Nod32

My sister, recently fell victim to an MSN worm.

In the past, I have heard good things about nod32's ability to deal with such malware. So i promptly asked her to install nod32 and run it.

My sister, who is not very computer savvy, did not understand the installation and scan process, so I decided to download it and walk through it with her.

Later on, I removed nod32, because I had no use for it anymore. Heres where the problem starts.

We all know that anti-virus apps like to be as low-level as possible, and they want to be in control of everything. Well, during the time that I had nod32 installed, it decided that it would interfere with my booting system (Powerquest BootMagic), and so, i was unable to boot either one of the operating systems i had running at the time, which really, really pissed me off.

After discussing it with some other people, we all agreed that "nod32 has done me in", so to solve the problem, i had to reinstall my secondary OS, and then fix bootmagic, which took a while, and was a very tedious and annoying process.

After some swearing, hours of fiddling and waiting, I got back into windows XP.

I just want to say that i've never had this problem with any other anti-virus software (i currently use symantec corporate), so it kinda makes me dispise nod32 as one of those poorly written programs that screws **** up all the time.

 

Yeah,

Why does nod32 interfere with my boot system?

Do you plan to support boot menu systems like BootMagic and BootIt in the future?

 

Hi mr a-bomb,

I'm not aware of NOD32 interfering with either of those or similar utilities, except possibly if NOD32 detected a non-standard MBR and you had changed the default configuration in such cases to replace the MBR, or manually clicked the replace button when alerted to the fact by NOD32.

I'm not aware for certain that NOD32 would actually responde to the MBR's used by these utilities (I only assume they must make use of non-standard MBR's) but I see no other way NOD32 could have been involved in your misfortune.

In any case it would be worth asking here if you ever come across anything similar in future - it may be quite easliy sorted, and/or ESET may wish to get a sample of the non-standard MBR to analyse and possible remove it from detection.

Thanks for letting us know you got your issue sorted already.

HTH

Cheers

 

Hi there,

Sorry for sounding like an asshole in my previous posts, ive just been frustrated with getting it fixed.

Nod32 never actually gave me any kind of notification, and i never ran a scan, i basically just sat through the install process, and then uninstalled it.

 

I could tell you were just frustrated.

The more I hear, the less likely it seems that NOD32 was the cause - there must have been something else going on. Did you eventually get rid of the worm?

Cheers

 

There was no worm, virus, trojan or any kind of malware. The problem was definately caused by NOD32

 

I know others who tell me there is no issue with a setup using the utilities that you have mentioned and NOD32. That doens't make it impossible, but on the likely list it really is almost non-existant, far more likely that there was something else going on with that system (not that we can tell much now anyway since your issue is already resolved)

Are you talking about two different computers - your sisters with a worm, and then another with boot utilities, or did I misunderstand?

Cheers

 

The problem only occured on my computer.

I am fairly sure that I did not have a virus or other such malware because:

• Both windows installations where fresh.
• there were no visible signs of malware at the time
• i am extremely careful with what i download
• i run decent anti-virus software

it would not suprise me to see an antivirus program that misidentifies legitimate software (bootmagic), and to me, that seems like the most reasonable explanation.

However, if you say that you know people who can run bootmagic happily with Nod32, then it is quite possible that an error occurred during the install/uninstall process which may have effected the boot sector.

 

That would seem like the obvious thing, that something happened at that time.

If you feel like trying it again, we'll be here

Cheers

 

The AMON boot sector options do include scanning upon Access and Shutdown, so conceivably, the problem could have occurred when mr a-bomb was in the process of rebooting. This could also explain why he never saw a message... because Windows was already in the process of shutting down.

Does Bootmagic have any sort of "rescue" utility to save and restore the modified boot configuration? If so, maybe you could use this to save the Bootmagic config to a floppy, in case anything like this ever goes wrong again (whether by NOD32 or for any other reason).

 

Yes, but as earlier stated, unless the default configuration had been changed there should have been a prompt before any action was taken.

Cheers

 

Hello,

I have never heard of a conflict before between NOD32 and Symantec's (neé PowerQuest's) BootMagic utility from the PartitionMagic program.

Can you describe how the hard disk was configured including operating systems installed, disk volume layout, version of BootMagic and anything else you can think of which might be helpful in reproducing the problem?

Regards,

Aryeh Goretsky

 

I think this is under stated early response ending resolved right on response.