nod32 and DriveCrypt from SecurStar

Discussion in 'NOD32 version 2 Forum' started by cdysthe, Jan 23, 2005.

Thread Status:
Not open for further replies.
  1. cdysthe

    cdysthe Registered Member

    Joined:
    Mar 6, 2004
    Posts:
    70
    Location:
    Austin, TX and Oslo, Norway
    Hi,

    I have my entire disk encrypted with DriveCrypt from SecurStar (required by my employer). However, nod32 thinks I have a virus:

    "MBR sector of the 1. physical disk contains probably unknown TSR.BOOT virus [7]."

    Is there a way to let nod32 know that DriveCrypt isn't a virus?
     
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    With this issue can you please send an email to support@nod32.com and place a link to this thread. If you do not hear from Eset within 3 days (allows for weekends), please advise us here...

    We would appreciate if you could keep us in the loop with your progress, as we all learn this way…

    Cheers :D
     
  3. cdysthe

    cdysthe Registered Member

    Joined:
    Mar 6, 2004
    Posts:
    70
    Location:
    Austin, TX and Oslo, Norway
    Will do. Thanks! :)
     
  4. Bandicoot

    Bandicoot Eset Staff

    Joined:
    Mar 23, 2004
    Posts:
    297
    Location:
    California
    Hello cdysthe,

    I suggest you go to the On-Demand Scanner and on the 'Setup' tab, un-check 'Boot sectors'. In the meantime, Eset will install this application and try to replicate the problem to find a fix.

    Bandicoot. :)
     
    Last edited: Jan 24, 2005
  5. cdysthe

    cdysthe Registered Member

    Joined:
    Mar 6, 2004
    Posts:
    70
    Location:
    Austin, TX and Oslo, Norway
    I will do that and await a solution. Please note that you need to add the "BootAuth" option for the drive you install DriveCrypt on to replicate my setup. Thank you for your timely response! :)
     
  6. Bandicoot

    Bandicoot Eset Staff

    Joined:
    Mar 23, 2004
    Posts:
    297
    Location:
    California
    Hello cdysthe,

    OK, we've checked it out and you're absolutely right. DriveCrypt is being shown in the scanner as a false positive. So we've sent the relevant file information to our analysts and a fix will be procured ASAP.

    I'll post again as soon as it's ready.

    Bandicoot. :D
     
  7. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,376
    This false positive has been fixed in update 1.983. Should your NOD32 still report it, feel free to contact the NOD32 technical support at support@eset.com.
     
  8. cdysthe

    cdysthe Registered Member

    Joined:
    Mar 6, 2004
    Posts:
    70
    Location:
    Austin, TX and Oslo, Norway
    After the update the false positive is gone. Thanks! :)
     
Thread Status:
Not open for further replies.