AMON Confusing Virus Messages

Discussion in 'NOD32 version 2 Forum' started by worldcitizen, Jun 19, 2003.

Thread Status:
Not open for further replies.
  1. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    Hi All,

    I'm a bit confused about AMON. When it catches a virus a red window pops up saying it could not clean the virus but doesn't say what it did do. I tried deleting but got an error message. When I checked AMON it showed 3 viruses. I did a scan but no viruses were found.

    After rebooting, AMON showed no viruses, I went to the virus log and it said the virus had been deleted and an error message of my own manual deletion (because it had already been deleted)

    Can anyone enlighten me why AMON still shows the viruses as active until reboot and why the red box doesn't say the virus has been deleted? It's all so confusing.

    Shouldn't both AMON & the virus alert box both show that the virus has been dealth with. This leads to panic when the virus has already been destroyed and makes me do a scan because AMON doesn't refresh the information until a reboot. If the information showed up properly during real time in both AMON and the virus alert it would save me a scan and a reboot.

    It's very confusing trying to figure it all out. Today this happened with a real virus, the other day the same thing happened with eicar test virus. The information is not refreshed leading the user to believe the virus is still active when it has already been destroyed.

    This can lead new users to think that NOD is ineffective because the information displayed is not updted to reflect what is happening in real time.

    Is there a fix for this?

    Dave
     
  2. Karl_Menshy

    Karl_Menshy Registered Member

    Joined:
    Apr 18, 2003
    Posts:
    135
    Hi,

    the red box is only shown when AMON finds a virus. The action that will be taken depends on your setup in the control center. Normally the virus found box displays a range of option. If you hit the delete button, than AMON deletes the file and the red info box closes, so why do you think this is confusing?

    The number of viruses shown in the control center AMON tab is just an overall statistic, informing you how many viruses have been found during this work session, an not how many are still active. That is why the number is reset only on a reboot.

    Oh and it's always a good idea to do a full system scan in case AMON detected a virus...you can never be too safe and after all NOD is pretty fast ;).

    I hope I understood your problem correctly, if not, let me know.
     
  3. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    Thanks but when I hit the delete button the red box closes & then pops up again. That has always happened. This is what is confusing. If the virus has been deleted then the program should say so and not pop up again and again until I click on close.
    Also if you look in AMON, the message is 'number of files infected'. This ambiguous message doesn't give the user a clue about current status.

    The number of viruses shown in the control center AMON tab is just an overall statistic, informing you how many viruses have been found during this work session, and not how many are still active.

    AMON doesn't say that you - do. AMON only says 'number of files infected' which is not what you are saying. You are saying it is only a statistic of the current session - AMON says it refers to the number of files infected. There is nothing about whether that is now, yesterday, 10 days ago or 5 minutes ago. But if you ask most people what that message means you would probably get similar answers to mine. Why should it say 'infected' if there are no files infected - that's absolutely ridiculous and misleading and it makes me have to scan and then I find nothing. If NOD32 has deleted the virus the virus warning should not keep popping up and AMON should show 0 files as being infected.

    You idea of 'the current session' is nowhere indicated in AMON. In the Help file this is what it says -

    Other useful information available in the main AMON window is the statistics on the total number of Scanned, Infected, and Cleaned files.


    NOD32 is the best I agree but is very user unfriendly when it comes to informing the user what has happened to a virus. I got a virus yesterday. NOD32 automatically deleted it but it didn't say that it had done so. The virus warning popped up prompting me for an action and when I selected 'delete' it popped up an error message (because unknown to me the file had already been deleted) I kept doing this and it kept popping up so I had to just close it. Then I look in AMON and it lists 3 infected files. If there are no current infections it should say so. The user needs to know if his/her pc is infected NOW not what happened 20 minutes ago which can be kept in a log file.

    I personally think that this idea of resetting information after a reboot will loose NOD32 many, many, many customers because people who come across a virus while trying and seeing that NOD32 is still showing infections no matter what they do will think it gets infected. You have a read of some reviews where people have said they got 15 and 20 infections etc. What they were referring to was that they probably tested NOD32 and found that because the 'STATISTICS' still showed the infections then they thought that NOD32 was breached and complained. They most probably uninstalled it and got another anti-virus which I almost did. They didn't stick around to reboot and then find out that the viruses had been intercepted.

    For all NOD32's great qualities this is a major flaw and it is absolutely ridiculous that a reboot is needed to show that viruses have been destroyed.


    Regards

    Dave
     
  4. NewNOD

    NewNOD Guest

    World,

    I sympathize with you. The detection and scanning process seem first rate (how can we really be sure?), but the interface (though it looks good on the surface) and user interaction when viruses are found leave something to be desired. I reported some very strange behavior regarding "repeat" pop-up warnings, deleted files not responding as having been deleted thus giving an error message when manually attempting to delete, etc. when using certain download utilities (see thread I started on 6/14 entitled Command Line Switches, IMON, Archives, DownLoad Utilities (Long).

    What you are likely going to find in my experience is this: if your question is more complex than"how do I register my software?" (which yours is) or your question points up a negative aspect of the software (which yours potentially does), people will either tell you you don't know what you're talking, people will completely reinterpret / misinterpret your question and give you an off-the-wall answer, or peope will mildly acknowledge your problem's existence, but somehow blow it off with, "Well that's really not that big a deal, now is it?"

    Good luck, but every problem that I've either reported or tried to help explain if I had experienced something similar, was met with responses as described in the paragragh above.

    I guess you might get lucky. I hope so. It'll certainly change the trend.
     
  5. Karl_Menshy

    Karl_Menshy Registered Member

    Joined:
    Apr 18, 2003
    Posts:
    135
    Well, actually I was just trying to help.And if I got something wrong I appreciate that worldcitizen has corrected my misunderstandings so maybe I can correct my remarks. NewNOD, to be honest, it is by no means anybody's interest in here to blame any user of misunderstanding the interface or whatever of NOD in order to "defend" NOD, but all we are doing to try is to clarify things and then maybe even give some notes to ESET so that they can improve the program.

    But back to the original questions:
    1) I have never had the problem of AMON popping up twice. Can you tell me on what virus it pops up twice? I will try to reproduce that behaviour then - I have never set AMON to do anything but ask by default, that's maybe why I didn't understand you problem correctly at first.

    2) You are right, that the documentation has to be improved in some places, overall it's just a bit too small. But I guess ESET people will fix the tech problems first and then do a bit more work on the docu. So let's hope for a better docu soon.
     
  6. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    On all instances where I have had viruses detected NOD32 has deleted the virus but AMON still shows that there is an infection on my computer until reboot.

    Because it had already deleted the virus when I clicked on delete I got an error and the virus warning kept popping up until I closed it manually.

    AMON did not show the viruses had been deleted but continued to display x number of infections until I rebooted.

    This also happened with Eicar the test file. AMON doesn't reset it's 'infected files' counter immediately after a virus has been deleted leading the user to think there is still an infection. A scan produced no results but after rebooting the AMON infected file scanner was reset to zero.

    I am only pointing this out because I love this product and I noticed that on some software sites people who had tried NOD32 were saying that NOD32 did not detect viruses because they had done tests and found that NOD32 could not delete the viruses. What really happened was that AMON continued to show the infections although they had been deleted, leading people to think that NOD32 could not or was not finding viruses.

    I'll give you an example. On 1 site a person was saying that 40 or so viruses got through NOD32. What I believe happened was this. They probably downloaded eicar 10 times and NOD32 deleted all of them but in the AMON statistic window they would have seen something like 40 infections & got alarmed. Thus they reported that NOD32 was hopeless and advised others not to buy it. They probably did not reboot and again check AMON. If they did that they would have seen a zero count again for infected files.

    This 'glitch' is causing many people to have misgivings about NOD32's virus prevention abilities which we know are almost perfect.

    AMON's statistics are not in real time and most definitely is downgrading it's quality in the eyes of those testing it. Loss of sales is a result and if it is not fixed people will continue to give it bad reviews because they see 10,20 or 40 infected files displayed in AMON's window which have all been deleted but not reported to the user. They don't bother to reboot and check again because all other anti-virus software show zero viruses immediately after deletion. They get scared, uninstall NOD32 and then bash it at any software site because they have read it's claims to be the best but take notice of the AMON statistics which is still showing infections long after viruses or test viruses have been deleted.

    I hoped to help sales by bringing this matter to the attention of everyone because AMON is in effect damaging the reputation of NOD32 by not accurately reporting that viruses have been deleted until after reboot and people simply won't wait that long but get rid of it instead and then start bashing the best product on the market.

    Regards

    Dave
     
  7. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    Everyone! Look in the NOD32 version 1 forum page 2 HELP! 5 VIRUSES!

    Please note the responses and that in the end I reported that after I got up in the morning there were no more viruses being reported in AMON.

    I was just new and very confused why these 5 viruses were showing up on AMON for hours and hours. In the end a reboot solved everything but did anyone know that?? I wasted time doing long scans as well as an online scan and changing all sorts of configurations as well but no-one seemed to have any idea that only a reboot was required.

    Dave
     
  8. jan

    jan Former Eset Moderator

    Joined:
    Oct 25, 2002
    Posts:
    804
    Hi world,

    thanks for your comments - we'll check them deeper and put them on the wishlist.

    All the best,

    jan
     
  9. mccracky

    mccracky Registered Member

    Joined:
    Dec 17, 2002
    Posts:
    33
    Location:
    Quito, Ecuador
    I can't rightly recall right now, but I seem to remember that we had some viruses that kept the AMON screen poping up. I think it had to do with a memory resident virus and when AMON deleted the disk file, the memory resident virus kept trying to create the disk file again. This was solved by getting rid of the memory resident portion first.
     
  10. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    Thanks Jan,

    This happened twice to me so far. Once was with eicar & the other with a trojanloader called scizzor or something like that. Both times the file was deleted but the warning kept popping up and the viruses were still shown in AMON until I rebooted.

    Dave
     
Thread Status:
Not open for further replies.