NOS32 causing grief!! Please Help!!

Sorry for this long post, But I am a very frustrated new user who just switched from Norton 2004 AV Pro to NOD32. OS and other programs listed in message below. I have configured NOD as per the configuration instructions in the first post on the forum and still having problems. Please note NOD support's response, my e-mail and my response to their response... which I still haven't heard anything on yet. It's a shame that a company in the software security business does not have 24/7 support! Some additional things I have noticed is that (1) according to the configuration post at the top of this forum, quarantine does not truly quarantine a possible virus, but rather makes a copy of it to be sent to support (doesn't say how that is done) and then deletes the file (which in 2 cases turned out to be false positives when scanning with TrojanHunter). And (2), in setup for DMON and IMON setup-actions, the right hand window for "Uncleanable infiltrations" is "greyed-out" so that no changes can be made including the ability to quarantine. I hope someone knowledgable on the thread will take the time to read this post and can help. Many thanks all and everyone.
______________________________________________
______________________________________________

|Thank you for the prompt response to one of the three |questions below. I am using an SBC DSL Pro connection... |1.5 to 3 download... (not dial-up) and my firewall
|(ZoneAlarm Pro v. 5.1) is set to allow both nod32krn.exe |and nod32kui.exe (only ones showing under "Program |Control" in Zone Alarm) to Access (Trusted and Internet) |and Server (Trusted and Internet). I have no problems |updating any other programs.
|
|Also, I am NOT getting the message you show when doing |Update now.... and NEVER have. The box shows after |every "Update now" shows: (Please note there is NO |message that anything is up to date!!)
|___________________________________________________________
|Status
|___________________________________________
|Status: idle
|Server: <choose
|automatically>
|Virus signature database update: automatic
|Program component update: offer
|Last update: 9/28/2004 20:49:00 PM
|__________________________________________
|Version of virus signature update: 1.880 (2004092
|___________________________________________________________
|
|Please advise how to correct the above and respond to |questions #'s 2 & 3
|below.
|
|Thank you.
|_____________________________________________
|
----- Original Message -----
From: "Eset Tech Support" <support+114@eset.us>
To: XXXXXXXX
Sent: Wednesday, September 29, 2004 4:45 PM
Subject: Re: Urgent Problems with NOD32


| Hello,
|
| When you go to the NOD32 Control Center and click on Update now in the Update section, you should get a message "Your version of NOD32 is up to date. No update necessary." The message means that you have the latest
| virus signature update installed on your system. Some of the update errors can be caused by a software firewall on your system or if you use a dial-up connection.
|
| Your Eset Team
|
|
|
| XXXXXX wrote:
|
| > Please Help ASAP. Changed to NOD32 from Norton AV 2004 Pro. Having problems as noted below. As a doctor, patient data confidentiality is critical and I need your assistance immediately. Thank you.
| >
| > (1) Internet connection working fine, but don't know if getting current updates for NOD32. Have tried to manually update from Control Center using "update now", but see errors in log below. Last virus definition is now 1.880 (9/28/2004). Have had no problems updating other programs. Using WIN XP Pro with 1 meg of ram and 50 gigs of freespace. Running Zone Alarm Pro, Spybot S & D, AdAware (scan only personal version), Spyware Blaster, Spyware Guard, SpySweeper, BOClean, TrojanHunter... all latest versions and updated plus have all WIN XP critical updates installed except SP2 and new one from this week. Don't know why connection is failing when doesn't happen with any other programs. Would be nice if NOD32 gave message that file definitions were current. Please note that updates are sometimes coming through. Please see log below.
___________________________________________________________________

| > Time Module Event User
| >
| > 9/29/2004 13:48:50 PM Update Function: gethostbyname, parameters: , return value: 11001
| >
| > 9/29/2004 13:48:50 PM Update Update attempt failed (Server connection failure.)
| >
| > 9/29/2004 13:48:48 PM Update Error connecting to server www.nod32.com.
| >
| > 9/29/2004 13:48:47 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/29/2004 13:48:45 PM Update Error connecting to server u4.eset.com.
| >
| > 9/29/2004 13:48:45 PM Update Error connecting to server u3.eset.com.
| >
| > 9/28/2004 20:49:01 PM Kernel The virus signature database has been updated successfully to version 1.880 (2004092.
| >
| > 9/27/2004 23:31:00 PM Kernel The virus signature database has been updated successfully to version 1.879 (20040927).
| >
| > 9/27/2004 9:40:18 AM Kernel The virus signature database has been updated successfully to version 1.878 (20040927).
| >
| > 9/26/2004 13:20:02 PM Update Error connecting to server u3.eset.com.
| >
| > 9/26/2004 13:19:59 PM Update Error connecting to server u4.eset.com.
| >
| > 9/26/2004 13:19:56 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/26/2004 13:18:23 PM Update Function: gethostbyname, parameters: , return value: 11001 DRMEFNOTEBOOK\Administrator
| >
| > 9/26/2004 13:18:23 PM Update Update attempt failed (Server connection failure.) DRMEFNOTEBOOK\Administrator
| >
| > 9/26/2004 13:18:21 PM Update Error connecting to server www.nod32.com.
| >
| > 9/26/2004 13:18:18 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/26/2004 13:18:13 PM Update Error connecting to server u3.eset.com.
| >
| > 9/26/2004 13:18:11 PM Update Error connecting to server u4.eset.com.
| >
| > 9/24/2004 20:34:51 PM Kernel The virus signature database has been updated successfully to version 1.877 (20040925).
| >
| > 9/23/2004 23:32:06 PM Kernel The virus signature database has been updated successfully to version 1.876 (20040924).
| >
| > 9/22/2004 20:47:26 PM Kernel The virus signature database has been updated successfully to version 1.875 (20040922).
| >
| > 9/21/2004 10:07:40 AM Kernel The virus signature database has been updated successfully to version 1.874 (20040921).
| >
| > 9/20/2004 9:32:03 AM Kernel The virus signature database has been updated successfully to version 1.873 (20040920).
| >
| > 9/19/2004 23:59:57 PM Update Update attempt failed (Failure to open socket.) DRMEFNOTEBOOK\Administrator
| >
| > 9/19/2004 23:59:55 PM Update Error connecting to server www.nod32.com.
| >
| > 9/19/2004 23:59:54 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 23:59:52 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 23:59:52 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 23:54:53 PM Update Update attempt failed (Failure to open socket.) DRMEFNOTEBOOK\Administrator
| >
| > 9/19/2004 23:54:52 PM Update Error connecting to server www.nod32.com.
| >
| > 9/19/2004 23:54:50 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 23:54:49 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 23:54:49 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 23:48:04 PM Update Update attempt failed (Failure to open socket.) DRMEFNOTEBOOK\Administrator
| >
| > 9/19/2004 23:48:03 PM Update Error connecting to server www.nod32.com.
| >
| > 9/19/2004 23:48:01 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 23:48:00 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 23:47:59 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 20:48:50 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 20:48:32 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 20:48:14 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 20:29:19 PM Update Function: gethostbyname, parameters: , return value: 11001
| >
| > 9/19/2004 20:29:19 PM Update Update attempt failed (Server connection failure.)
| >
| > 9/19/2004 20:29:17 PM Update Error connecting to server www.nod32.com.
| >
| > 9/19/2004 20:28:58 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 20:28:38 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 20:28:21 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 19:28:08 PM Update Function: gethostbyname, parameters: , return value: 11001
| >
| > 9/19/2004 19:28:08 PM Update Update attempt failed (Server connection failure.)
| >
| > 9/19/2004 19:28:06 PM Update Error connecting to server www.nod32.com.
| >
| > 9/19/2004 19:28:05 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 19:28:03 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 19:28:03 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 13:35:21 PM Update Function: gethostbyname, parameters: , return value: 11001
| >
| > 9/19/2004 13:35:20 PM Update Update attempt failed (Server connection failure.)
| >
| > 9/19/2004 13:35:18 PM Update Error connecting to server www.nod32.com.
| >
| > 9/19/2004 13:35:17 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 13:35:15 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 13:35:15 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 12:35:18 PM Update Function: gethostbyname, parameters: , return value: 11001
| >
| > 9/19/2004 12:35:18 PM Update Update attempt failed (Server connection failure.)
| >
| > 9/19/2004 12:35:16 PM Update Error connecting to server www.nod32.com.
| >
| > 9/19/2004 12:35:15 PM Update Error connecting to server u2a.eset.com.
| >
| > 9/19/2004 12:35:13 PM Update Error connecting to server u4.eset.com.
| >
| > 9/19/2004 12:35:13 PM Update Error connecting to server u3.eset.com.
| >
| > 9/19/2004 2:08:41 AM Kernel The virus signature database has been updated successfully to version 1.872 (20040917).
| >
| > 9/19/2004 2:04:29 AM Update Function: gethostbyname, parameters: , return value: 11001
| >
| > 9/19/2004 2:04:29 AM Update Update attempt failed (Server connection failure.)
| >
| > 9/18/2004 18:14:16 PM Update Function: gethostbyname, parameters: , return value: 11001
| >
| > 9/18/2004 18:14:16 PM Update Update attempt failed (Server connection failure.)
______________________________________________

| > (2) Website says new version of NOD32 available, but have not been notified. Below is from Control Panel NOD32 information:
| >
| >___________________________________________
| > NOD32 Antivirus System information
| >
| > Virus signature database version: 1.880 (2004092
| >
| > Dated: Tuesday, September 28, 2004
| >
| > Virus signature database build: 4869
| >
|
> Information on other scanner support parts
| >
| > Advanced heuristics module version: 1.010 (20040902)
| >
| > Advanced heuristics module build: 1061
| >
| > Internet filter version: 1.002 (2004070
| >
| > Internet filter build: 1013
| >
| > Archive support module version: 1.021 (20040917)
| >
| > Archive support module build version: 1101
| >
|
> Information on installed components
| >
| > NOD32 For Windows NT/2000/XP/2003 - Base
| >
| > Version: 2.12.2
| >
| > NOD32 For Windows NT/2000/XP/2003 - Internet support
| >
| > Version: 2.12.2
| >
| > NOD32 for Windows NT/2000/XP/2003 - Standard component
| >
| > Version: 2.12.2
| >
| >
| >
| > Operating system information
| >
| > Platform: Windows XP
| >
| > Version: 5.1.2600 Service Pack 1
| >
| > Version of common control components: 5.82.2800
| >
| > RAM: 1024 MB
| >
| > Processor: Mobile Intel(R) Pentium(R) 4 - M CPU 2.20GHz (2198 MHz)
| ______________________________________________

| > Is their a new version update and how do I get it... and why wasn't I notified (box is checked) if it's on your forum's website?
| >
| >
____________________________________________________________________________
| >
| > (3) Getting false positives whenever running complete TrojanHunter scan: c:\documn~1\Admini~1\locals~1\temp\XXXXXX(varies each time).exe
-NOD32 says new file created and can't fix or quarantine. No other antiviruses causing this problem as per TrojanHunter forum. Some on TrojanHunter forum claim is caused by AMON or IMON unable to unpack files fast enough. Any solution to this problem?
| >
| > (4) Does NOD32 virus scan outgoing pop mail (Outlook Express)?
| > ___________________________________________________________
| >
| > Would be nice if program advised that user had latest version of program and virus updates.

Many thanks,

XXXXXXX

 

I don't think they should even call it "Quarantine". I feel that this is very misleading since nothing is actually quarantined. I also feel this thing about making a copy to be sent to Eset is interesting. I, the customer, having purchased NOD32, am supposed to send viruses to Eset? Isn't it Eset job defend our computers from viruses? I suppose other companies do the same thing, I just think it's kind of strange.

I think Eset had some issues with needing more servers to handle the demand, at least here in the US. I don't know if that's the reason for the problem you are having, but it is frustrating I am sure.

 

That’s quite ok

This is correct.

The post does says:

Quarantine allows restoration of a file at a later time/date; C> Program files> Eset> Infected

You must click on the “Clean” Radio Button, in order to use the right hand window, otherwise you will be given choices according to what you have chosen in the left hand side…

You should see a notice that says "Your version of NOD32 is up to date. No update necessary." as per the attached screenshot.

You have the latest Virus Signature Database, your Nod32 is up to date.

There are server update issues discussed here, they are being addressed currently, more servers are being brought online...

See post number 19 here

You can have Nod32 automatically update both the main Engine and Virus Signatures, instead of offer…

Please delete your TEMP files by doing the following: open up Internet Explorer> Tools> Internet Options> General TAB> Temporary Internet Files> Delete Files> Delete All Offline Content. Then do the following:

Step 1. Restart your system again in “SAFE MODE” by pressing/tapping F8 while booting up.


Step 2. Start a scan with Nod32 while in SAFE MODE by doing the following: Start> All Programs> Eset> Nod32.


CHECK THE FOLLOWING BEFORE YOU START YOUR SCAN:

“Actions” TAB
Make sure Quarantine is ticked, both for “If a virus is found” and “Uncleanable viruses”.

“Setup” TAB
Objects to diagnose – place a tick in all boxes.
Diagnostic methods – place a tick in all boxes.
Heuristic sensitivity – place a tick in “Deep”.
Extensions – place a tick in “Scan all files”.

“Scanning targets” TAB
Double click on ALL of your Hard Drives so there is a RED tick shown
Click “Clean”


Make SURE Quarantine is ticked with EVERYTHING that is detected BEFORE you DELETE anything that is found. If you are not sure whether it is safe to delete an infected file, quarantine allows restoration of a file at a later time/date.


If the scan finds a “Probable NewHeur_PE virus found”, please do the following:

1. Place a tick in the Quarantine check-box
2. Select Delete
3. Send the quarantined file to Eset: samples@nod32.com this file can be found here: C> Program files> Eset> Infected

No it doesn’t, the short reason why is that AMON would stop anything outgoing…

Hope this helps…

Let us know how you go…

Cheers

 

drmef

Originally Posted by Blackspear
NOTE: Make SURE Quarantine is ticked with EVERYTHING that is detected BEFORE you DELETE anything that is ever found. If you are not sure whether it is safe to delete an infected file, quarantine allows restoration of a file at a later time/date.


If the scan finds a “Probable NewHeur_PE virus found”, please do the following:

1. Place a tick in the Quarantine check-box
2. Select Delete
3. Send the quarantined file to Eset: samples@nod32.com

This file can be found here: C> Program files> Eset> Infected


NOTE: Quarantine ONLY copies the Virus or Trojan found so it can be sent to Eset for further analysis, it does NOT isolate the Virus or Trojan.


I wish I could, but if you note in my original post, the right side box under "actions" for "Uncleanable viruses" is greyed-out and I cannot check anything... although "prompt for action" is checked in the "greyed-out" area. When the virus window pops-up it often says uncleanable and I check quarantine, but I get a message that there was an error quarantining the file and checking the quarantine log shows nothing. I now check quarantine and close the window and then retry quarantine and the scan just continues, but nothing is quarantined.
_______________________________________________

"You must click on the “Clean” Radio Button, in order to use the right hand window, otherwise you will be given choices according to what you have chosen in the left hand side…"

Understood, but I can't change the choices in the right hand window as it is "greyed-out" and does not respond so that I can check "quarantine".

_______________________________________________

"
Originally Posted by drmef
…Please note there is NO message that anything is up to date!!...


You should see a notice that says "Your version of NOD32 is up to date. No update necessary." as per the attached screenshot."
________________
That's what I would have thought, but the only message I get when I click "Update now" (and it is not in a separate box) is "Abort" (and "cancel update" on the next line) in place of "Update now". I have rebooted, and defragged and run trojan and virus scans multiple times, but still get the same result. When installing, I turned off all programs including antitrojan, antispyware, ZoneAlarm Pro 5.1, etc..
________________________________________________
"CHECK THE FOLLOWING BEFORE YOU START YOUR SCAN:

“Actions” TAB
Make sure Quarantine is ticked, both for “If a virus is found” and “Uncleanable viruses”."

As mentioned above, I am unable to check quarantine under "Uncleanable viruses"... and If I check quarantine on the Pop-up window when a proported virus is found... it says there is an error and cannot quarantine.

I sincerely appreciate you trying to help, but as you can see, it is truly frustrating and I am very concerned that my computer is going to get a corruption error or miss a virus or update or whatever. Something is definitely wrong somewhere!!! Thanks again. I hope you or someone can think of the answer.
________________________________________________
"Quote:
Originally Posted by drmef
(3) Getting false positives whenever running complete TrojanHunter scan: c:\documn~1\Admini~1\locals~1\temp\XXXXXX(varies each time).exe


Please delete your TEMP files by doing the following: open up Internet Explorer> Tools> Internet Options> General TAB> Temporary Internet Files> Delete Files> Delete All Offline Content. Then do the following:

Step 1. Restart your system again in “SAFE MODE” by pressing/tapping F8 while booting up.


Step 2. Start a scan with Nod32 while in SAFE MODE by doing the following: Start> All Programs> Eset> Nod32.


CHECK THE FOLLOWING BEFORE YOU START YOUR SCAN:

“Actions” TAB
Make sure Quarantine is ticked, both for “If a virus is found” and “Uncleanable viruses”.

“Setup” TAB
Objects to diagnose – place a tick in all boxes.
Diagnostic methods – place a tick in all boxes.
Heuristic sensitivity – place a tick in “Deep”.
Extensions – place a tick in “Scan all files”.

“Scanning targets” TAB
Double click on ALL of your Hard Drives so there is a RED tick shown
Click “Clean”


Make SURE Quarantine is ticked with EVERYTHING that is detected BEFORE you DELETE anything that is found. If you are not sure whether it is safe to delete an infected file, quarantine allows restoration of a file at a later time/date.


If the scan finds a “Probable NewHeur_PE virus found”, please do the following:

1. Place a tick in the Quarantine check-box
2. Select Delete
3. Send the quarantined file to Eset: samples@nod32.com this file can be found here: C> Program files> Eset> Infected"
______________________________

Please note that the problem does not occur with an NOD scan, but with NOD popping-up a window saying it has found a virus WHEN DOING A COMPLETE TROJANHUNTER SCAN. Doing a complete NOD scan before and after doing the TrojanHunter scan shows no viruses, etc.. (All files scanned except paging file).
____________________________________________

Many thanks for stepping-up to try and help. I have rebooted the computer many times, run a scandisk, defragged, run antitrojan and antispyware, etc. and still have the same problems with NOD. When I installed NOD, I disabled all programs including ZoneAlarm Pro V.5.1, antitrojans, antispyware, etc.. Any assistance from anyone would be greatly appreciated. TIA.

 

Re: drmef

Any choices made within the red box, will grey out the right hand side…

 

If you choose "Clean", then the right hand side comes available...

 

Do you have your updates set to Choose Automatically?”

 

Have you tried emptying your TEMP folder as described in my previous post.

Did you run a scan in SAFE MODE?

The infection you have shown is in a TEMP file, thus when you empty your TEMP files it should not remain, as well, a scan in SAFE MODE should remove anything found…

Still on it, we’ll get you there…

Cheers

 

I don’t need to go any further in regards to your system updating, it is doing so “Successfully”...

The Update errors you are seeing in your logs I have addressed in my first post to you: There are server update issues discussed here, they are being addressed currently, more servers are being brought online...

Cheers

 

That's one problem down! Thanks! When you do a complete scan of all files, do you click "scan" or "clean"? I added "clean" in the left window and "Prompt for an action" in the right window and "quarantine" in both, but won't this delete possible false positives when doing a scan?

 

Yes. I checked again and it's set exactly like yours... <Choose automatically>. I did click on "Servers" and it is empty. Is that correct? TIA.

 

I agree, it is misleading. Quarantine has been discussed extensively here and here

I have to disagree, by doing so, people that come across a new virus that Nod32 would detect as; “Probable NewHeur_PE virus found” then by sending the Quarantined file to Eset they are able to write a virus signature for it. We help them, they help us…

Hope this helps…

Cheers

 

I always clear my online and offline cache and cookies before running any scan (using IE6+), but don't run the scan in TrojanHunter or NOD (not sure which scan you are referring to?) in safe mode because safe mode scrambles all the icons on my desktop when I reboot (wish there was a way to lock those in position so they go back to where they were when rebooting). Thanks for your time and effort.

 

I'll post the quote again, just to make things clear...

Hope this help...

Cheers

 

Can you please run a scan in SAFE MODE, just this once, to be sure your system is clean...

Safe mode uses basic video resolution settings, thus your icons are "scrambled...

Cheers

 

There is a very simple step by step tutorial on setting up Nod32 here

Hope this helps...

Cheers

 

Is that the reason for me failing to get the pop-up window stating that I am current with all updates? I have never seen that window... just the "abort" message where the "Update now" is or no message at all. Also, should I clear the event log? Also, FYI, the virus log shows the virus popup during the TrojanHunter scan is coming from AMON and indicates "error quarantining". Many thanks once again for your assistance. Hopefully this will work out.

 

Are you using a Proxy Server?

Is your connection set to what it should be? For settings see post 33 to 34 here

Cheers

 

No... not using proxy server to the best of my knowledge. Followed posts 33 and 34 as you suggested and clicked detect and got message no proxy server. Thanks for trying.

 

Has your system come up clean after running a scan in SAFE MODE?

 

That is correct, that dropdown box is for adding in servers if you are so directed by Eset support. If you click on the "Choose Automatically" dropdown, you will see a list of servers there....

Hope this helps...

Cheers

 

Hello drmef,

How long are you waiting when you hit the 'Update now' button? That will always show 'Abort' for either a split second or maybe for a minute or two. This can be due to your machine's speed, the speed of your internet connection or general heavy traffic on the old internet highway. I think Blackspear asked what type of connection you have: did you say? Is it Dial-up or DSL? Dial-up is generally a lot slower than DSL so it's quite conceivable that you might be hanging around for a minute or two while your machine receives Virus Signature updates and therefore you would see that 'Abort' button. In the window above it, you should hopefully see some activity as your machine is calling out to the Eset Servers..... "Cooo-eeeee......over here! Updates for me please..."

Bandicoot.

 

Thanks for your assistance Mr Coot, as always it is a pleasure

Drmef your own logs show that you have the latest version of Nod32, that being 2.12.2

Cheers


PS. Hmmmm was wondering isn’t a Bandicoot a nocturnal rodent, something like an overgrown furry little rat, or was it just an over stretched Hamster, sure I read it somewhere reliable, like the internet…

 

I can easily go away and play with my real furry, rodent chums you know.......

 

ROFLMAO, no, no, nooooooo I wouldn't have anything to play target practice with