That little grey pop up scanning window (botton right of screen)

I'm a bit puzzled about the new pop up file scanning thing that shows in the bottom right of the screen.

It seems totally random.

I go to many many different websites, all with a wide variety of text and images. Once in a blue moon for no apparent reason whatsoever, that little gray box pops up and appers to be downloading an image or something.

But I have seen 100's of images and thet box does not pop up.

It's like totally random and I guess may pop up about twice during a hour of surfing the net.

Can anyone explain ?

 

If you have the following ticked by default, then only large files of a certain size will have the pop up window displayed. What the exact size is I have not checked into...

Hope this helps...

Cheers

 

this happens to me with p2p and msn file swapping, it appears to be scanning the hash # of the file, which is quite good, and how i managed to pick up the new heur virus which was hidden in an mpeg file[ posted last week]
it picked up a hidden ext .iiv

 

An image may already be in your browser cache from a prior visit and not downloaded again.

 

I think it only occurs for files of a certain size as Blackspear and others noted. However, the interesting thing is that I think that there is an upper limit on the file size for its appearance as well. If you think about it, the setting that says "Switch to passive (compatible) for files... larger than [2048]kb" probably means that the translucent popup won't appear for those files larger than 2MB. Why? Because it doesn't really need to. My understanding is that the popup is only there to provide feedback where otherwise there would be none. When IMON HTTP is in passive mode it doesn't wait for full file completion, it passes packets as it receives and processes them. Therefore, the browser itself can display download progress if need be, because it is receiving packets in a timely fashion. So, you probably only see the popup when the downloaded image/file/etc. is between, say, 500 to 2048kb, and then probably only when the download exceeds a set time threshold. That is, if the file is, say, 600KB, but it downloads within 1-2sec... the code for the popup probably isn't triggered since its not really needed and would be more of an annoyance as it caused excessive flashing in the bottom right corner.

 

Thanks for the nice Piccie
A Picture's worth a thousand words.....

To be honest it FEELS totally random (though guess it isn't then)

I've been browsing around and downloading various freeware files of the net and 99.9% of the time, then out of the blue that little window pops up and I think, what the hell is that doing ? I can't say I have ever accociated it popping up with anything large.
I shall have to go to some large image areas and see it it pops up each time.

Steves digicams has megabyte+ images of digi camera shanpshots. I'll see if one of those triggers it as that's about as big a picture as you will find.

 

No...

Obviously I'm not understanding this yet:

Just been to steve's digicams and looked at sample screenshots of the lowest and (one of) the highest cameras and nod32 remained silent.

They are .jpg files, so perhaps that's why NOD32 is ignoring them.

Small:
http://www.steves-digicams.com/cl18/img_0006.JPG

Large:
http://www.steves-digicams.com/2004_reviews/c8080/samples/p3110170.jpg

Can't seem to quite get to grips with what triggers it yet

 

Try this URL and see if you get the pop-up?

http://webpages.charter.net/gunn1943/yard1.htm

 

Yeah, it popped up for those... But why, when it didn't pop up for the other BIG one I posted earlier?

Is it just file size as they are noth jpegs.... (still puzzled)

 

hey nice yard i didn't get a peep out of nod when i looked at your pictures.

 

Yep, got three download images on top of each other.

rgds,
Martin

 

I don't know? Must have something to do with the size maybe. Your large one was around 3.5MB while those yard pictures are around 1MB each.

If you have a high speed broadband connection the pop-up may not have time to show up with smaller images?

 

Did you read what I posted earlier? It's not just a "large" file popup, its a popup that occurs only for a certain RANGE of sizes. Your two files aren't in the range. The small jpg is only 77kb, and the large one you linked to is something like 3.3mb. The default setting in NOD32 is to switch to passive mode for files larger than 2mb. Stan's jpg are all in the correct size range, that's why his will generate the popup.

 

Hi donsan,

Thanks. If you didn't get the NOD pop-up download window do you have the IMON HTTP checking enabled?

 

Ahhh, ok.... The mist is beginning to clear a bit, sorry I didn't understand what you said earlier.
I thought it was just anything OVER a certain size.
So we've got a certain range (say 500K - 2000K) for example, anything larger or smaller it ignores.

OK, fair enough. (not quite following the logic as to why only middle range files have dodgy stuff in them) but ok will accept that.

 

No, it's not that it only scans those in that range... it's just that it switches to a different mode of operation for the 2mb+ size files. It still scans the large files, it just doesn't wait to completely receive those files before passing packets on to the underlying app. If it waits to completion and it detects a virus, it can dump the whole file and report the virus prior to the underlying app ever seeing any packets. However, in passive mode it's still scanning, but now if it detects a virus and pops up a warning the underlying app has already received a portion of the file in question. NOD32 can try to reset and terminate that TCP session, but some of the malware packets in question may have been downloaded. That potential partial download probably isn't that big of a risk, really, but still the other mode is probably a tad safer.

The problem is, that for large files this would appear as weird behavior to many users. For example, your large jpg shows up in the browser as a progressive render during the download. That is, it sweeps down from top to bottom as the file downloads. If passive mode wasn't active, then the file would be gathered up by NOD32, you would continue to see a blank screen, and then -- wham -- it would all appear at once. The progressive JPG is sort of a feedback mechanism to let you know that the file is actually being downloaded. Likewise, say you wanted to watch an Apple Quicktime or Windows Media stream. If NOD32 didn't switch to passive, then playback wouldn't begin with only a partial download. It would likely have to wait until the entire stream file had been downloaded.

 

Idea for automatic passive-mode switch was:

1) all viruses/scripts/malware are small.
2) it is annoying wait for downloading *big* files... (images, archives)

so all small files (you CAN specify what means "small", it depends on your connection speed, for me is small files max 200kb) are scanned in efectivity mode (imon can shows nice page if file is infected), bigger are scanned only in compatibility mode (connection is ABORTED if file is infected - you will get only part of infected file).

Popup window appears only for Efectivity mode - and efectivity mode is used only for smaller files...

 

Thanks for all the explanations.

I shall bow to people who know a lot more about viruses than myself and leave NOD at it's default settings.

Glad to know it's looking after me

 

Well said Tempest.

rgds,
Martin

 

This web page makes the little grey boxes go crazy man !!

http://ubbxforums.ubi.com/6/ubb.x?q=Y&a=tpc&s=400102&f=23110283&m=35010114&p=153

 

Alec, what program are you using to make your screenshots? They look great

Cheers

 

Photoshop Elements. It's pretty handy for that sort of thing. For screenshots you will also probably get better results with GIFs than with JPGs. You can quickly compare the two in PhotoshopE, and it seems to auto select the better format in most cases.

Edit: Oops, I should say that the screenshot itself was taken with AnalogX's Capture utility (freeware), THEN I just used PhotoshopE to convert from a huge BMP into a GIF (plus add the ellipse for highlighting).

 

Thanks for that

Cheers

 

Your quite welcome.

 

Noticed that box when starting bitorrent client, but not with anything else

Just tried it with the IL2 forum link...
I get the grey box when browsing using IE but not when using firefox

Does it not monitor when using firefox or is it just becasue firefox loads images quicker than IE?