Windows XP SP2 - Any Compatibility Issues with Nod32?

Uninstalled Nod, and reinstalled SP2 again. No problems with getting an ip address this time, nor does my isp think I have a virus anymore (although ironically I'm now vulnerable!). There would certainly seem to be clash between nod and sp2 ...

(edit) Oh, I almost forgot - these problems were using the current beta.

 

Another update - Installed Nod on my now working SP2 system, but this time not the beta. Did an expert installation and told it not to enable imon. Restarted system and internet worked ok. Enabled IMON. Internet still ok. Allowed Nod to update - everything still ok. Rebooted ... and internet no longer worked. Disabled IMON and tried to get an ip address but couldn't. Rebooted with IMON disabled and internet still didn't work. Uninstalled nod, and everything fine again...

 

SimonJN,
couldn't it be the case described at https://www.wilderssecurity.com/showthread.php?t=28121 ?

 

Hi Marcus - That was the case where you uninstalled Norton and it broke DHCP? No - this was a brand new pc with a fresh xp installation. I got caught by that "feature" of Norton before and haven't used it since.

I did check the dhcp service though (in case it was something similar), and it was running ok. It had written an error to the event log saying it couldn't allocate an ip address. I first assumed it was a compatibility issue with my wireless netword card drivers, but updating them had no effect. Only nod seems to have any effect. When I have time I'll do some more tests to try and tie down when it occurs more precisely.

 

Could it be a firewall problem?

 

Marcus, I did another quick test. I Installed the beta this time using expert mode, and I told it not to register Imon. My internet connection works fine. I allowed it to download the lastest definitions and rebooted again. Still fine. I suspect given my previous results that if I enable Imon that my internet connection will stop working again, and will remain broken until I uninstall Nod.

 

I suppose so. I'll disable the windows firewall entirely, and then enable IMon and see what happens.

 

Right - one last test before bed! I disabled the windows firewall, and enabled IMon. Everything was ok. I restarted the system, and I was unable to get an ip address. Disabling IMon made no difference after that - I tried disabling & re-enabling my wireless connection but it kept failing. I tried using ipconfig to renew my ip address (ipconfig /renew) and got the following error :-

"An error occurred while renewing interface Wireless Network Connection : The requested service provider could not be loaded or initialized."

Once Nod had been uninstalled my connection started working again. I then reinstalled *without* Imon and it was still ok. It seems that if I enable IMon just once, then my connection breaks and stays broken.

 

Have you tried the "Repair" function after installing IMON?

Control Centre
IMON
Setup
Advanced (Tab)
Repair Now

Hope this helps...

Cheers

 

I haven't yet - I won't be able to test that until Thursday. Will post back here when I have some more results.

 

I tried this, but it didn't help me.

 

ok ... I'll be a guinea pig. I plan on installing sp2 on my new notebook today. It has a Netgear wireless setup and ask that you use Netgears wireless drivers and disable XP's wireless service. This might be something to consider. I don't have the NOD beta installed just the current public version. Will write back when finished.

 

OK just installed SP2 on my notebook with NOD, OUTPOST, BoClean, and Wireless connected to net running in the background. Only problem was when I created a rule in Outpost for alg.exe. Lost access to net. Deleted the rule and net access ok now. Updated the def in NOD no problems. Writing this from the notebook now.

 

So, the implication is that it's the combination of SP2, my wireless drivers and Nod that are causing the problem. Well, I've got another wireless card lying around so I'll add that to my list of things to try! I think it might simpler to just roll back to SP1 again

 

I today also installed SP2 and I have the same problem of no longer being able to connect to the internet. I'm not using a wireless card so the problem also exists with wired cards.

Perhaps a good question what cpu are you guy's running on.

The ones without problems and the one with problems.

I myself am using an AMD A64 3200+ CPU.

Could this be cpu related ?

The only solution that I have found till now is to use a program called WinsockXPfix. This somehow disables the IMON monitoring. After a restart then I get my connection back. I can then restart the IMON service but the problem is there again after a restart. I can however now disable the IMAN service within the NOD32 program and I get my connection back. After I got my connection back I can then again restart the IMON service.

I know this is not an easy way to use the program but it's a way.

Regards,

Peter

 

My system for comparison

A64 3400+
MSI K8T NEO fsr2
Using onboard Realtek Gigabit Network Card
Via 4.51 drivers
ATI X800XT
SB audigy 2

The audigy and the X800XT arnt the problems because i did a fresh install and IMON was causing problems before these were installed.

So its either the A64, Realtek Network Card or the VIA 4.51 Drivers and IMON

 

P4 2.6g
512mg ddr
Netgear MA521 Wireless pcmcia

 

Guys, everything everyone is saying sounds consistent with a conflict among what's called "Layered Service Providers" or LSP's. LSP's are kernel mode snippets of code that get "sandwiched" or "layered" in the Winsock TCP/IP stack. That is how IMON apparently works it magic, it has code that gets inserted into the protocol stack as an LSP. LSP's sort of form a chain and if there is a conflict or an erroneous entry in the chain then it can basically kill or stop all communications through that chain of LSP's.

Apparently, enabling and/or disabling IMON is adding or removing these LSP entries. Disabled, no problems... enabled, the chain gets broken and communication stops. Some of you say that installing NOD32 without IMON and then enabling IMON later on works once (prior to a reboot); but I'm curious if that is actually enabling IMON to inspect actual POP3/SMTP/HTTP traffic during that current session. My guess is that enabling IMON only adds the LSP entries in the registry somewhere and that it doesn't really work until a reboot... which in turn causes the conflict and the resulting failure.

Anyway, with all these reports of issues, hopefully Marcos can gather enough evidence to isolate the bug. As someone early on pointed out, LSPFix should help you fix your problems. Also, users of Ad-Aware can install a plug-in called LSP Explorer that will show you what Layered Service Providers are installed. Other than that, if you have problems just keep IMON off.

 

So will ESET be releasing a fix for this? Or am i going to have to put up with this "feature" if not, then i think its time to move to another AntiVirus, quite dissapointing because ive had NOD32 just over a week.

 

Well, first off, just keep in mind that I'm simply speculating based on what I have heard. Secondly, I'm not in any way, shape, or form an official spokesperson. Third, there may not be any "bug" at all. It may somehow be a simple (or not so simple, depending upon your perspective) misconfiguration, or something otherwise wholely unrelated to the NOD32 code itself. However, it sounds like several people had the same/similar problem, so that is probably doubtful.

Keep in mind that we are all dealing with several complicated variables... the release of SP2, the release of new functionality in NOD32 v2, etc. With SP2 there are bound to be a few rough patches, and not just with NOD32. If it is an Eset problem, I think they will resolve it in a fairly timely fashion. They seem to be fairly responsive based upon my experience. They also seem to have a nice componentized structure that lends itself to modular updates, so hopefully any issues can be fixed just that much quicker.

 

Finally got a chance to try a few more things ...

1. Using Repair in IMON - no effect.
2. Enabling IMON and then using LSPFix - yes, that fixes it but only by disabling IMon.

I noticed that the IPSEC service always failed to load as well. This may be related or not.

Regarding my hardware - I have an Athlon 64 3000 (so that makes three of us), it's on a NForce 3 motherboard and my network card uses a Prism chipset .

Since the Athlon 64 has the NX bit which stops programs running code from data segments, I wondered if that might be related. By default SP2 enables it only for "essential windows programs and services" which you would assume includes Nod ... anyway, I turned it on for everything. Nod wouldn't load at all after that - no32krn.exe kept repeatedly crashing and restarting and filling up my event log with error messages (like) :-

"The NOD32 Kernel Service service hung on starting." -and-

"The NOD32 Kernel Service service terminated unexpectedly. It has done this 20 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service."

If any of you other A64 owners want to try it (just in case it's my xp installation that's shafted), you'll find the option in control panel / system / advanced / Performance Settings / Data Execution Prevention.

Thanks for the various suggestions - I'll be leaving IMon disabled for the moment.

 

I have a Athlon64 3400+ on an Asus K8N (Nforce3), same problems on wireless usb nic and onboard ethernet. I think I remember a option to disable the data protection thing, gona see if I can do that for NOD32 when I get home (at work now).

 

One last suggestion, have you tried removing Winsock and Winsock2 by doing the following:

How to Recover from Winsock2 corruption

To resolve this issue, delete the corrupted registry keys, and then reinstall of the TCP/IP protocol.

Step 1: Delete the corrupted registry keys

1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. In Registry Editor, locate the following keys, right-click each key, and then click Delete:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

4. When you are prompted to confirm the deletion, click Yes.

Note Restart the computer after you delete the Winsock keys.

Doing so causes the Windows XP operating system to create new shell entries for those two keys. If you do not restart the computer after you delete the Winsock keys, the next step does not work correctly.

Step 2: Install TCP/IP

1. Right-click the network connection, and then click Properties.
2. Click Install.
3. Click Protocol, and then click Add.
4. Click Have Disk.
5. Type C:\Windows\inf, and then click OK.
6. On the list of available protocols, click Internet Protocol (TCP/IP), and then click OK.
7. Restart the computer.

Cheers

 

Athlon 64 3400+ In my laptop too, wireless card is made by Ralink

 

So, BG and Blackspear have P4's and have no problems with SP2/NOD, and those of us that have Athlon 64's (5 in this thread? all have the same problem ...

I haven't tried Blackspear's suggestion about removing winsock (I'll try that this evening), but I am really starting to believe it's a three way clash between the cpu, sp2 and nod ... I wonder is anyone at Eset has an Athlon 64? If not, I'm happy to do more tests for them.

On a related note - I tried to totally disable DEP last night, but it didn't seem to work. However I did get a slightly different error on boot up. Instead of the nod kernel crashing, I got a message saying that it had been stopped by DEP.