NOD32 Module

This is the main window of the NOD32 on-demand scanner module.

To run the on-demand scanner, click Run NOD32. You will be prompted to select the scanning targets.
To scan local disks, click the Local button.

To scan an inserted diskette click the Diskette button.

The on-demand scanner can also be started by clicking on the NOD32 icon located on the desktop, (if the icon was created on the desktop during installation). The on-demand scanner can also be executed as follows:

  1. Click Start
  2. Click All Programs
  3. Select Eset
  4. Select NOD32

A convenient short-cut to trigger the on-demand scanner is available using the right button of the mouse. This feature needs to be selected during installation of the NOD32 system. If enabled, a file may be scanned by right-clicking it, and selecting NOD32 Antivirus System from the pop-up menu.

Execution of the on-demand scanner begins with a self-check of integrity, and a scan of your computer memory.


NOD32 (On-Demand) Scanner

The NOD32 scanner (also referred to as the on-demand scanner) is used to perform scanning of specific targets upon request of the user. The NOD32 scanner can also be executed using the NOD32 Control Center, even without user-intervention if scanning has been scheduled using Scheduler/Planner function.

To execute the on-demand scanner manually, click on the NOD32 icon located on your computer desktop. To schedule execution of the on-demand scanner using the Scheduler/Planner, open the NOD32 Control Center main dialog window by clicking on the NOD32 icon located in the system tray (usually the lower right-hand part of the monitor, near the clock). Running the NOD32 scanner automatically scans operating memory for viruses. An integrity check of the on-demand scanner itself is also performed automatically.

The NOD32 scanner main window contains five tabs that can be selected by clicking on the corresponding name of each tab. Click on the links below for detailed information on each tab.

  • Scanning targets
  • Scanning Log
  • Actions
  • Setup
  • Profiles

The bottom section of the NOD32 scanner main window remains the same regardless of the tab selection. A description of this section is presented below.

Control Buttons

Scan

This button invokes scanning of all selected targets. If selected, the Scanning target tab is replaced by Scanning Log tab window to display information on scanning results. Also, the Scan button is replaced by Stop button which can be used to terminate scanning. If an infection or potential infection is found during scanning, the information is stored in the log file in red. Cleaning of infected files, should be done using the Clean option described below or by using the mouse to right-click the log entry and selecting Clean from the context menu.

Clean

The Clean button starts scanning of all selected targets accompanied by cleaning, provided a cleaning procedure for an encountered infiltration is available and “clean” action is selected in the Actions tab as described below. Execution of this action can be stopped by clicking the Stop button that has replaced the Clean button while a scan is running. If an infection is found, the behavior of the program depends on the configuration defined in the Actions tab, described below.

Quit

This button is used to quit the on-demand scanner. If a profile has been changed during the execution of the program, a window is displayed prompting the user to save the profile modifications.

Version info

The lower-left side of the window displays information on the installed version of the virus databases (e.g. 2.129 and the corresponding release date by the developer listed in parentheses, e.g. (20020621) in the following format: YYYYMMDD followed by the operating system version.

Help

Selection of this button invokes the on-line help system. The same effect is achieved by pressing F1 key at any time.


Scanning Targets

This tab provides options to select scanning targets. It is divided into two groups: the upper section is for disk selection, the lower for directories and files.

Disks

To select a disk target, double-click on the drive icon. To clear a selection, double-click on the selected drive icon. Check the corresponding box in the upper right-hand corner to enable listing of Local and Network disks. To select all the drives within the list, click on the Select all button. To remove all selected drives from the list click on the Deselect all button.

Directories and files

To add or delete directories and files from the list of scanning targets, click on the Add and Delete buttons accordingly. Before deleting an object, it needs to be highlighted first. Clicking on the Add button opens a new dialog window with the following options: OK, Cancel, Directory…, and File… . To select a directory or file, click on the corresponding button. A standard file browser is invoked for easy selection of desired scanning targets. After selecting the target, click on OK. The selected scanning target will be marked by a red checkmark over its icon. To remove the checkmark (and deselect the target) double-click on its icon. To remove the target from the list, highlight it and click the Delete button.

All targets on the list can be selected or deselected by clicking on the corresponding button.


Scanning Log

The Scanning Log is displayed after running the on-demand scanner. The Scanning Log contains valuable information on each performed scan.

The scope and format of the information displayed can be configured in the NOD32 Scanner Log section and the Setup tab listed below. The scrolling check-box at the bottom of the window affects the way the log is displayed. If selected, information scrolls upwards within the display window. Otherwise the information is static and navigation within the log file can be done using the vertical bar on the right-hand side of the display window. Information on the currently scanned file is listed below the display window. A rotating bar in the lower right-hand side of the window indicates scanning activity.

The Setup tab tab provides further options to manage the Scanning Log file format and parameters.

Scanning Log list

Each Scanning Log contains information on the currently installed version of the scanning engine. It also lists:

  • The date and time of the scan
  • The list of files marked as infected (in red)
  • Files that could not be scanned due to certain errors (in blue)
  • Termination status
  • Number of files scanned
  • Number of viruses found
  • Termination time
  • Total scanning time

The Notes section provides detailed information on errors encountered during scanning.

In addition to the Log file, an integrated Log Management System including the NOD32 Scanner Log files is available in the NOD32 Control Center. For further details regarding other Logs created by NOD32 Control Center, see Logs.

Hints: To clear the log, right-click in the log window select Clear log. Right-clicking an infected file allows immediate cleaning from the pop-up menu, (assuming the infection can be cleaned).


Actions

If the Clean button is selected and an infiltration is detected by NOD32, several alternative actions can be applied based on choices made in this tab. The actions may differ depending on the nature of the infected object. To select an object, click on the arrow of the pull-down menu in the upper part of the Action tab. (“Files” is the default selection). Object types are:

  • Files
  • Boot sector
  • Operating memory

The possible actions are:

  • clean
  • notify/offer action (default)
  • no action
  • rename
  • delete
  • replace - (for boot sectors only)

To save an encoded copy of an infected file into a special quarantine folder, select the “Quarantine” check-box.

If any of the selected actions differs from the default settings, a notification message is displayed in the bottom part of the window. To return to default settings for all objects, press the Default button.

Examples

If the radio button “delete” and the check-box “Quarantine” are selected, infected files will be encoded and moved into the quarantine folder before the original file is deleted.

If the action “clean” is selected and the file can't be cleaned, NOD32 will resort to a secondary action as specified in the right-hand side of the tab.


NOD32 Setup

The Setup tab provides options to select objects to diagnose, diagnostic methods, heuristics sensitivity, system options, and log parameters.

Objects to diagnose

The set of objects to diagnose is a subset of the scanning targets. For example, if drive C: is selected as a scanning target, the scanner will not scan archives if the “Archives” box is not checked. Using the default profile, files, boot sectors, and operating memory are scanned. Runtime packers, archives, and email files can also be selected.

Scanning methods

Scanning methods are the key features of the NOD32 Antivirus System. Both Virus signatures and Heuristics should be selected at all times. Disabling either option reduces the detection capability of the system. Virus signatures represent databases which are frequently updated by the automatic update system (configured in the NOD32 Control Center). A valid username and password are required to download the latest version of the virus signature database. Heuristics allow detection of infections without the need to compare them with the virus signature databases.

System

The System group provides setup of three features:

  • List all files - Checking the List all files box will affect the contents of the Log file. The Log file will show all the scanned files, even those not infected. Selection of this option should be limited to special cases since it greatly increases the size of the Log file.
  • Sound signal - Checking the sound signal box sounds a warning if an infection is detected.
  • Use MAPI interface - Enables access to MS Outlook® e-mail files using the MAPI interface.

Heuristics sensitivity

Heuristics are state-of-the-art tools to help detection of unknown infections. We recommended keeping the value of this parameter on Standard. Available options are:

  • Safe
  • Standard - default (Recommended)
  • Deep

Scanning Log

The Scanning Log is a file (by default, nod32.log) located in the NOD32 installation directory. An alternate name can be specified in the Setup tab. Unless log creation is disabled in the Setup tab, this file is stored and available even after leaving the NOD32 program. The maximum size of the file can also be specified here. To provide clearer printing of the Log file, the Wrap Log option can be selected to keep the width of the stored file reasonable. Finally, if the Append option is selected the old scanning results are kept while the new ones are added. If the Overwrite option is selected, the old scanning results are overwritten during each new scan.

Buttons

The Extensions button invokes the Extension Editor window. For further information see the section Extension editor.

The Advanced button opens the Advanced Setup window.


Extension Editor

The Extension Editor is a special feature and its use is not recommended unless you are an advanced user. The set of file extensions to be scanned is constantly being updated and you are provided with regular updates as needed. Removing any of the default extensions might result in an infection of your computer!

Extensions list

The list of file extensions to be scanned is presented in the main section of the window. Use the scroll bar on the right-hand side of the window to navigate through the list. To highlight an extension, click on it with your mouse.

Buttons

  • Confirm - Any modifications to the list of extensions must be confirmed using the Confirm button.
  • Cancel - The Cancel button closes the window and returns control to the Setup tab.
  • Add - To add an extension, click on the Add button, fill out the dialog line, click on OK and the Confirm button.
  • Remove - To remove an extension (may result in security threat), highlight it, click on the Remove and Confirm button.
  • Default - To restore the default set of extensions (recommended) click on the Default button and Confirm.

Checkboxes

  • Scan extensionless files - This checkbox includes scanning of files with no extension.
  • Scan all files - Select this option to scan all files by default. When this option is selected the Extension Editor reverses the function of the main dialog box: a list of extensions of the files to exclude from scanning can be created in the extension window. In addition, a new checkbox appears allowing exclusion of extension-less files from scanning.


Add New Extension

The list of file extensions for NOD32 to scan are pre-selected, by default, for optimum safety and efficiency. If a new threat requires addition of a new extension, Eset will release a new update. Therefore, in normal use, we do not recommend selecting the option: “Scan all files”, since this would slow down the scanning process unnecessarily.

WARNING! Removal of any default extension is not recommended and could lead to loss or damage of your data.

The Extension Editor window also has options for scanning all files and files with no extension (generally unnecessary).


Nod32 - Extended Setup

NOD32 - Advanced Setup

When important events occur, such as an infiltration is detected, a new update completes, or for certain error states, a notification message can be sent from the affected computer to predefined email addresses or computers. To quickly configure the notification system use the Advanced button on the Setup tab. For further details on the specific setup of the warning & notification system, see the corresponding section of the NOD32 Control Center help topic.


NOD32 Profiles

The Profiles tab serves to create or select a special set of scanning parameters. Such a user-defined set of parameters is referred to as a profile. All the configuration parameters set in NOD32 tabs can be stored in a profile. To save the modified parameters, click on the Save button. The Save profile window provides a selection of existing profiles or creation of a new profile. To create a new profile, click on New to enter a name in the “New profile name” dialog box.

To set password protection for profiles and the entire configuration, check the password check-box and return to the NOD32 Control Center to specify the password. All profiles with password protection selected will be protected by the same password. Selection or modification of the password is described in the password section of the NOD32 Control Center.

See Advanced Setup for management of the warnings and messages that are available after selecting the Advanced button.

To set the current profile as default, select the Set as default check-box.


Profile Selection

The NOD32 scanner may use a particular set of the key scanning parameters, saved as a profile. The scanning profiles are created (defined) as follows from within the NOD32 program:

  1. Select the Profiles tab
  2. Click the Profile... button
  3. Click the New button
  4. Enter a name for the new profile
  5. Click the Save button


Save the Settings

Click OK to save the settings to disk.


If NOD32 Finds a Virus

NOD32 has an unprecedented detection track record. The number of new viruses increases by several hundred a month, so virus attacks are very common. However, NOD32 is your most reliable line of defense.

The NOD32 Antivirus System is equipped with a powerful heuristics engine. The heuristics engine allows detection of a large portion of yet unknown (i.e. not analyzed) viruses with a minimum number of false alarms. If a suspected new virus is detected, the Virus Log of NOD32 will declare this virus as a probable unknown infiltration. We recommended that any such supposedly infected files be sent via e-mail to Eset’s labs for detailed analysis. Please send the suspicious file sample to:

sample@eset.com

If an infiltration is found, run the scan again by selecting the Clean button rather than Scan. In “cleaning” mode, if an infiltration is found, actions are offered to clean or neutralize the infection. In most cases, NOD32 is capable of cleaning a detected virus. Note that with most of the recent computer worms, the entire file is the worm body, so it is simply deleted.

If you are not sure about a particular file, please send a copy to the address specified above.


Add a Directory or File into the List

Add a Directory or File into the List of Scanned Objects

In addition to selection of entire disks as scanning targets, NOD32 supports the selection of individual directories (folders) and files.

To select a directory or file to scan with the on-demand scanner:

  1. Click the Add button
  2. Enter the directory or click the Directory button (to browse the disk) or click File to browse available directories
  3. Select directory or file and confirm.


About NOD32

The NOD32™ Antivirus System

Copyright ©1992-2003 Eset®


Command Line Parameters

The NOD32 scanner can be executed in four ways:

  1. From the main window of the NOD32 Control Center
  2. From the desktop (by clicking the NOD32 icon)
  3. Automatically, as a scheduled task
  4. Automatically or manually by command line execution

When running the scanner from the command line, a number of parameters and switches can be used to specify the various options.

The parameters and their effects:

Many parameters are enabled or disabled with a plus(+) or minus (-) sign. For example, to enable the scanner self-check use “/selfcheck+” , to disable it, use “/selfcheck-”.

General

  • /help Display the list of program switches
  • /selfcheck+ (-) Self-test enable (disable)
  • /expire+ (-) Enable (disable) the program expiration notice
  • /subdir+ (-) Enable (disable) the sub-directories scanning
  • /multi+ (-) Multiple diskette scanning enable (disable)
  • /sound+ (-) Sound warning enable (disable)
  • /list+ Create the list of all tested objects in the Log
  • /list- Include in the Log only the objects infected
  • /break+ (-) Enable (disable) testing intermission
  • /scroll+ (-) Enable (disable) Log scrolling
  • /quit+ (-) Quit/do not quit the program after scanning

Detection

  • /pattern+ (-) Enable (disable) testing using virus signatures
  • /heur+ (-) Enable (disable) heuristic analysis
  • /scanfile+ (-) Enable (disable) scanning of files
  • /scanboot+ (-) Enable (disable) boot sector scanning
  • /scanmbr+ (-) Enable (disable) master boot record (MBR) scanning
  • /arch+ (-) Enable (disable) archives (ZIP, ARJ and RAR) scanning
  • /pack+ (-) Enable (disable) internal runtime packer files scanning
  • /local Scan all local non-removable media
  • /network Scan all network disks
  • /ext=<LIST> Add a new extension to the list of tested files. (Multiple entries permitted, e.g., /ext=EXT1,EXT2
  • /all Scan all files regardless of extension

Heuristic analysis

  • /heursafe Set safe heuristic sensitivity (minimize false alarms)
  • /heurstd Set standard heuristic sensitivity
  • /heurdeep Set deep heuristic sensitivity

Protocol

  • /log+ (-) Enable (disable) Log file generation
  • /wrap+ (-) Enable (disable) text wrapping in the Log file
  • /logappend Enable Log file append option
  • /logrewrite Enable rewriting of the Log file
  • /logsize=N Set Log file to a maximum size of N KB)
  • /log=<FILENAME> Set the Log file name (e.g.: /log=NOD.LOG)

Cleaning

  • /clean Clean infected objects (if applicable)
  • /prompt Offer an action upon virus detection
  • /rename Rename infected files
  • /delete Delete infected files
  • /replace Replace the code within infected boot sectors with appropriate standard code

Note: If the switches: /prompt, /rename, /delete/ or /replace are used concurrently with the /clean switch, the corresponding action is carried out only if the virus can be cleaned.


Enter String

This dialog window is displayed if the user is prompted to enter a string.


Virus Detected

When a virus is detected the following options are available:

  • Clean – the antivirus system will attempt to clean the file. Some files may be damaged to the extent that cleaning is not available. Certain files can not be cleaned, since the entire file is the virus body. In these cases the file needs to be deleted.
  • Rename – will rename the file to prevent its execution.
  • Delete – the infected file will be deleted.
  • The No Action option closes the window without any additional action.
  • Move to quarantine – if this check-box is selected, the file is saved in the quarantine folder before any other action on the file is performed.
  • Display the warning window – turning off the warning window is not recommended under normal circumstances, however, it may be necessary if a massive infection has occurred.


Virus in Memory

NOD32 detected a virus in the memory of your computer.