demand

I can't make my mind up on which AV to use - NOD or KAV Personal 5. From what I've read and learned, I shouldn't run two (or more) AV real-time monitors at the same time.

I often read that any people run NOD as the real-time scanner, while at the same time running KAV as the On-Demand scanner. What if I disable KAV 5 real-time monitoring, then install NOD 32 and use it for real-time monitoring. Would this cause a problem ?

What problems am I likely to encounter ?

Also, if after this change, what if I wished to switch to KAV 5 Real-Time scanning for a week or so ? Would it be OK to disable NOD's realtime scanning and then enable KAV's realtime scanning ?

Would NOD's RT scannig conflict in anyway ? Likewise, if I disabled KAV's RT scanning and enabled NOD's RT scanning, would the RT scanners conflict ?

If not, then I might purchase a licence for both AV's. While I don't doubt that the advice on Wilder's is un-biased, the AV is probably the most important SW you'll ever install so I don't want to take any chances. That said, I will probably wait a couple of weeks before making my decision so I can make an informed choice after reading all the replies.

 

Defenestration,

Since your thread is not specifically about NOD32(looking for opinions on NOD and KAV), i'll move it to the other anti-virus software forum.


snowbound

 

No problem snowbound. At least you let me know about it, rather than just moving/deleting it which moderators of other boards have done.

I hope this won't reduce the replies I get though.

PS. I like your name.

 

A NOD, KAV thread? Nah, it should get lots of replies.

Thank u.



snowbound

 

I agree, but I'm still waiting...

I happen to like snowy weather, so any chance of throwing a bit my way..?

If it makes people miserable, it's likely to make me happy so bring it on!

You can't beat going for a walk in the snow though!

 

The topic between KAV and NOD seems to come up far too often here. I guess in a way it says something about these two AV's

Is there any reason why you do not want KAV 5 as your real time monitor? Not to say one is better than another, but i have rarely seen an instance where something was detected by NOD and not by KAV. In those instances many times it is by NOD's heuristics, and soon after KAV will have detection as well. But if resources are a concern many people opt for NOD and perhaps an AT software.

Like you mentioned there are some people who use NOD and then KAV as an on demand scanner, so conflicts are probably rather minimal if configuration is correct. However some general problems you may encounter by having two AVs installed are... freezing, instability, or dramatic slowdown. Sometimes the computer will not even boot or you will just get a blue screen. Note that even if you do disable an AV's real time scanner, sometimes one (or both) of the AV's do not have the proper configuration option to disable everything needed to run stable. Thus it may appear you properly disabled the real time monitor but still suffer the instability of running two real time monitors at the same time.

To me I think the choice between these two comes down more to personal preference, resources, and price. Some people can get away with just running KAV for virus and trojan protection. While some others feel more comfortable with NOD and a dedicated AT. Some even use KAV and a dedicated AT. Needless to say the combinations are endless and the choice is ultimately your own.

 

Defenestration,

Let me add a couple of comments,

I currently use both on the family PC's. Right now 3 PC's use KAV 4.5 WS exclusively, one uses NOD32 exclusively, on my PC NOD32 is on the primary partition, KAV 5.0 WS is being tested on my backup partition - which I'm working from now. It's really just a shakedown to see whether I convert the KAV 4.5's to 5.0.

I have used NOD32 as realtime/KAV 4.5 as demand in the past. Not sure if I'd try that with the KAV 5.0 family. I'd be a little hesitant of conflict between the realtime AV and KAV's startup monitor. I haven't tested this out, just an early concern.

Performance differences are most prominent during the initial system startup scan. NOD32 is clearly lighter here. In typical use, I'm really not feeling a lot of difference, although this will certainly be machine dependent. It's been a little surprising to me, but while working/surfing during a KAV 5.0 system scan, I'm not seeing a lot of system crawls. That was always an issue with me using KAV 4.5. System response is very reasonable during a complete scan.

On systems where I've run both in parallel or series, neither AV has left any malware for the other to find. To me, that says a lot. Both are very solid choices.

The historical hit on NOD32 is limited coverage of trojans. I'd say that deficiency has been largely eliminated.

I've said this elsewhere, but I repeat it here - the various tests presented at www.av-comparatives.org capture the essential differences and trade-offs between the two AV's fairly well. KAV is a leader in the current malware tests due to its encyclopeadic database. NOD32 is a leader in the retrospective tests of ability to identify malware not covered by an existing signature via heuristics. A new edition of the retrospective test is slated to appear in December. The two approaches are complementary and to varying degrees all products incorporate both schemes.

The one aspect of KAV 5.0 that I am sorry to see is the very complete integration of all the system modules into a single package. Earlier KAV's had a much more modular design ethic, which I prefer.

As rerun2 notes,

I agree. Despite the occasional intensity of feelings voiced in discussing these two options (and a number of others), field use performance differences are indeed minor according to my personal experience. Naturally, the experiences of others may differ.

Blue

 

Because I use the Directory Opus file manager and KAV causes slowdowns when reading folders. While DOpus is superior in almost every respect compared to other file managers, it does not use another thread to "pick-up" the file's icon. This causes DOpus to "hang" while it is being scanned by KAV. This "hang" is caused because KAV is unpacking and then scanning the entire contents of a file (usually a compressed exe file). When running NOD, only a small delay is noticeable while reading the contents of the same folder.

At the same time, I feel safer with KAV, when compared to NOD. Last time I tried NOD, it did not detect an infected exploited jpeg which was in a zip archive, even though I had NOD set to maximum settings. This made me feel vulnerable because it was an ITW infection (which NOD is supposedly the best at detecting). Anyway, this was with NOD 2.12.1 (from what I remember). Since I am about to trial NOD 2.12.3 (the latst NOD version) to see if this issue has been fixed, I will reserve my judgement on NOD, and post my findings back in this thread. I will also be trialling NOD against some "dodgy" sites. Don't ask which sites in particular; Suffice to say, if I hadn't had a few beers (or visited the Netherlands), I wouldn't like to visit these sites

 

So BlueZanetti, are you saying that when you used to run KAV 4.5 and NOD, you have not encountered any problems ?

I don't fully understand what you mean when you say that you had NOD running on the primary partition, and KAV 5 WS running on the backup partition. Did you have them both running at the same time ?

What do you mean by "primary partition" and "backup partition" ?

 

Yes, I've run KAV 4.5 and NOD32 together without problem. The key is to completely disable between installations (I use msconfig to disable the appropriate service and startup components). Its fairly straightforward to bring things up in a controlled fashion - just have to be careful to not have two realtime scanners going at once.

On the second part - it's a dual boot machine - separate XP Pro installs on two different drives. I choose which to boot to on startup. The PC has two AV's. Only one is active at any time since they are basically associated with distinct OS installs.

Blue

 

Is the kavsvc only linked to Real-Time scanning ? ie. if I disable it will the GUI part still work and allow me to run On-Demand scans ?

Am I right in thinking that to have NOD32 running as my Real-Time scanner, I should disable kavsvc ?

What do I need to disable in NOD32 if I want to have KAV as my real-time scanner ?

 

I tried this once (the same thing), and I what I did was to...
To remove KAV RTS from Mem.... keep kavsc, but remove kav.exe from startup
To remove NOD32 RTS from mem...remove nod32kui.exe from startup list, but keep nod32krn.exe in services...

NOD32 is really fast, while KAV is really thorough, but it used to give a lag on my PC (never sorted it out, just disabled it)
Use the one which works for you (KAV for FULL protection at the cost of resources, NOD32 for good protection at NO cost for performance)
Hey, anyone wanna confirm this

PS: you want to simply "disable" the AV's RTS from its console, so that if you need to switch the AV scanners, this is the quickest way to do it. Removing the above files will mean an extra lag in switching while the secondary AV starts its main console. Keeping these and simply using "disable RTS" option means that the AVicon remains in the tray, but you see it as "disabled"...

 

I been trying to use KAV Personal 5 with NOD32. However, even with KAV's RT protection disabled (from the console), it still scans things at start-up. This seems to conflict with NOD32 in some way because my system has "hung" several times, with the Desktop not being re-drawn. NOD32 seems to fully disable RT protection when AMON is disabled.

I will try to remove kav.exe from the startup and see if that helps. As you mention though it would be preferable to be able to do this from the GUI.

 

Apparently the problem with startup objects still being scanned by KAV even though Real-Time protection is disabled, will be fixed in the next service release (hopefully MP2).

Maybe this will solve the lock-up problem when running NOD as RT scanner and KAV as On-Demand.

 

dvk I can't use KAV and NOD on my system either, It was suggested to me in another thread to try installing KAV FIRST and then NOD but I have NOD setup the way I like it with a few custom profiles and I don't feel like doing all that again so I never tried it to see if that helped. If your NOD setup isn't that complicated you may want to try that.

 

As a KAV 5 Personal MP2 beta tester, I have to say that, unforturnately, there is still no method to turn off automatic scanning of start-up objects.

 

I used them together without problems. You need to disable KAV from startup (aka MSCONFIG) and also go to the Administrative Tools at the Control Panel and run SERVICES. You should disable KAV MONITOR service there. No KAV icon will show up upon next boot but the right click functionality and on demand scanner will remain. Of course, before doing anything please disable on access scanner from within KAV program itself. NOD resident monitor could be used this way.

 

At least in my own case, it seems as though they do not coexist quite as gracefully together as I previously experienced. I hadn't run in this fashion for a while and I tried it out during some brief performance testing this weekend. Same basic configuration. I used KAV 4.5 since 5.0 has the startup scan issue. It's not BSOD level problems, just system tray and application launches getting locked-up. I wonder if it is tied to the SP2 Security Center and contending for attention/notification there. In any event, as more internal protections get built into the OS and applications, the ability to have on-line backup in the form of a full package relegated to demand-only status is seemingly going by the wayside.

Too bad in a way since I still experience clear performance/coverage tradeoffs with the present generation of options that was mitigated by this style of configuration.

Blue

 

As I said, there is *NO* startup scan problem with KAV5 if you know how to disable it properly. If you just disable it from the KAV options, it will scan at boottime anyway.

Under 2000/XP, go to the services and disable KAV MONITOR. Do not make it manual, just disable it.. Also check off KAV from MSCONFIG and finaly do not forget to disable on access scanner from the program options inside KAV. If you do these, there will be no KAV icon loading at startup and there will be no KAV loaded in the memory at all...

On demand scanner and right click scanner still functions.

Hope this helps.

 

Hi all,

What I did was to install NOD32 in Safe mode with all of the real-time engines turned off. When I started up again, NOD32 was installed but there weren't any conflicts with KAV 4.5. When I want to run a NOD32 demand scan, I first turn off KAV and then run NOD32 on-demand with NOD32's real-time scanner turned on. This seems to work fine. I have it running like this for a couple of days now.

I also, very tentatively, re-installed PG 3.0 to see what happens. So far, so good. If things explode again, I will go back to the clean image copy and try again.

Rich

 

I have kav 4.5 and nod 32 v2 on my xp pro system and both run very well together without any problems at all.
I can switch between resident monitors without issue at all, sometimes I will have kav monitor enabled for a few weeks and then I disable it and run nod instead, but I usually have kav4.5 enabled most of the time and use nod as on demand scanner.

I have installed kav first and then nod second in the past and I have installed nod first and then kav second and It does not make any difference which one is installed first on my system as both run without issue and I have not experienced any lock ups either.

The only thing that I did when installing both av programmes was to disable all other security programmes before install of kav and then do the same for nod and all went without a single problem.

I would like to try kav5, but there are still to many issues for me to give kav 5 a try, I am going to wait for further maintenance packs to be released to see if these issues will be resolved.


Your friend

THE MUL

 

I had the same experience. I do not know if this is helpful but what I noticed was that in 4.5 build 94/97 (I believe) I was able to run another antivirus as resident and then KAV as on demand. KAV gave me the download location to KAV 4.5 build 94/97 when I ordered and it is the version where they put your key in the installation file. During installation you can choose whether or not to install the resident component. And everything would work smoothly afterwards, even with another AV running resident. But when I wanted to upgrade to build 104 I had to save my key and download the trial version of 104. This trial version of build 104 did not give me the option to not install the resident component during installation. After installing KAV and trying to disable the resident component in the control centre i would still have lock ups etc.

 

Maybe the speed lags if u havesome other 3rd party apps?
KAV+spysweeper = trouble (on my system)