nod32 module won't show results after scanning?

I installed nod32 on a new machine and configured etc...rebooted... now when I go to the nod32 module and select c drive and scan... it scans alright, but then when done, before you have a chance to see results, it simply closes and your back to the main nod32 screen?

If you go to scan logs it shows it scanned, but also show "0" files scanned?

I sat there and watched it scan all the files?

anyone else have this problem?

 

What happens if you goto My Computer, and right click on C: drive and goto NOD32 Anti-Virus System?

 

I uninstalled it and am reinstalling..... I'm starting to wonder if I corrupted one of the scan engines by hitting "update now" when it was already trying to update itself?

Ill let you know!

 

Bummer.. same thing!!! It still stops after scanning without showing the results.
I do have "scrolling" enabled, but not for all files.

I did rightclick on c drive in my computer and scan that way... it made no difference.... it behaves the same way.

One interesting fact... on one machine that does fine... when you go into the nod32 module , the local drives and network drives is not ticked, but my C drive is!

However on the computer thats giving me fits, you cannot untick the C drive without it also unticking the local drive box?
I don't know if thats any relation at all....

 

What version of Windows?

Can you run a scan in Safe Mode with Nod32 fully tweaked to the max and then please and tell us the results.

Cheers

 

winxp pro with sp2... and yes.. Ill try that too...

I do have "fast.exe" running in task manager on the problem machine.

 

i did the same thing again..... right before it ends... it scrolls some lines too fast to see, yet slower than when not in safe mode.. I still can't see then and the it simply closes and leaves you with your safe mode desktop.

Maybe Ill try cleaning the registry on this machine to see if that helps

 

Can you try following the steps found in post number 2 here:

https://www.wilderssecurity.com/showthread.php?t=47830

I think you have an infected machine.

Cheers

 

Well you left quite a list...... There appears to be nothing working wrong other than this....
Here is where I am at so far.....
I have already ran the winsock fix.. because I don't trust how mcafee's leaves it after their unistall.
First of all .. I completely uninstalled and reinstalled nod32.... same results..
1. I ran spybot and updated and cleaned all the temp directories and internet files as well as ran a scan again... "it was already installed on this machine" set to scan daily.
2. I ran regmechanic and cleaned any findings and rebooted.
3. I also installed, updated and ran pestpatrol..... it only found one unknown trogan... I deleted it .. rescanned and found nothing.
4. So I attempted to rescan with nod set the same way as before.....it still responded the same. THe scan log showed the scan but 0 files scanned.
5. Then I set it to clean and in the right column I set it to delete and quaranteen.... I reran nod32 again..........It still scans then then closes.. denying it actually scanned any files.
6. NOW I went to safemode again and reran nod32 with the clean function... that doesn't seem to do anything different.
7. Now still in safe mode, attempted to open nod32 control panel... I get an error.... "error occured during communication with nod32 kernel service "nod32kui" I don't know if this is normal while in safe mode... but nevertheless I am running a scan again with clean enabled to delete and quaranteen again.

 

interesting... this time I am able to see the results... "while still in safe mode"... I did notice some driver.cab files were corrupted too... I don't think that is the issue right now.....
I will now go into normal mode and see what happens....

 

It is pretty comprehensive, tackling most problems out there.

Can you download and run Regcleaner 4.3.0.780 from here: http://www.majorgeeks.com/download460.html and remove any entries left by McAfee and any other Antivirus remnants.

You can not open the Control Panel while in Safe Mode. In order to run Nod32, you have to go to Start> All Programs> Eset>

This is an oddball, if you are still having this issue after doing the above, I’ll send off an email to Eset and see what they can come up with.

Cheers

 

you may have something about the remnant av.... mcafee leaves a ton of crap..... Ill run reghealer on advanced mode...... if that won't get it all out nothing will..... After running regmechanic on my machine.... reghealer found 2800 more entries!
Ill let you know if I figure anything out..

 

Thanks, appreciate it, we all learn that way

Regcleaner is pretty good as well.

Cheers

 

humm.. well I'm stumped so far.... I cleaned over 2100 entries with reghealer and it still does the same..... there must be something about this system....
NOw I have to decide if nod will work on this system or whether I must reinstall mcafee?..... yuk..

 

try a windows repair maybe

 

Does it happen also if you leave only Files selected in the Objects to diagnose section in the on-demand scanner setup?

 

Nah, we'll get it on there, haven't seen a system that we can't yet...

Can you send me a Hijack This Log, my email is in my profile, bottom left corner.

Cheers

 

You know... maybe you can share what your on to... because when I do as you suggest "only scanning files" it works!.... even in normal "non-safe"mode!

I went to taskmanager and turned off everything that would turn off.. except for nod stuff and explorer and it still does it... so far the only scenario where it doesn't is when I go into safe mode "its done it there too, but it didn't once", and when I only scan for files?

Another peculiar thing this computer does is why you are installing something... it like to bounce to the task bar and disappear "whatever you are installing"... maybe that has something to do, I don't know?

but I appreciate you guys loving a challenge.... This is a computer I'm tuning up for a friend and it works great except the these issues.

I also ran the progs blackspear suggested and scanned for cws stuff and even bad jpg's along with the betterinternet stuff.... came up clean...

But if you can tell me whats up with the files only thing I would appreciate it!!!

 

Sorry Blackspear.. I also sent you a pm... but I cannot figure how to send you an email... I did as you suggested and all I got was "blackspear AT wilderssecurity DOT com".... I don't know how to turn that into an email?....
it says your not accepting emails either...

I was trying to send you the highjack log you asked for.
Ill send you another pm.

But here is a copy and paste of the highjack log:
Logfile of HijackThis v1.98.2
~~snip~~ HJT Log removed - Blackspear

 

Hi Windstrings, received and replied to your PM.

Regarding the email, replace AT with @ and DOT with "." so it looks like a normail email address. I display it this way so the address will not be harvested...

Cheers

 

Ah.. yu prty smaaat!

I tried again to run it.... this time.. all I did is "unticked" the
archieves...and it also worked!!!!.....
I wasn't sure as of yet if its the fact that as long as "all" of them aren't
ticked they work.... or if its specifically the archieves being ticked thats
the problem.

Anyway... So next I did run it again with packers unticked... it messed up.... it appears that unticking the archieves is the secret to getting it to work....
I ran chkdsk also and it was good because I had ran it two days ago.

 

I have sent a PM to Marcos asking for this thread to be followed up, it will be interesting to see what he has to say, as this is one very odd issue, and it will be good to see the outcome...

By the way, your HJT Log is clean, you can remove O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)

Cheers

 

i guess that toolbar is an old mcafee thing??

anyway...for the sake of anyone else who may encounter this problem... I am making most of my coorespondence with nod32 availiable to the forum...

Send#1
just so you know... as I watch the nod32scan.. towards the last.. I do see
that there are reports of some c:\windows\driver cache\i386\cab files that
are corrupted.
I did run it again with packers unticked... it messed up.... it appears that
unticking the archieves is the secret to getting it to work....
I ran chkdsk also and it was good because I had ran it two days ago.

Send #2
I did run it again with packers unticked... it messed up.... it
>> appears that unticking the archieves is the secret to getting it to
>> work....
>> I ran chkdsk also and it was good because I had ran it two days ago

questions from nod:
1.) Is it continually hanging on a particular file or files?
2.) Are the resources being used by NOD32 spinking during the scan of
these archives?
3.) Would you be able to overwrite the corrupted ones from the i386
folder on your disk?
4.) Does NOD32 list the individual file or just the cab?

Send#3
my answers:
1. I can't tell if its hanging on a file... it just stops when the progress bar is at the end... I'm assuming its done... but I won't tell you the report... almost like it was cancelled?
2. the cpu usage bounces from 23 to 100% during the scan.
3. If I could see a report to see which files it was reporting as bad... I could do that..... when you hit the stop button... all is gone.
HOWEVER... when I view the successful ones... I see not corrupted cab files because those archieves were excluded..... AND.. when I watch it scan... I do get a glimpse that it is scanning the corrupted cab files when it all stops....
Note that the only time I could see what those files actaully were at all was when I was in safe mode.... while in normal mode, it scans much too fast!
4. not sure what you mean.... it list the pathway to the corrupted cab file and the file name itself if I remember right.
Maybe if I can find those cab files and replace them that will do the trick!

 

from nod:
Just thinking. How about opening the cabs, and copying the files to a
folder on your desk top. They won't be compressed and maybe NOD32 will
be able to see and report which individual file is corrupted. Think
it's worth a shot? I'm going to see if I can find some third party
software that would also do that.
my response:
what Im doing right now is I copied those cab files from my computer to a temp dir on the affected computer.
then I right click on the whole i386 directory and scan the good ones first I sent that are in the temp dir.
then scan the ones that are bad.
there are only 3 files..... ie: driver.cab, sp1.cab, and sp2 cab

 

just for fun I decided to individually scan those files.... its the driver.cab that is bad.... do I tried to extract it to a temp dir and even winzip responds the same way that nod does when it is extracted.... winzip closes.... it does get a few files but then close, crashes or whatever it does... nevertheless I can't see the individual bad file... unless I select each file individually and try to extract it.... which when I did that.... I found that the first file that was bad was a .wav file.
So I just deleted the whole driver.cab and replaced it...
now what puzzles me... if I right click on the i386 dir and scan with nod32, it will scan just fine and even give me a report where it wouldn't before with the bad driver.cab present..
but If I open the nod32 module and scan the whole c drive... it still stops prematurely...... maybe theres another file corrupted somewhere else?