NOD32 v3.650 fails Microsoft updates

Discussion in 'ESET NOD32 Antivirus' started by twl845, May 10, 2008.

Thread Status:
Not open for further replies.
  1. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    I have not been able to receive Microsoft updates since the beginning of April. They fail. Today I attempted to install XP sp3 and it failed. Checking with Microsoft support, it was suggested that the problem could either be my FW or AV not permitting changes. I first shut down my FW, and tried again, but that wasn't it. I then disabled my NOD32 v3.650, and tried to do the update and it was successful. Checking when I upgraded Nod to v3.650, I discovered it was April 4th, exactly when the Microsoft updates started failing.
    What do I have to disable or what setting do I have to change in NOD to correct this? Thanks. :)
     
  2. ASpace

    ASpace Guest

    Very strange . I would say that svchost.exe is blocked and that is why you can't get your updates.

    I have no such problem with computers running XP or Vista and never seen any problem with this.

    You can try to exclude svchost.exe from communication so that its traffic is not scanned at all. Please , check your firewall again :)
     

    Attached Files:

    • try.png
      try.png
      File size:
      36.1 KB
      Views:
      1,032
  3. Joan Archer

    Joan Archer Registered Member

    Joined:
    Aug 12, 2007
    Posts:
    73
    Location:
    Pembrokeshire, South Wales, UK
    I never had any problems installing SP3 with NOD32 v3.0.650.0 running, in fact I didn't turn anything off. ;)
     
  4. BeanCounter

    BeanCounter Registered Member

    Joined:
    Apr 8, 2006
    Posts:
    66
    Location:
    Melbourne, Australia
    Same here. I have installed SP3 on 3 computers with 3.0.650.0 running and I have not experienced any problems.
     
  5. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    I found svchost checked, so I unchecked it. Now I'll have to wait for the next windows update to see if it flies. If not, I'll put in the x as you suggested. Thanks.
     
  6. ASpace

    ASpace Guest

    No , you must make it with x if you want it not scanned . If your protocol filtering is set to "Ports and applications..." , no matter you have unchecked it , it will still be scanned because the ports svchost will use to communicate will be scanned . Making it with x will for sure exclude it
     
  7. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    OK will do. Thanks.:)
     
  8. ablatt

    ablatt Registered Member

    Joined:
    Nov 14, 2004
    Posts:
    128
    Location:
    Canada
    Why is a critical Microsoft component like svchost.exe selected as a web browser in NOD32 v3.650 by default?

    Should everybody leave it selected or should we all put an X beside it?
     
  9. ASpace

    ASpace Guest

    It isn't selected as a web browser. It is in the list because it has (at least once) used a http port to communicate . By default ESET products scan http traffic . Placing a x will make the program not scan the svchost's traffic no matter the port or other settings .

    I have suggested that so that we eliminate any possibility where NOD32 might interfere with the updates . You don't need to prevent NOD32 from scanning the traffic unless you have problems. I don't have problems . Thousands of other users don't have problems , too.
     
  10. Joliet Jake

    Joliet Jake Registered Member

    Joined:
    Mar 1, 2005
    Posts:
    911
    Location:
    Scotland

    Mine has never appeared in there.
     
  11. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    See my earlier post here: https://www.wilderssecurity.com/showthread.php?t=206329

    Basically, I have found that if svchost.exe is scanned in "Active mode" (the next section down in the configuration menu), then Windows Updates fail. Make sure that svchost.exe in unchecked in the "Active mode" section.

    By the way, you may still leave svchost.exe checked in the "Web browsers" section.
     
  12. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    Thanks for the info. I also had your problem with the 3 updates, which I commented on in your other thread. :D
     
  13. Philippe_FR22

    Philippe_FR22 Registered Member

    Joined:
    Sep 6, 2007
    Posts:
    249
    Hello,
    Is there event log or something like that (at NOD32 level or Windows level) that could confirm that svchost.exe (or windows update process) was blocked or was not able to download updates (or contact server?) ?

    Regards
     
  14. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    The closest thing is in the Windows Update history. The failed updates have a red "X". If you click on the "X", you will see an error code of 0x80072F78, which means "ERROR HTTP INVALID SERVER RESPONSE".

    There is no sign anywhere else (that I can find) that something went wrong.
     
  15. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    I did updates today twice with no problems after unchecking svchost.exe. Thanks again guys. :D
     
  16. ASpace

    ASpace Guest

    Good job! Thanks for letting us know :thumb:
     
  17. silx

    silx Registered Member

    Joined:
    Jun 1, 2008
    Posts:
    5
    Location:
    Brazil
    Hi,

    But, if you don't have any problems with windows update or anything else, is recommend exclude or not svchoest.exe from "web browsers"?!

    thanks.
     
  18. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    Look up in post #11.
     
  19. silx

    silx Registered Member

    Joined:
    Jun 1, 2008
    Posts:
    5
    Location:
    Brazil
    Yeah twl845, I saw post number 11.

    But I'am curious about implications on activate or don't activate this process...on tab "web browsers"...
     
  20. silx

    silx Registered Member

    Joined:
    Jun 1, 2008
    Posts:
    5
    Location:
    Brazil
    I looked again "protocol filtering" and read again post number 6 of HiTech_boy's and understood.

    Thanks.
     
  21. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    OK, great. :)
     
Thread Status:
Not open for further replies.