LnS and NOD32

Discussion in 'LnS English Forum' started by amoise, Nov 25, 2003.

Thread Status:
Not open for further replies.
  1. amoise

    amoise Registered Member

    Joined:
    Oct 19, 2002
    Posts:
    10
    Location:
    ITALY
    Is it possible that LnS is interfering with the automatic update of NOD32?
    I'm very basic with packet filtering because I've always used program filtering so I'm in need of help. :'(
    Thanks
     
  2. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    Hey

    Verify NOD32KRN.EXE is authorized to Connect in Application Filtering List.

    Verify there is an Authorizing rule for Outgoing initiating Connections to remote machines via port 80tcp, “TCP : Authorize most common Internet services” rule found in EnhancedRulesSet.rls and “TCP : Allow” rule found in Phant0m``s Rule-set should all you need.
     
  3. amoise

    amoise Registered Member

    Joined:
    Oct 19, 2002
    Posts:
    10
    Location:
    ITALY
    Yes NOD32 is authorized and Yes I have the TCP authorize most common Internet service, but under this one I have
    TCP block everything else (I'm translating).
    Could be this the problem?
    I can only update NOD32 via the manual update, the automatic one give me an error connecting to the server.
    Thanks
     
  4. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    Hey amoise

    NOD32 Updating System doesn’t require to act as server, therefore no additional rules required to be placed before “TCP : Block incoming connections” rule. “TCP : Authorize most common Internet services” rule found in EnhancedRulesSet.rls and “TCP : Allow” rule found in Phant0m``s Rule-set is the only thing you need.

    * Have you tried while Look ‘n’ Stop wasn’t running?
    * What version of NOD32?
    * What Version of Windows?
    * What type of Connection?
     
  5. amoise

    amoise Registered Member

    Joined:
    Oct 19, 2002
    Posts:
    10
    Location:
    ITALY
    * I was using Zonealarm without problems in automatic update
    * NOD32 version 2
    * Windows XP Home
    * ISDN Connection
     
  6. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    Hey amoise

    My first question is still unanswered.

    * Are you using EnhancedRulesSet.rls?
    * If you using EnhancedRulesSet.rls, has it been modified?

    If you like you may E-mail the rule-set to me, Phant0m@wilderssecurity.info
     
  7. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    Hey

    I’ve received your E-mail with the rule-set attached, appears you was using StandardRulesSet.rls with few additional rules. Nothing there to explain difficulties with NOD32 Automatic Updating, whatever it is I don’t see this being Firewall related. Can you send me Look ‘n’ Stop Log files anyways?
     
  8. amoise

    amoise Registered Member

    Joined:
    Oct 19, 2002
    Posts:
    10
    Location:
    ITALY
    You are right. I was using the standard one with some minor modifications.
    I've sended the ruleset via e-mail
    Thanks
     
  9. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    Few more questions;

    * Are you using any Local Proxy server Software? If so please give the name…
    * In “Setup of Automatic Update” Dialog, what server you using www.nod32.com?
    * In "Type of update" Dialog is "Notify before downloading virus signature database update" checked?
    * In "Advanced setup" for Internet Connection section, is "LAN / fixed line" checked?
     
  10. amoise

    amoise Registered Member

    Joined:
    Oct 19, 2002
    Posts:
    10
    Location:
    ITALY
    *No
    * automatic choice
    * Notify before downloading virus signature database update is unchecked
    * yes, is checked LAN/fixed line
     
  11. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    Hey

    OK, try specifying www.nod32.com. Lets see if this helps... ;)
     
  12. amoise

    amoise Registered Member

    Joined:
    Oct 19, 2002
    Posts:
    10
    Location:
    ITALY
    I'll give it a try and I'll let you know
    Thank for your help :D
     
  13. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
    Not a prob, anytime! :)
     
  14. amoise

    amoise Registered Member

    Joined:
    Oct 19, 2002
    Posts:
    10
    Location:
    ITALY
    It worked !! :D

    I made two change. Loaded Enhanced Rule set and chosed www.nod32.com and the automatic download worked.
    Now the question is .... which one made the difference ?
    Bah who care. :D
     
  15. MickeyTheMan

    MickeyTheMan Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    1,016
    I believe it's the server since as long as NOD32KRN.EXE is authorized to Connect in Application Filtering List, there is nothing else to interfere with the download in LNS
     
  16. Phant0m

    Phant0m Registered Member

    Joined:
    Jun 7, 2003
    Posts:
    3,684
    Location:
    Canada
Thread Status:
Not open for further replies.