Why would a scan job log not show completion

Running a trial version of NOD32 on a friend's computer. The weekly scan job was run manually by telling NOD32 to run it now

The job has the following as its parameters:

/local /adware /ah /all /arch+ /heur+ /log+ /mailbox+ /pack+ /scanboot+ /scanmbr+
/scanmem+ /scroll+ /sfx+ /unsafe /wrap+


Why would the status window show that NOD32 is still running the job when it isn't. there is no scan window in the task bar but the scan log just ends and shows no reference to his last logical parition nor is there any summary information.

As well if a particular file is added through NOD32 exclusion list, due to a false positive should the same excluded file still raise a warning in the above scan log?

 

Sounds similar to this:
https://www.wilderssecurity.com/showthread.php?t=103165

 

Yes it sure does and that thread does not seem to have any definitive solutions to the problem.

 

Does using the /mailbox- parameter make a difference?

 

An overnight scan on the computer in question would have to be performed as the machine is no speed demon. The machine is not normally used for email with the default email client being OE. However the partitions in question were F: and G: which is not where any mail clients or their mailboxes reside. Does this matter?

 

FWIW, I have the same problem. I still need to try the /mailbox- setting, particularly as I do not use Outlook, but I do have a couple of questions.

In at least one case, the Update log reports that updates were attempted more than once during the time when the scan should have been taking place. Wouldn't an update to the scanning engine during a scan cause errors? I'm surprised that this is permitted by the scheduler.

Also, for these remote scans, could the MAPI interface be causing problems? On my first attempt to scan today, the scan was left with "cleaning" in the logs. Thinking that perhaps the problem was associated with the NOD scheduler, I have been using the XP task scheduler. Reviewing the log files of task scheduler, it states that the task was aborted after the time limit had expired (3 hours in my case).

I attempted another scan this afternoon where I would not be gone from the house for so long. In this case when I came home there was an error message on the screen from Outlook stating "Either there is no default mail client or the current mail client cannot fulfill the messaging request. Please run Microsoft Outlook and set it as the default mail client". Canceling this message then allowed NOD to run.

After some debugging, I have determined that this message occurs when, in NOD, 'use MAPI interface' is selected AND I am running in a Limited account.

Note, when running as limited, I get this same error message whenever I attempt to open the NOD32 program (for example, when right clicking a folder in explorer and request that NOD perform a scan)

Is there something about NOD that does not like running under a Limited account? Could this be part of the scanning problem - that NOD is hitting files where it wants to use the MAPI interface under a Limited Account and is timing out/crashing out?

Off to run more tests,

mikkl

 

Another question - in the XP task scheduler, the "Last Result" indicates 0x5. I had been assuming that this was the Windows standard error message 5 indicating "access erro", which is fairly typical for a NOD log file. Looking up the command line options, I see that the NOD exit code 5 is "scan interrupted by user".

Is the Windows Task Scheduler outputting the NOD exit code? If so, this again points to some form of interference hanging the scan and task scheduler aborting it for running too long.

Is there a command line option for disabling mapi scanning? If I start NOD32 from the command line in a Limited account, I receive the same Outlook error that I mention above.

Thanks,

mikkl

 

One more message update - through a process of trial and error, I have found that there is a /mapi command line option. When I use /mapi- and /mailbox- options, the scan runs correctly and completely, using the XP Task Scheduler.

During this scan (which was run on a Limited account), Poptray was checking email and my complex screen saver (Marine Aquarium) was running.

I am going to reboot and let the scheduler try again and see if it will work two times in a row.

mikkl

 

Last follow-up (I hope)

The reboot and rescan worked. FWIW, here is the command line I am using:

C:\PROGRA~1\ESET\nod32.exe C:\ /ah /heur+ /cleanmode /delete /clean /quarantine /log+ /wrap+ /sound- /mapi- /all /scanboot+ /scanmbr+ /scanmem+ /mailbox- /arch+ /sfx+ /pack+ /adware /quit+

HTH,

mikkl

 

Today was the first *real* run of my normal scheduled cleaning routine.

My NOD32 command line scan worked correctly. /mapi- seems to have done the trick.

HTH,

mikkl