advanced heuristics and AMON

Discussion in 'NOD32 version 2 Forum' started by rug, May 16, 2004.

Thread Status:
Not open for further replies.
  1. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    Well, each to his own. :) I understand that many users, yourself included, want the threat stopped at the border, so to speak, before it gets in even though AMON might alert immediately. I think choices should be available and Anders has replied in another thread that AH WILL be incorporated in some form into AMON but how soon is the main question.
    https://www.wilderssecurity.com/showthread.php?t=32086&page=5

    As for viruses in email, I have an iron clad rule that I never break and that is that unless I am expecting the attachment, I delete it unopened. If I am expecting it, I ALWAYS download the attachment to disk and then scan via command line adv. heuristics. As for some sort of attack embedded in the html in the email ...I use plain text only. Plus, Proxomitron will force plain text also. I can't download the Eicar text test unless I bypass Proxo as it renders it into plain text. Also, no one else uses this computer so I don't have worry about a user who doesn't practice safe computing. My only real worry is that I might get distracted sometime or be extremely tired and thus do something dumb and acquire a nasty because of my momentary lapse in safe computing practices or that I might sometime visit a site I thought was very reputable and it isn't...but I can't be protected against every single possibility....
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,441
    Support for AH is planned to be incorporated to AMON any time soon.
     
  3. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    That sentence is confusing...did you leave out the word "not"?
     
  4. rug

    rug Guest

    Maybe he mixed:
    "any time now"
    "some time soon"

    ?
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,441
    Of course, I meant "some time soon" ;-)
     
  6. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    Too bad you didn't mean "any time now". :D But "some time soon" is encouraging. :)
     
  7. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    Not true. I have the beta and I just disabled IMON for ever. That HTTP scanner really slows my very fast box (3GHz, 1GBRAM on a fast cable modem connection) down! I cannot imagine even thinking of putting something like that on my W98SE box.
    I have to sit there watching a download box from IMON! NO WAY!

    Plus, I don't want advanced heuristics scanning HTTP. I have enough problems with the false positives that AH gives me when I do an on demand full scan using AH. I've changed my mind and I don't want AH for AMON either. I just want ability to scan inside zipped files so I don't have to unzip first and I want more signatures for trojans. I'm soured on AH. I want faster signature protection.
     
  8. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    I find the download of a file a little slower - P4 2.8GHz, 2 x 256 3200MHz DDR, Cable Modem - but all-in-all very happy with it...

    And if you aren't happy with the HTTP scanner, you can disable it. Personally I like it, and are rather impressed with how it pops up and displays the scan, if I can grab a screenshot I'll post one...

    Cheers :D
     

    Attached Files:

    • HTTP.JPG
      HTTP.JPG
      File size:
      36.8 KB
      Views:
      139
  9. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Nod32 HTTP Scanner checking a downloading file.

    Cheers :D
     

    Attached Files:

    • HTTP.JPG
      HTTP.JPG
      File size:
      12.9 KB
      Views:
      137
  10. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    Well that is nice you like the slow down. I don't. I hate that stupid window. I don't pay a lot for a fast connection to sit and watch IMON scanning something with AH and then give me a false positive. No thank you. Now tell me why I want to renew my subscription to pay for something I will never use on even my fast XP box much less my beloved W98SE box that I like better than my XP box? But as you say...each to his own.

    I want to see AMON fixed...poor AMON. Some one over at dslr trying out NOD32 and all upset because AMON can't detect the eicar in the zip. Eset is going to loose current customers and not get new ones if they don't fix AMON...not that anyone will go to KAV since Kaspersky neutered KAV's ability to detect in zip in real time in 5.0...but instead i suspect they may go to NAV even with all its problems.
     
  11. Stan999

    Stan999 Registered Member

    Joined:
    Sep 27, 2002
    Posts:
    566
    Location:
    Fort Worth, TX USA
    Does it help with the speed if you select the "passive mode" per this post?

    https://www.wilderssecurity.com/showthread.php?p=179910#post179910

    Thanks,
     
  12. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    Mele,

    Slightly indeed, as Blackspear concluded as well. Do you really expect an extra scanning module without the logical slight slow down coming with it?

    Just curious: did you encounter any false positive while using the HTTP scanner?

    A matter of personal taste actually ;)

    That's up to Eset to decide. Personally, I fail to see a reason for that. Everything is caught while unzipping.

    In the works for some time now - have a look at the updates over on www.nod32.com . It surely will improve even more.

    AH is (part of) the future. It's for good reasons NOD32 grabbed viruses because of the AH before any other AV had issued signatures for these. That said: fast signature updates are very nice as well ;)

    Well, no one is telling you what to do - it's enterily up to you wether or not to renew your subscription; it's a personal decision. That said: I for one am convinced the majority will like the upcoming version very much.

    You might do him the favor of pointing him to this forum - dslr isn't the NOD32 support forum after all ;).

    No offense intended, but I for one don't think so - on the contrary. As far as I know, the numbers of NOD32 users is growing very, very fast. The new upcoming version most probably will boost the growth even more.

    regards.

    paul
     
  13. sig

    sig Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    716
    Just in general it seems to me that the more an AV does (in terms of scanning and unpacking, etc) the more impact it will have on the system and performance. I wonder if that's partly why KAV 5 Personal reportedly doesn't detect in compressed files in real time. Ironically, NOD's limitations in RT detection in compressed files is one of the things its critics have used to bash NOD LOL. [Although KAV 5 Personal's design may also, intentionally or unitentionally, result in an increasing number of people migrating to KAV 5 Pro since they want more capabilities in their AV. ;) ] It seems that KAV 5 Personal is aimed at the mainstream more so than previous versions. I'm no KAV expert, so I'm just speculating.

    People have asked for an AH option in AMON but that too one suspects will have some impact on performance if AH is active. ESET says it will be available to some extent in AMON. No doubt ESET will try to minimize the performance impact of any increased scanning capabilities, whether performed by AH or in another fashion, since "light and fast" is one of NOD's selling points, but it seems inevitable that there will be some trade off in performance whether those increased capabilities are performed by IMON or AMON. As long as there are options available so that the user can choose for himself how his AV is configured and what features are used (which I hope there will be), the user should be able to decide the tradeoffs for himself, increased scanning/detection capabilities or optimal speed.
     
  14. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    As I was saying above, very little slowdown of a downloading file, no system performance slowdown noticed... and if you don't like it, TURN IT OFF, really very simple :rolleyes:

    From what I can find, there is no "passive mode" option available, see screenshot...

    Cheers :D
     

    Attached Files:

  15. Kobra

    Kobra Registered Member

    Joined:
    May 11, 2004
    Posts:
    129
    That has to be the absolute funniest tray i've seen yet.. The tech guys at the office are gonna love that one when I bring it in.. Anyway, if it slows down downloads, i'd be inclined to disable it.. Lets hope they improve AMON to bring it up to the level I need it so I can re-purchase NOD32.
     
    Last edited: Jun 2, 2004
  16. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Each to their own, and not everyone has your expertise. I enjoy trialing various software to see what it does, and better safe than sorry :D

    Glad I could make you smile :D

    Cheers :D
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.