Very Very Crazy problem I'm reporting in here

Hey guys this is really insane but I figured it out, and thought everyone should know this because it regards NOD32.. We have a batch file being loaded through logon script that calls a reg file and imports a bunch of settings for Internet Explorer. Proxy exceptions, proxy address, and etc.. I did not create this but inherited it.

After upgrading to NOD32 V4 I started to get machines that would launch Internet Explorer, and would go to a black screen, reboot, and go over and over again.. I could uninstall NOD32, and the problem would go away so I thought "DAMN IT ESET HAOHAOOHAOAHO DIE"..

Here lies the issue, and I began to dig deeper. I could uninstall the Netware client on the machine, and leave NOD32 on, and the problem would not happen.The mini crash dump files pointed towards the NWFS.sys file that is in the C:\Windows\system32\netware folder.

So I knew it had something to do with NOD32, and Netware.. I narrowed it down to a Netware Group called Pushproxy... Narrowed it down to the batch file, and then to the registry file..

I delete the registry file, and replaced it with a new reg file that did not have a lot of extra hex values to modify Internet Explorer. Deleted the user profile, logged back in, and NOD32, IE, and Netware love one another again.

I do not really blame NOD32 for this issue because it was an old system admins .reg file for IE settings from IE4 or IE5 importing causing this issue with NOD32/IE7/8..

A lot of people I see complaining on here probably have similiar issues, and leave it at the fact that uninstalling NOD32 fixes the problem... I could post the .reg file that crashes my systems, but I would not want someone to use it for malicious reasons to crash systems with NOD32 V4 on it.. I am reporting it to ESET, and calling them tomorrow.

Very Very insane.. The life of a sys admin... Time for my a hot bath!

 

Just out of curiosity, do you have the latest version of the Novell client installed? Do you use a Novell or MS client?

 

Yes I tried that, and it still happened. It was the .reg file being pushed down from a .bat file for Internet Explorer that would cause this issue.. Would you like to see the registry file that would do this? It only would happen with ESET 4.0 on the machines.