NOD32 takes 99% CPU too long

I used NOD32 v2.51.26 for 1 week in quite good conditions. Then it began consuming more and more CPU for scanning. So I would like to know what causes NOD32 to use 99% of CPU for as long as it scans the files. My computer freezes waiting AMON to end. The bigger the EXE or RAR or ZIP, the longer my PC freezes. Up to 30-40 seconds!!! So as a last resort before throwing NOD32 in the garbage bin, I ask you: what is going on

 

AMON does not scan inside other than SFX archives. Try disabling SFX archives in the AMON setup to see if it makes a difference.

 

AMON scans all. Period.
And how do you explin NOD32 'eats' more CPU as time goes by?

 

I think you can pretty much take Marcos @ what he's saying. Considering he works for Eset I'm pretty sure he's correct on his statement. After all, unless it is during creation in which AMON scans everything it can and uses Advanced Heuristics.

Do you have any other real-time programs running on your machine? That's a pretty typical culprit of High CPU usage.

-Cov

 

I think I can pretty much read in Extensions tab: Scan All...

No, I don't. And I am using Process Explorer (http://www.sysinternals.com/Utilities/ProcessExplorer.html) just in case.

And to be more specific, I tested also Kaspersky, AVG and ZAP. They all use advanced heuristic method, but none of them freezes my computer when creating/copying/moving/deleting files... I guess this issue is very well known by NOD32 authors and yet they dump it like a skeleton in the closet. "If clients bump on it, we'll blame on something else, if they don't... lucky us"

 

If it was all NOD32/AMON's fault, then I assume all users would have same experiences as you? Then how come it is not? It must have something to do with the setup you're using? Or softwares you are using? I'm just guessing... Maybe if you provided more info? Which hardware/PC are you using (how powerful), which OS, service pack, other security softwares, "clean" AV installation or not (are there any left-overs of other antiviruses)? etc.

EDIT: By the way, I tried putting an infected .exe file that NOD32 detects inside a .zip archive. I have set AMON to scan all files, yet it does not alert me when I put my mouse over the .zip archive (not even when I double-click the archive either). I guess this goes as proof against what you said? This should be normal behavior for a NOD32

 

I will take them one by one. Remember that my PC had same computation 'power' for every anti-virus tested. CPU goes to 99% when checking/creating files ONLY for NOD32.

SYSTEM INFO
==========

NOD32 antivirus system information
Virus signature database version: 1.1784 (20060929)
Dated: Friday, September 29, 2006
Virus signature database build: 8114

Information on other scanner support parts
Advanced heuristics module version: 1.037 (20060926)
Advanced heuristics module build: 1122
Internet filter version: 1.002 (2004070
Internet filter build: 1013
Archive support module version: 1.050 (20060926)
Archive support module build version: 1176

Information about installed components
NOD32 for Windows NT/2000/XP/2003/x64 - Base
Version: 2.51.26
NOD32 for Windows NT/2000/XP/2003/x64 - Internet support
Version: 2.51.26
NOD32 for Windows NT/2000/XP/2003/x64 - Standard component
Version: 2.51.26

Operating system information
Platform: Windows XP
Version: 5.1.2600 Service Pack 2
Version of common control components: 5.82.2900
RAM: 512 MB
Processor: x86 Family 6 Model 8 Stepping 6 (PIII/933 MHz)

OTHER SECURITY SOFTWARE
=====================
Agnitum Outpost Firewall v4.0

ABOUT "CLEAN" INSTALL
==================
Format c: and Windows XP reinstall before each antivirus test.

 

Is there anything in the event logs?

Have you tried an uninstall / reboot / reinstall / reboot?

 

Define 'anything'...

Read above:
"Format c: and Windows XP reinstall before each antivirus test."

 

Is there anything in the event logs regarding NOD or any of its modules?

And wether or not you've formatted your hdd makes no difference to my questions.

 

There is something unique to your system, and with this being the case we need to find out what exactly it is to resolve this situation.

Please download and run HijackThis from HERE

Please download and run Autoruns from HERE

Please download and run Lookinmypc from HERE

Then forward the logs from all three programs to support @ eset.com with a link to this thread.

Cheers

 

i had this same problem when i had nod installed on my machine and i found the problem to be mim.exe, for whatever reason while nod was doing a scan it would go way up (i recently noticed avira does the same thing), when i disabled mim.exe recources went back to normal. I hope this helps

 

Doesn't sound like the cause in this case, but mim.exe is a MusicMatch JukeBox component and it is a known issue for them (MusicMatch) who were acquired by Yahoooooo a while back. It used to be even worse.

OK - now I've got a bit of dejavu

Cheers

 

Exactly. Never interested in that software and never installed it.
On the other hand, another forum member had same issues and NOD32 support suggested to uncheck "select all" extensions to scan. Which I did. But no change. The moment NOD32 kernel sees I want to copy/move an .EXE it scans and it scans and it scans and more CPU... very greedy software. Its days are numbered. Here I come Kaspersky AV + firewall or ZoneAlarm Internet Suite.

 

So disabling SFX archives nor AH didn't help? It's like with cars, the better the more gas it consumes. If you want an excellent detection you must sometimes sacrifice the speed.

What about excluding the exe file in the AMON setup if it stays at the same location? Anyway, in such case AMON would scan it only once with the "Optimize scanning" option enabled.

 

Ooooh... finally truth begins to emerge... I translate: NOD32 good detection -> sluggish system. So let's quit "configurations issues" and be more honest towards clients.

Optimize scanning my ###...

 

So actually you didn't post here to get support/help with any issue?

 

This is not true and we all know it. I think all has been explained so the thread is now closed to prevent from further trolling.