Intermittent disabling of IMON by PestPatrol

Discussion in 'NOD32 version 2 Forum' started by billaku, Dec 13, 2005.

Thread Status:
Not open for further replies.
  1. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    Ok - downloaded and installed:


    eTrust PestPatrol Versions Report
    This report was generated on: 12/13/2005-9:12:01 PM

    eTrust PestPatrol Version: 5. 0. 1. 6 (eTrust EZ Licensing)

    SDK Version: 5.6.7.9
    PPFILE.DAT Version: 12/13/2005-5:29:18 PM
    PPINFO.DAT Version: 12/13/2005-5:29:18 PM
    PPLOC.DAT Version: 12/13/2005-5:29:18 PM


    First tried setting a delay and IMON did not stay active after every reboot - the few times I tried - could work 100% - but decided to try the PP exclusion method.



    Made these PestPatrol settings:


    [v] Start Active Protection when my computer starts


    Exclusions

    Add File/Folder

    C:\WINDOWS\system32\imon.dll -- where imon.dll is on my system

    [v] C:\WINDOWS\system32\imon.dll -- clicked in the box to check


    Save Report

    Close



    On my WinXP SP2, rebooted 3 times and IMON remained active after each.


    Probably feel more confident after 21, 31 reboots.

    Right now, PestPatrol ActiveProtection icon shows in SysTray ~ 4 sec. before the NOD32 icon.
    Don't know how accurate the icons SysTray appearance is as far as actual load sequence, timing.
    Anyway - I have no delay set.


    edit: For '?' in title due to mata7's following post.
    - - - - Uninstalled PP - will reinstall this evening and see if can use due to licensing requirement - cancelled, 'terminated' license - - - - if then can, will try the PP udpdate and see what happens here.
     
    Last edited: Dec 14, 2005
  2. mata7

    mata7 Registered Member

    Joined:
    Nov 8, 2005
    Posts:
    635
    Location:
    Mississauga, Canada
    Re: IMON Not Disabled when Excluded in PestPatrol

    i fallow you guide and now IMON Don't get Disabled, but if you update PPatrol IMON Just stop working "at least for me" IMON Will stay on the last scan task "let say scan google.com" and then i wont scan nothing more, i have to stooped the reactivate again

    please check if this happen to you

    btw Thanks nice guide

    this is what i mean after i update PPatrol imon stay like this and dont scan any more site

    http://img.photobucket.com/albums/v330/MATA7/1.jpg
     
    Last edited: Dec 14, 2005
  3. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    Re: IMON Not Disabled when Excluded in PestPatrol ?

    PP reinstalled.

    During install, PP updates all its updateable files, so files currently up-to-date.

    What I get in IMON when check for PP updates:
    /eTrustPPStd/updates/ezlic/en/ppmaster.dat


    Your graphic shows:
    /eTrustPPStd/updates/ezlic/en/cavres.dll

    I don't have cavres.dll on my computer.

    Looks like it is a eTrust EZ Antivirus file:
    http://www.911cd.net/forums/index.php?showtopic=9715
    http://www.tomcoyote.org/forums/lofiversion/index.php/t46468.html
    http://www.techsupportforum.com/resolved-hjt-threads/62657-trouble-accessing-internet-help.html


    What you stated:
    Were some files updated?
    Or checked for updates and all files up-to-date?

    Would PestPatrol update eTrust EZ Antivirus cavres.dll?
    Is that why /eTrustPPStd/updates/ezlic/en/cavres.dll is showing in the graphic?


    When I check for updates and get
    'eTrust PestPatrol is up-to-date' in PestPatrol
    and
    /eTrustPPStd/updates/ezlic/en/ppmaster.dat in IMON
    IMON stays active.

    If I go to this forum, it shows:
    https://www.wilderssecurity.com/favicon.ico
    Then if I go to this thread it shows:
    https://www.wilderssecurity.com/showthread.php
    and the scanned file count in IMON keeps increasing.


    So, right now:

    1. Wondering about cavres.dll
    Guess you have eTrust EZ Antivirus?
    Or cavres.dll still on sys from an install.

    Wonder what would happen if you would also exclude cavres.dll in PP?

    2. Will have to wait until there is a PP update for my PP files to see if IMON stays active after such an update.


    On my sys:
    imon.dll still excluded in PP. IMON still stays active after reboots with
    [v] Start Active Protection when my computer starts (checked in PP Active Protection settings)
     
  4. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    Got a PestPatrol update: ppclean.exe, etc.

    Entry in IMON immediately after: /PPSDK/Components/ppsrindex.dat

    IMON stayed active.


    Did note yesterday though, IMON not active *every* time after reboot.

    IMON active today after computer on, through the update.


    Wonder if Eset could consult with ComputerAssociates on the intermittent disabling of IMON by PestPatrol even with imon.dll excluded in PestPatrol?


    Upon some reboots, IMON disabled. Now experiencing this from time to time.
    Also so far, once re-enable IMON, it stays enabled after additional reboots.

    So far, seems like it is enabled when computer first turned on.
    So far, seems to happen once after ~ first computer reboot.
    Then, after re-enable again, stays enabled until ~ first computer reboot, program install, similar.
    Seems like what is going on, sequences.
     
    Last edited: Dec 16, 2005
  5. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Re: IMON Not Disabled when Excluded in PestPatrol

    Hi billaku, as your new thread was a basic continuation of this thread I have merged the 2 together.

    Cheers

    Blackspear.
     
  6. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    Re: IMON Not Disabled when Excluded in PestPatrol

    PM sent requesting change in title of this thread to:
    Intermittent disabling of IMON by PestPatrol

    - as it now turns out that is what is happening even with imon.dll excluded in PestPatrol - for me upon computer startup or reboot.
     
  7. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Re: IMON Not Disabled when Excluded in PestPatrol

    Thread title changed.

    I have asked for someone from Eset to take a look at this thread.

    Cheers :D
     
  8. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    PestPatrol updates again today.

    After PP updates, IMON remained, still enabled.


    So, 2 out of 2 PP updates did not dis-enable IMON.


    Also, when turned on computer, IMON enbabled.
    After PP update, rebooted once, IMON still enabled.
    So?
    HELP CA! (Computer Associates) - to keep IMON enabled - PP not interfere with IMON.
     
  9. mata7

    mata7 Registered Member

    Joined:
    Nov 8, 2005
    Posts:
    635
    Location:
    Mississauga, Canada
    nice to see that work for you, i got no luck and i only use one AV nod32 And i got same version of PPatrol that u got
     
  10. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    Well, I still get IMON disabled from time-to-time when computer starts up, reboots.

    Do not see that NOD32 has option to start Minimized, not start Minimized.

    Would be nice if had option to startup with NOD32 'Not Minimized'.

    Then would see if IMON active or not, not have to remember to check - until ESET can clearup with ComputerAssociates, hopefullly.
     
  11. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Well...my oppinion is that is useless to have PestPatrol together with NOD32... NOD has a good protection against all kind of other malwares (dialers, adwares, spywares, etc) :)
     
  12. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    NOD32 can

    NOD32 may have "... good protection against all kind of other malwares (dialers, adwares, spywares, etc)", but not total:

    PestPatrol detected 'CWS.LoadAdv.400' a few times before finally, evidentally cleaned from system for now.
    This is supposedly a 'Hijacker'.

    NOD32 didn't indicate anything re 'CWS.LoadAdv.400' in same time frame.

    Same re 'MidAddle'. PestPatrol yes, NOD32 no: 'Adware'.

    I continually check that IMON and NOD32 other protections enabled - for now - 'til maybe 'issue' is resolved.
     
  13. mata7

    mata7 Registered Member

    Joined:
    Nov 8, 2005
    Posts:
    635
    Location:
    Mississauga, Canada
    Re: NOD32 can

    but How this can be resolved if no1 from Eset is paying attention to this problem, i mean look how many day this thread have and no1 cares, i don't like that :(
     
  14. billaku

    billaku Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    67
    Location:
    Texas Central Coast, US
    Re: NOD32 can

    Hi mata7,

    I really think it is more a CA, ComputerAssociates, issue: PestPatrol interfering with NOD32 - no?

    *If* something like that is the case, that would involve Eset getting with big ol CA and request they address - again, no?

    In either case, imagine would take a bit of time.
    Would be nice to get updates from time to time - even if 'working on it', 'still working on it'.

    Have not heard if 'working on it', though - your point.

    -- Bill
     
  15. Bandicoot

    Bandicoot Eset Staff

    Joined:
    Mar 23, 2004
    Posts:
    297
    Location:
    California
    This is an issue of a CA product disabling security related software. This is not something that "reasonably well designed" security software should be doing. The entire point of installing security software is to enhance security, not to reduce it. Currently no anti-spyware/anti-adware products detect all threats; there are some threats that some products miss and
    others detect. If you check http://www.westcoastlabs.org/cm-av-list.asp?Cat_ID=8 you will find that CA
    has not even achieved Checkmark Certification for spyware detection... but NOD32 has.

    Our developers are looking into how to prevent this behavior from happening, but as with all malicious software, if a user chooses to install it then it is possible to defeat most any protective measures.

    The recommended solution is to demand that CA either fix the problem or refund your money for the product. There are free solutions that do a better
    job of augmenting protection instead of decreasing it: The MS anti-spyware beta, LavaSoft Adaware, and Spybot S & D are all viable replacements for a product that offers a net decrease in security. I would fairly miffed with CA, to say the least, if they did this to my computer.

    Bandicoot.
     
  16. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    You're absolutely right Bandicot! I never liked PestPatrol.....giving a lot of false alarms and not so easy to use and configure.
     
  17. halcyon

    halcyon Registered Member

    Joined:
    May 14, 2003
    Posts:
    373
    What's the 411 on this? I'm still getting Imon disabled by PP update and PP update not working ("update cancelled due to user action or error!").
     
  18. RAV

    RAV Registered Member

    Joined:
    Jan 8, 2005
    Posts:
    70
  19. NOD32 user

    NOD32 user Registered Member

    Joined:
    Jan 23, 2005
    Posts:
    1,766
    Location:
    Australia
    As you can see clearly above, Bandicoot made his post on the 24th of December 2005. So far as it is possible for me to tell, the earliest checkmark certification for CA PP was not until late January 2006.

    I have never use CA's PP and so have no objective opinion of it to offer but would say that for as long as the things Bandicoot based his comments on remain true, I will agree with him as to his suggested recourse.

    And I do like NOD32 :D

    Cheers :)
     
Thread Status:
Not open for further replies.