Will ESET refund my payment as NOD32 no good for my system - Networking Offline

Discussion in 'NOD32 version 2 Forum' started by Tempest, Aug 15, 2004.

Thread Status:
Not open for further replies.
  1. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    I'm well annoyed now.

    Having used a trial version of NOD32 in the past, as I have a new machine I decided to do everything 100% right this time.

    System: AMD64 3200+, 1GB Ram, XP Home, X800 Pro Graphics, Internet via cable modem plugged into networking socket on motherboard

    Installed Windows XP Home clean and fresh, installed Service Pack2 clean and fresh, added my Video drivers.

    Now for my virus checker on my clean system

    Installed NOD32 beta and my network connection was offline.

    Uninstalled NOD32 networking/Internet was back working fine.

    Installed NOD32 latest official version and network again was offline.

    Uninstalled NOD32 and networking/internet was back working again.

    I'm just using default setting for everything, not messing with anything, but basically if I install NOD32 I have no network connection, hence no internet access.

    So I'm stuck, and do not wish to carry on installing software on my machine which I desperatly need to do, without a working virus checker.

    I've read a few other postings which sound like they may be similar, but wondering if:

    A: There is a sollution yet
    B: Will I get a refund for this product that will not work for me if I choose to buy something else ?

    Note: My system spec at top of this posting.

    ========== edited ==========

    I have emailed ESET about this networking going offline problem but had no answer yet :(
     
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Hi Tempest, can you try the Nod32 Beta to see if this resolves your problem...

    Cheers :D
     
  3. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    Thanks for the posting Blackspear, but if you read my posting you'll see i did at first try the BETA as I'd been told the beta was recognised by Service pack 2's new security window (firewall, virus info)

    I 1st tried the beta then when that killed my network I tried the latest release version which also killed my network, and uninstalled again to get my network back.

    The odd thing is, why would removing NOD32 make your network work again ?
    If it messed up some settings in windows, then removing a product would not fix those settings back would they ?
     
  4. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    My main question remains though.

    As I have basically paid almost £30 UK pounds for a product that does not work on my system (and was a clean system)

    As I only bought and paid for this online less than 24 hours ago.
    If I decide I can't wait for a fix (as I need my PC online and running) will they do the decent thing and offer a full refund on my credit card ?
     
  5. BlueZannetti

    BlueZannetti Administrator

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    The NOD32 IMON module inserts lsp protocols with the lsp chain - this is what allows IMON to work. If there's a conflict, or the lsp is broken for whatever reason, the protocol chain is broken, effectively cutting communication.

    Do you know what lsp's are active on your system? Ad-aware has an lsp explorer plugin that provides a quick peek at what's in the chain. From your description I assume that NOD32's lsp entries are the only added ones.

    If you disable IMON, this should fix the problem at the Winsock level since that will remove the NOD32 specific lsp entries, although I'd guess that a reboot is needed to fully clean up the chain.

    Take a look at the NOD32 help section focussed on IMON if you haven't already. There are a few things you can try with respect to how IMON works to see if this helps network communications. You can also disable IMON and rely on AMON only for real time protection, assuming, of course, this helps you problem. I tend to think of IMON as a proactive measure, it scans objects before handing them off to any applications, which does provide an added measure of safety, but AMON should be able to handle any malware. If you go with this route, do reboot after disabling IMON before coming to an assessment whether it worked or not.

    Blue
     
  6. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    For the moment, so you can have internet access and install programs and have NOD32 check them, try uninstalling NOD32. Then reinstall choosing custom install and DECLINE to register IMON. Decline anything to do with IMON during the install process. Once NOD32 has installed IMON should be greyed out. Do NOT enable it. You should be ok if you do that. AMON will still catch anything and you can download programs and still right click and scan with NOD32 on demand scanner to be sure there is no nasty there.

    Eset may have a later version of the beta for you to try which may have the problem with IMON corrected. I don't use IMON because of potential problems like this. But most people have no trouble using IMON. I have been burned very badly from applications that seriously mess with Winsock like IMON does so I am extremely leery of ever again using any application that does this. I don't feel though that I am unprotected because I don't use IMON. AMON is still running and it is the resident monitor. IMON email scanner is not necessary if you practice safe hex. The IMON HTTP scanner is just a newfangled gadget that Eset dreamed up for marketing IMO. :D

    If you still have problems, uninstall NOD32 again and then run this fix and then reinstall NOD32 and be sure to decline anything related to IMON.
    http://www.cexx.org/lspfix.htm
     
    Last edited: Aug 15, 2004
  7. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    OK..... News hot off the press............

    I followed your above advice and selected a partial custom setup of NOD32 this time.
    (I went with the beta as this is recognised with SP2 new security panel)

    I left all the options on their default settings apart from right at the end where it gave you the option not to have IMON active.

    It installed, rebooted and it WORKS !!!!!!

    I now have the net working AND NOD32 working.

    Which is some good news at last :)

    Just so I fully understand, what does not having IMON running actually mean ?

    ========== edited ==========

    I would of course like to have IMON working. So if anyone finds out how to solve this one, I would of course love to hear :)
     
    Last edited: Aug 15, 2004
  8. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,751
    Location:
    Texas
    Last edited: Aug 15, 2004
  9. BlueZannetti

    BlueZannetti Administrator

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    Expanding on what ronjor has pointed to, here's a couple of segments from the beta help file....

    Blue
     
  10. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    Thanks guys for the above two postings....

    I'm a little confused about exactly what IMON does still.

    In one side it sounds like it's an Email scanner

    Yes, above it sounds like it's checking files as they are downloaded bit by bit.

    Are we saying (in plain english) that you can DOWNLOAD an infected file and it will not be detected (by NOD32) as infected until it is actually run if IMON is not running ?

    Also Emails could contain viruses as attachments, which also would not be detected as such until you try to run them ?

    Is this what IMON does ?

    Sorry if I'm being thick, but some of the explanations of the seperate parts could be simplified.
     
  11. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,751
    Location:
    Texas
    It would be possible to download a malware file if Imon is not running and your email program is not configured to a "safe" state.
    Amon would not let it do any harm though if through heuristics or definition it could be detected.
    Same goes for any antivirus program.



    While the role of AMON is to provide real-time, resident, anti-virus monitoring of a system and user actions, the IMON module serves as an anti-virus monitor of traffic between the system and the outside world (Internet).



    IMON's primary role is to monitor incoming email. The key advantage of IMON, compared to its predecessor (POP3 scanner), is its ease of use. There is virtually no setup necessary since this module is email client independent. IMON works on the winsock level.


    AMON (Antivirus MONitor) is a memory-resident (working in the operating memory after each restart of a computer) file scanning program. Automatic execution of AMON after computer restart is a fundamental defense against malicious code. Quitting AMON is not recommended and should only be done under special circumstances. Execution of two different antivirus monitors (from different developers) is not recommended since it can cause a system crash and, especially on Windows NT systems, might lead to serious problems. Automatic execution of AMON after computer restart can be set in the Security tab of the AMON setup window.



    AMON is the most important line of antivirus defense. It is critically important to keep it running at all times using the most current version of the virus signature databases. AMON monitors all potentially threatening actions on protected computers such as opening, executing, creating, or renaming files.

    AMON is frequently referred to as the antivirus monitor or the “on-access” scanner in contrast to the “on-demand” scanner. (The latter is invoked by user or as a scheduled task.)



    To execute its tasks AMON requires important system rights. Technically speaking it works on a level of a system driver. As a result compatibility with other services running on a computer need to be checked during installation of NOD32 system. If the test has been completed successfully, AMON is allowed to start automatically after each restart of a computer.




    Important note: The use of more (than one) antivirus monitor is not recommended. Two (or more) antivirus systems may be installed on a computer, but only one antivirus monitor (on-access scanner) should be used at any time.




    AMON has three states:

    Running and enabled (Loaded in memory and performing on-access scanning).
    Running and disabled (Loaded in memory but not performing on-access scanning).
    Stopped and disabled (Not loaded in memory).
    If AMON is stopped its icon in the main window of the NOD32 Control Center is gray. This state is not recommended since no active on-access antivirus protection is available on the computer. To start AMON, click its icon and the Start button located in the AMON window.


    If AMON is loaded in the memory but its scanning is disabled (not a recommended state), its icon is red. To enable AMON, click its icon to open AMON window and click “Resident module (AMON) enabled” check-box. This action will bring AMON’s icon into the normal (recommended) state. To double check AMON’s performance, click AMON icon to open its main window. The main AMON window contains information on the number of scanned files. Have a look at this number and remember it. Then run/stop any application and check the number of scanned files again. If AMON is running properly, the value of the parameter has increased.



    Description of the AMON window

    To open the AMON window, click on the AMON icon in NOD32 Control Center main window.

    The contents of the AMON window (available buttons) depends on AMON state of execution. The “Resident module (AMON) enabled” checkbox serves to enable or disable AMON’s main function: on-access scanning. This option is only available (it is not grayed out) if AMON is loaded in the operating memory. To load AMON into memory, click the Start button. To unload AMON from memory, click on the Stop button.


    Other useful information available in the main AMON window is the statistics on the total number of Scanned, Infected, and Cleaned files. The name of the latest or currently scanned file is also available followed by information on the installed version of the virus database with its released date. Dates are listed in the following format: YYYYMMDD.


    To access setup parameters of AMON module click Setup button located in the main AMON window.
     
  12. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    Thanks for that info...

    I can sleep soundly in my bed tonight then :)

    With all these people having the same problem (NOD32 kills networking connection - Or rather IMON kills it) after Service pack 2, and possibly from what I've read, AMD64 systems seem quite prone.

    I'm sure they'll want to fix it ASAP as killing someones Internet connection with your software is rather a MAJOR issue !!!!!!!

    At least I'm ok now and can just get the corrected version when it's done.

    Unless one of these secret Beta's people talk about has already been done to correct this.

    Please let us know guys if you find something works.
     
  13. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Tempest, can you try emailing beta2011@eset.sk and place a link to this thread, they will probably give you a newer version of the Nod32 Beta.

    Cheers :D
     
  14. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    Tempest, I'm so glad that worked for you. :) I see that you have gotten excellent information on AMON and IMON from Ronjor. I would only add that while changing from a standard type email scanner that has to be configured by the user to a scanner that is much easier to use because it works at the Winsock level and thus doesn't need configuring is good this also opens the door to the very sort of major problem you had. You are actually lucky. You could have had a totally wrecked system and had to reformat. So, I am staying away from IMON until there are no more problems like this. Plus, I still don't see the point in the IMON HTTP scanner. To me, that is redundant and it slows my XP box too much.
     
  15. Stan999

    Stan999 Registered Member

    Joined:
    Sep 27, 2002
    Posts:
    566
    Location:
    Fort Worth, TX USA
    The NOD beta IMON HTTP scanner doesn't slow down my old PIII 500 WinXP box or a WinXP P4 2.8 Dell. I think the HTTP scanner is a great addition.
     
  16. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Guys,
    some compatibility issues with AMD64 and SP2 have been fixed and the new program component update is supposed to be issued very shortly. With the beta we use, no issues have emerged on this system configuration so far.
     
  17. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    Gimmie, Gimmie Gimme :)

    Dare we say how long before it happens, (days, weeks)

    More importantly.... How will we know when this new version is out for download? Do they normally email NOD32 customers, or do we just have to keep checking their website ?
     
  18. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Hi Tempest, try emailing beta2011@eset.sk and place a link to this thread...

    Cheers :D
     
  19. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    The English installers of NOD32 will be placed on our website within 24-48 hours so it's not a recommended practice to inundate the beta mailbox with requests for the newer version.
     
  20. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Sorry about that Marcos, I was just following what your website advises, being that these are genuine problems:

    http://www.nod32.com/download/downbeta.htm

    "Please, send your comments regarding this version to beta2011@eset.sk ; all your comments are greatly appreciated!"

    Cheers :D
     
  21. Tempest

    Tempest Registered Member

    Joined:
    Aug 15, 2004
    Posts:
    23
    Just to say, the new BETA has fixed the problem for me (phew)

    I am a tad suspicious that my internet browsing whilst downloading a file has become slow with IMON running, but that may just be me.....
     
  22. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    I haven't noticed any slow down, P4 2.8, 512 DDR RAM...

    Cheers :D
     
Thread Status:
Not open for further replies.