Server has become unstable

I have posted this in the v2 forum but was told i should have posted it here.

I have noticed a dramatic rise in problems on two of our servers since we have put nod32 on them.

ServerA is a Win2kServer running our website+mailserver(mdaemon)+sybase database used for web content

ServerB is a Win2K3 Server acting as a fileserver + sybase database

Before nod was installed the servers where very stable and only switched off when there where schedueled power outs.

When i originally installed the nod32 it was version 2.000.09 on both machines the servers kept behaving strangly, services did not start up, communications to our databases stopped working interminatley. we kept having to stop/restart the dbservices before we could talk to the database again. I disabled IMON which helped, things where still going wrong, but not at the same rate!
I got in touch with my supplier of NOD32 who recommended I installed a beta version 2.000.11 Again this has improved things but I am still getting the occational hangup. I still can't switch IMON on, if i try switching IMON on, on serverA for example, nobody can pickup their mail, until i have disabled IMON and rebooted the server!

I have read many a column on this forum about all sorts of network applications/services problems that have arisen after installing NOD32, are these problems still being looked into?

I do like nod32, it is quick and easy to install, we have become a reseller and have recommended it to a few of our customers. But this has now stopped until our issues in-house have been resolved

 

Hi manney:

Servers rely heavily upon TCP/IP for interaction (most notably that when you turn off IMON they run better). Currently we have NOD32 installed on approximately 50 servers ranging from NT to SBS 2003. None of them display your characteristics.

1st question: Did those servers have previous antivirus protection that was removed and then NOD32 installed?

2nd question: If previous antivirus solutions were removed: When you look at services, do you see any remnants of previous protection (common with other antivirus solutions is to linger services and files).

3rd question: Have you attempted to repair TCP/IP with any of the winsock fix utilities? (even in IMON there is a utility).

I hope these help you troubleshoot.

 

Thanks for your reply. As a software development company ourselves I do understand that you would not have released software that hadn't been as widely tested as possible.

It is a bit of a strange one though. The servers can seem to run fine for a few days but then seem to go in a rapid downhill spiral. in fact, yesterday all the workstations started dropping off the network, tried to log on to the 2003 server console. And it took almost an hour to get through the login process! Eventually Restarted the server, the same thing happened again 30 mins later, this time I completely uninstalled nod32 and then restarted the server and so far, touch wood, we have had no problems.

The servers are standard installs and have little 3rd party apps running on
them. The 2003 server is also a domain controller, and only has Sybase Anywhere v7 database installed & Sage Line 50 Accounts package and also acts as the NOD32 Remote Server.
the win2k server is a standalone workgroup server with IIS + Mdaemon v7.1 + Sybase Anywhere 7

In answer to your questions,
1st question: Did those servers have previous antivirus protection that was removed and then NOD32 installed?

NO

2nd question: If previous antivirus solutions were removed: When you look at services, do you see any remnants of previous protection (common with other antivirus solutions is to linger services and files).

Not Applicable

3rd question: Have you attempted to repair TCP/IP with any of the winsock fix utilities? (even in IMON there is a utility).

NO. Is this something that you are saying i should try?

We have NOD32 installed on 8 of our XP&Win2k workstations and at that end it seems to be fine, Just don't understand!

 

Hi Manney,
It is strongly recommended not to install IMON on servers (since you installed the beta , you must have noticed that IMON wasn't turned on by default). You shouldn't experience any problems with IMON not registered to the system.

 

Hi Marcos: It this permanent (or only for the Beta)? Our servers run fine (Beta not installed).

 

Marcos, I said in my original posting IMON is not enabled as it caused too many problems.

As I said last Thursday, I have now UNINSTALLED nod32 from our main w2003 server and since then not one thing has stopped working, and the server has not needed to be rebooted

I will leave nod32 off the server for a couple of weeks, and let you know how it behaves and then try and install it again

 

Hi Marcos.
Just a question: why don't you include this kind of warnings in the f.a.q. page (http://www.nod32.com/support/faq.htm) or in the documentation page (http://www.nod32.com/download/manual.htm) of NOD32 web sites?
In my opinion a "well explained" deployment guide will help system administrators to implement NOD32 in a better way since its first installation.
I notice that some questions posted in this forum could be included in a white paper, don't you think so?
Thank you.

 

Read this knowledge base article

http://support.microsoft.com/default.aspx?kbid=822158

it outlines the files that need to be excluded by virus scanners...
Nod are aware of this KB article and said they will incorporate this into the next major update of NOD32...

the info contained in the Kb article solved all the issues we were having with all of our clients who were running NOD32

btw if ur running a terminal server on a win2k server then the terminal server licensing server databse directory also needs to be excluded (when TS is set up in application mode it ask where to keep the licensing server database)

good luck

 

Thanks for the link asdf69,
I have completely unistalled NOD32 form both our servers. It is not the best idea I know but I just wanted to confirm to myself that it was not anything else that has been causing the problems. The two servers have reported no problems what so ever in the past week, no services have stoped working. I will leave them as they are for another week and try to install NOD32 again next week, with the server files excluded from scanning and we'll see what happens

Can someone please advise
When I install the beta version from a clean install, it seems to put ob a standard version of NOD, and not the admin version. As the server was the machine creating the mirror, I do need the admin version. The only way I have found to do this is
1 - install nod32 for xp (admin) from download site
2 - install beta version of NOD32
this then gives me the option to mirror
is this correct?

also what is the latest beta version? I think the one I have is 2.000.11

please advise

 

If you email beta2011@eset.sk and place a link to this thread, they will probably give you a newer version of the Beta:

NOD32 Antivirus System information
Virus signature database version: 1.840 (20040811)
Dated: Wednesday, 11 August 2004
Virus signature database build: 4748

Information on other scanner support parts
Advanced heuristics module version: 1.008 (20040804)
Advanced heuristics module build: 1057
Internet filter version: 1.002 (2004070
Internet filter build: 1013
Archive support module version: 1.018 (20040727)
Archive support module build version: 1093

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.0
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.0
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.0

Hope this help...

Cheers