IMON and streaming media

Discussion in 'NOD32 version 2 Forum' started by chuckenheimer, Nov 28, 2004.

Thread Status:
Not open for further replies.
  1. chuckenheimer

    chuckenheimer Registered Member

    Joined:
    May 11, 2004
    Posts:
    46
    Location:
    Houston, Texas
    Well, this is the first time that I've run into IMON and streaming media where the green, downward-rolling arrow Taskbar icon has appeared. Nice feature, but it now raises a question for me.

    When I right-click on the icon, then the semi-transparent NOD32 dialog box appears with the d/l speed / progress indicator. When I right-click on this dialog box I get the option to Terminate the d/l, switch to Passive mode or Play. I'm somewhat confused here in that when I click on Play then I hear the audio but I'm not sure where to allow NOD32 to automatically allow this media to play without intervention.

    Can someone shed a little light on this for me please? Thanks!
     
  2. chuckenheimer

    chuckenheimer Registered Member

    Joined:
    May 11, 2004
    Posts:
    46
    Location:
    Houston, Texas
    I'm not in the habit of responding to my own emails but I'm surprised not to have received any reply. Why is this?
     
  3. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    You have to exclude programs that use media streaming (WinAMP,iTunes and other media players). Technically streams cannot contain viral code so its safe to exclude it from IMON HTTP Scanner. You'll find this excluding feature in IMON module under HTTP tab. Some streaming programs might not work properly if you don't exclude them.
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Basicly it's not a good practice to exclude anything from scanning. In the case of streaming media, it's crucial to have media players set to higher compatibility mode in the HTTP scanner compatibility setup.
     
  5. chuckenheimer

    chuckenheimer Registered Member

    Joined:
    May 11, 2004
    Posts:
    46
    Location:
    Houston, Texas
    Marcos,

    Thanks for the information. I've made the change to iTunes.exe as suggested. I'll see what happens next.

    This brings up an issue though about how to remove references for software removed from your system but still referenced there in NOD32. Is it possible?

    I forgot to mention that my WMP 9.0 doesn't appear to have the same problem as does iTunes. Does this make sense?
     
    Last edited: Dec 1, 2004
  6. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Not possible without hacking the registry at this point in time. It has been discussed in a previous thread somewhere and added to post number 9 under Technical in this thread: https://www.wilderssecurity.com/showthread.php?t=49674&page=1

    Hope this helps...

    Cheers :D
     
  7. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Marcos,i can guarantee you that you can't get infected from streaming media.
    HTTP scanner just couses lots of troubles if its checking continous stream of data. The only thing that is not scanned on exclusion is this streamed data for a very specific program. AMON is still fully active and IMON HTTP is also checking all other HTTP streams.
     
  8. AJohn

    AJohn Registered Member

    Joined:
    Sep 29, 2004
    Posts:
    935
    Back in the day Winamp had a bug which allowed any music files (including streams) to delete files.
     
  9. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    That was vulnerability and not viral stream data. Thats a big difference.
     
  10. AJohn

    AJohn Registered Member

    Joined:
    Sep 29, 2004
    Posts:
    935
    That is true, but a friend of mine used to have a program that he could use to exploit the bug in just about any file read by WinAmp. I was just using that as an example that such things can be possible.
     
  11. chuckenheimer

    chuckenheimer Registered Member

    Joined:
    May 11, 2004
    Posts:
    46
    Location:
    Houston, Texas
    Blackspear,

    Yeah, I tried to read that thread before. I was overwhelmed with the functionality of NOD32, much less the requests for more. Actually I was a bit embarassed by just how little I know but more impressed with what NOD32 can do with the little bit of configuring that I've done so far.

    Thanks again for being around.
     
  12. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    My pleasure, don't be embarrassed, or overwhelmed, take one step at a time and ask as many questions as you like, that's why we're here.

    Cheers :D
     
  13. karakarota

    karakarota Registered Member

    Joined:
    Sep 12, 2004
    Posts:
    11
    Marcos thanks a lot! You have just solved an issue between Firefox and my favourite streaming radio! I had stupidly set "everything Firefox" to Higher Efficiency (including NSPlayer), then forgotten that, then begun to have trouble with my radio, then cursed NODDY.

    I'm gonna feed him with a couple o' nasty Sassers for forgiveness... :D

    Ciao

    K
     
  14. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Good to see, and thank you for sharing, it helps us all to learn...

    Cheers :D
     
  15. Ianez

    Ianez Guest

    still on Imon (mainly java issues)

    Hi there,
    I have Nod32 installed from a few days,
    last version, all updated...
    I run with sp2, explorer 6, firefox 1.0, outpost 2.5: all UPDATED
    I' ve two kind of problem with Imon:

    >> as someone else posted, can't load .class streaming video (meteo webcams for example), I can see them only disabling port 8080 in the http port field in Imon setup. Anyway after a while the browser totally close (both expl and firefox). And I have reports like that https://www.wilderssecurity.com/showthread.php?t=46060&highlight=java
    I've the last java runtime 1.42.06 and never had such problem before Nod Installation
    With Imon Disabled I can see everything but I have crashes
    With Imon Stopped I can do everything and nothing crash

    >> Imon causes also connection to hang (both browsers) sometimes and I have to close all windows and restart browser (very boring)
    With Imon Disabled I can see everything but I have hangs
    With Imon Stopped I can do everything and nothing hang

    No answers from Nod support.
    Any suggestion is welcome.
    I've decided to totally stop Imon, I think Esent should find a solution to all these problem in short time.

    Cheers

    Ian
     
  16. Bandicoot

    Bandicoot Eset Staff

    Joined:
    Mar 23, 2004
    Posts:
    297
    Location:
    California
    Hello Chuckenheimer,

    Thanks for sending some screenshots and a detailed explanation of what was happening to support@nod32.com. It appears that iTunes is downloading something with the name "play" (actually, it's a file provided by a script named "play"). It has nothing to do with playback functionality. This menu is shown because you have (or had) set up iTunes to Active http scanning mode, which may cause a conflict with streaming media, so it's recommended to keep media players in Passive http mode.

    Bandicoot.
     
  17. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Thank you Mr Coot, as helpful as ever, any results with Ianez similar issue?

    Cheers :D
     
  18. Ianez

    Ianez Registered Member

    Joined:
    Dec 2, 2004
    Posts:
    5
    Hi Blackspear,
    my 3d has been moved but still no answers concerning it...
    The problem is persisting and only disabling Imon I can use java without crash
    :'(

    ciao

    Ian
     
  19. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Mr Coot has just gone away on a business trip, I believe Marcos has taken over this issue while he is away. You will find Marcos exceedingly knowledgeable and I'm sure he will have you sorted out in a short while.

    Cheers :D
     
Thread Status:
Not open for further replies.