Extermely slow NOD32 scan of certain Word documents

Discussion in 'ESET NOD32 Antivirus' started by Saul, Sep 23, 2009.

Thread Status:
Not open for further replies.
  1. Saul

    Saul Registered Member

    Joined:
    Sep 23, 2009
    Posts:
    3
    My company uses ESET NOD32 Antivirus 4, under Windows XP.
    I have a problem with documents I receive from a single source (my law firm). Opening any Word document (*.doc) from this source is annoyingly slow (> a few seconds), even though the documents are small (a few 10's-100's of kbytes). While waiting for the document to open, I see the message "running virus scan" at the bottom of my screen, which I assume is generated by NOD32.
    When I use the "select all" feature of Word to make a new copy of the document (with all the same visible text), the new document opens much faster (at least 10x faster). I assume there is something hidden in the Word file (template ?) that makes NOD32 slow. The difference in file size ("original file" - "saved from select all") is only 7 kByte. Is there any workaround for this problem, other than re-saving every document I get from this source in a 2nd version? I have spoken to the IT manager at my law firm and he denies that they add anything special to their Word files.

    Saul
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    There's a bug in Office 2007 which causes documents to open slowly even if DMON is only registered in the system. If disabling DMON helps, start Windows in safe mode and rename the file ekrnDmon.dll in the ESET install folder to prevent DMON from being loaded on startup.
     
  3. Saul

    Saul Registered Member

    Joined:
    Sep 23, 2009
    Posts:
    3
    Thanks, but I forgot to mention, I use Office 2003.
    Saul
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Could you confirm or deny that disabling DMON makes a difference?
     
  5. Saul

    Saul Registered Member

    Joined:
    Sep 23, 2009
    Posts:
    3
    Will do. However, it will take a few days until our IT person comes around (we're a startup with IT outsourced) - as far as I can tell, you need the administrator password to disable document protection (I assume that's what you mean by disabling DMON).
     
  6. Brambb

    Brambb Registered Member

    Joined:
    Sep 25, 2006
    Posts:
    411
    Location:
    The Netherlands
    If you are able to change settings in the NOD32 client you can disable DMON (document protection module), so you can test if it makes a difference. You don't need to know the administrator password of the computer if you have the password to unlock ESET configuration (if set, of course).

    See screenshot below:
    http://dl.getdropbox.com/u/349356/ESETNOD32dmon.png
    - untick 'Enable Document protection'
     
Thread Status:
Not open for further replies.