NOD32 Control Center

The NOD32 Control Center is the central management program of the NOD32 Antivirus System. The system consists of the following resident modules and filters:

  • AMON – the resident (running in operating memory at all times) or "on-access" antivirus monitor. This program is the most crucial antivirus defense tool.
  • NOD32 – (also referred to as the "on-demand" scanner) this is the scanner executed manually by the user, or automatically by the scheduler.
  • IMON – this scanner provides the first line of defense by monitoring Internet traffic (smtp, ftp, http and other Winsock protocols).
  • EMON – the NOD32 Mail Scanner provides protection from email-borne viruses.

The other Control Center sections are:

  • Update – this program provides automatic Internet/network update of key system elements including the executables and virus signature databases (a valid username & password is required).
  • Logs – a management tool for maintaining the system, virus alert, and on-demand scanner logs.
  • NOD32 System Tools – includes a variety of tools making the use of the NOD32 Antivirus System's user-friendly and powerful features. Includes Quarantine, Scheduler/Planner, Information, and System Setup.

To open the NOD32 Control Center, click on the [image] icon located in the system tray (located to the left of the clock in the lower right corner of the screen). If the icon is unavailable, click on: Start -> Programs (All programs) -> Eset -> NOD32 Control Center.

Main Window

The main window of the NOD32 Control Center contains the list of installed system modules and features (the only exception is the on-demand scanner – its icon is available on the system desktop and it can also be executed as as a scheduled task). The following groups are available in the main window: Resident modules and filters, Update, Logs, and NOD32 System Tools. More detailed descriptions of each group are presented below. To navigate within the main Control Center window, use the mouse or up/down arrow keys.

Resident modules and filters

The Resident modules and filters are the scanners that remove existing virus infections and prevent new ones from entering your computer. Click on the following links to learn more about these modules

  • AMON - On-Access Scanner
  • NOD32 - On-Demand Scanner
  • IMON - Internet Monitor
  • EMON - NOD32 Mail Scanner

Update

  • Update - Provides setup for the automatic Internet update of all system components (virus signature databases and executables).

Logs

Performance monitoring of the NOD32 System programs (Update, AMON, On-demand scanner, IMON, etc.) is available in a centrally created system of log files and records. Activity of each module is stored in a separate log which can later be retrieved and inspected. For further details on available log files click on one of the following links.

  • System Log
  • Virus Log
  • On-Demand Scanner Logs

NOD32 System Tools

The NOD32 System Tools section includes Quarantine, Scheduler/Planner, Information, and NOD32 System Setup. For further information on each of these features, click on the corresponding item below.

  • Quarantine - management of the quarantine folder
  • Scheduler/Planner - a powerful program to schedule various tasks
  • Information - on the installed version of the NOD32 system and the computer's operating system
  • NOD32 System Setup - a general settings tool to configure graphics, interactivity, security, warnings/notifications, and the Log maintenance features of the NOD32 system

Buttons

The three buttons located in the bottom part of the main Control Center window can be used to hide the window, quit the application and invoke the on-line help system.

  • Hide – Hiding the window will not stop the program. All warning/notification messages will be sent if applicable.
  • Quit – Quitting the application will disable the notification system (warnings and event notification messages will not be sent).
  • Help – Invokes the interactive on-line help system.


Event Log

The Event Log stores information of all events that have occured. This log lists the following information:

  • Time - the date and time of occurrence of the event
  • Module - the name of the NOD32 module which generated the entry
  • Event - a brief description of the event

How to send detailed information about an incident to Technical Support (vendor or authorized distributor):

  1. Right-click the line whose details you wish to send
  2. Select Copy selected
  3. Open your e-mail program
  4. Enter the e-mail address of your distributor
  5. Fill out the Subject line
  6. Click in the space of the message body to relocate the cursor
  7. Click Edit, then Paste

The above procedure can also be used to include all detected viruses. To do that, select Copy all in step 3 above.

An alternative way of copying the entire log with all details onto the clipboard is to click the Copy selected icon located in the bottom left-hand corner of the window.

To delete individual log entries, or to clear the entire log, right-click in the log window and select from the pop-up menu.


Virus Log

The Virus Log section displays a window listing itemized information on the viruses detected by the NOD32 on-access modules (AMON, IMON, and NMS).

To access the list, click the Virus Log item under Logs in the main NOD32 Control Center window.

The following information is provided by the “Viruses” window:

  • Time - lists the time that a particular virus was detected
  • Module - displays the NOD32 module responsible for the virus detection
  • Object - lists the type of infected object
  • Name - provides the name and folder of the infected object
  • Virus - the name of the virus detected
  • Action - the action performed by NOD32 when the virus was detected
  • Info - additional information about the incident

To get more detailed information on an incident, double-click on the line in the log.

How to send detailed information about an incident to Technical Support (vendor or authorized distributor):

  1. Right-click the line whose details you wish to send
  2. Select Copy selected
  3. Open your e-mail program
  4. Enter the e-mail address of your distributor
  5. Fill out the Subject line
  6. Click in the space of the message body to relocate the cursor
  7. Click Edit, then Paste

The above procedure can also be used to include all detected viruses. To do that, select Copy all in step 3 above.

An alternative way of copying the entire log with all details onto the clipboard is to click the Copy selected icon located in the bottom left-hand corner of the window.

To delete (clear) the log, right-click in the log window and select Clear log


NOD32 Scanner Logs

The NOD32 (On-Demand) Scanner log lists the following information:

  • Scan Date & Time
  • Description of directories scanned
  • Total number of scanned, infected, and cleaned files
  • Scan status

Double-clicking any entry with the mouse will show more detail about that scanning session. To delete an entry right-click on it and select "Delete selected" from the pop-up menu.


Quarantine

As of version 2.0, NOD32 supports a file quarantine system.

In most cases, NOD32 is capable of cleaning infected files. In cases where an infected file cannot be cleaned, you may send it to our labs for detailed analysis. The quarantine folder is a convenient location to store infected or suspicious files in a benign form. (That is, in a form that can't be executed.) The location of the quarantine directory is set by default, but it can be changed in the Extended Tab of the NOD32 System Setup page.

Note that in many cases (especially with Win32 worms), the “infected” file is just the body of the worm. Since a file of this type contains no useful data, it is simply deleted instead of cleaned.


Scheduler / Planner

NOD32 provides a very powerfulScheduler/Planner module. The most commonly scheduled tasks are:

  • NOD32 - scanning (on-demand)
  • Update - NOD32 update
  • NOD32 Kernel - Execution of an external application

Each scheduled task is executed using its corresponding profile. A profile defines how a particular task is performed, and what parameters are associated with it during its execution. Profiles are created and named by the user.

To add a new task:

  1. Click on the [+] icon in the lower left corner of the Scheduled tasks window
  2. Select desired task from the pull-down menu
  3. Enter the task name and timing/triggering option from the available radio button list
  4. Select details for the selected option
  5. Select the action taken if the task can not be performed as specified
  6. Check the summary of the schedules task
  7. Click Finish to complete the specification or Back to change the settings
  8. Select a profile from the list of available profiles
  9. Click OK

The NOD32 Antivirus System comes with two factory predefined profiles:

  • Default scanning profile
  • Default update profile

The most important features of the Default scanning profile are the scanning targets (fixed drives) and the default scanning parameters such as: heuristics sensitivity, diagnostic methods, action applied if virus is found, etc. The basic characteristics of the Default update profile are the definition of the Internet update server and the frequency of the update attempts (every six hours).

The Scheduled tasks window contains the list of scheduled tasks, including their name, type, corresponding module, execution mode, special settings, and the time when the task was last triggered.

All defined tasks appear in the list of scheduled tasks, but execution of a particular task can be enabled or disabled with the check-box located to the left of the task name. To modify, delete, or execute a task, or to learn more details about a particular task, right-click the line and select an option from the context menu.


Add Scheduled Task

Select the task to schedule and click Next.


Scheduled Task

Click the following links for information on the types of task scheduling available:

  • Once
  • Repeatedly
  • Daily
  • Weekly
  • Event triggered


Task Execution - Once

The scheduled task will be executed once, at the specified time and date. To invoke a pop-up calendar, click the pull-down button of the date dialog.


Daily scheduled task

Daily scheduled tasks are performed at a predefined time each day.


Weekly scheduled task

The scheduled task will be executed at the specified time on the selected day(s).


Event driven task

Event triggered task

An event triggered task is executed if certain condition (event) has occurred. Available events include:

  • every computer startup
  • the first computer startup of the day
  • modem connection to the Internet
  • successful update of virus signature databases
  • successful update of NOD32 executables

Other conditions may be imposed to limit the execution of a task in spite of the occurrance of a triggering event.


Task Execution Failed - Action

If the scheduled task execution failed for some reason (e.g., the computer had been turned off), the follow-up action can be defined in this window:

  • Execute the task at next predefined time
  • Execute the task as soon as possible
  • Execute the task immediately, if more than a certain number hours have elapsed since the last execution of the task.
    If you wish to apply this option, select the number of hours before the action is triggered.


Summary of the Scheduled Task

This window displays the summary of the task's selected options. To change any of the options click Back, otherwise click Finish.

Some tasks allow for certain specific additional options, for example, a profile. If applicable, select the available check-box to specify further details of the scheduled task.


Run external application

To schedule execution of an external application, you have to specify the filename of executable, its working directory, and command-line parameters, if any.


Information

The Information section contains information about:

  • The Installed NOD32 System
  • Installed System Components (NOD32 modules)
  • Running Operating System

All information within this section is needed if you file a problem report or contact our support staff. Before you do so, make sure the latest version of the NOD32 System is installed on your computer. Many support problems are due to the use of an outdated version of NOD32.

To find the most current version of the system and signature files, go to www.nod32.com

The most recent version of the NOD32 system is listed on our website. If the version found in the second line (virus signature database) of the Information section differs from the latest currently available, immediately update your system and perform on-demand scanning of your entire computer.

Before contacting Eset or your closest authorized distributor, make sure you have performed the aforementioned steps. When sending your support request by e-mail, we recommended that you use the convenient “Copy to clipboard” button.

To use this feature:

  1. Click the “Copy to clipboard” icon located in the bottom section of the window, to copy the contents of the Information section to the Clipboard
  2. Open your e-mail client and compose a new e-mail message
  3. Click the mouse cursor in the body of the message and
  4. While holding down the Ctrl key, press the V key to paste the information into your e-mail message


Setting

Settings

The NOD32 System Setup menu (located in the NOD32 System Tools window of the Control Center) provides access to the following system parameters:

  • General (Graphics, Silent mode, Password protection, listing of default system tasks)
  • Notification (SMTP, Windows® Messenger service, and message formatting options)
  • Log Maintenance (parameters for the recorded logs and their maintenance)
  • Extended (location of the quarantine folder, time interval a message window remains displayed, Terminal Services options)
  • Remote control (specification of the network management server)

The Settings window of NOD32 System Setup provides a quick summary of the following options:

  • Use of graphics: whether NOD32 supports application-specific graphics or Windows® system graphics.
  • Password-protected settings: the values of key system settings can be password protected.
  • Sending messages via SMTP: communication by NOD32 modules with the user or other authorized personnel via email
  • Sending messages via LAN: communication by NOD32 modules with the user or other authorized personnel via the Windows® Messenger service
  • Silent mode: suppresses non-critical interaction of NOD32 with the user
  • Listing of NOD32 system tasks: controls display of system tasks performed by NOD32 modules


General Settings

The General Settings window is divided into four groups:

Graphics

NOD32 windows can be displayed in two modes. By default (and if available hardware supports it) application-specific graphics are used. Otherwise, a standard windows layout is applied.

To disable the splash screen display at startup, select the corresponding check-box.

Silent mode

To avoid display of messages that are not vital, silent mode can be activated. Virus warning messages will still be displayed if a virus is detected by AMON. Activation of Silent mode is especially appropriate in a network environment to reduce interaction of users with the system.

Protection of Setup Parameters

To protect vital setup parameters of the NOD32 System, click the Setup button to invoke the password setup window. Keep the password in a safe location.

Default System Tasks

These tasks are important for normal operation of the NOD32 System. Unless there is a good reason to modify these tasks, it is not recommended to select this option. An example of a system task is maintenance of the system logs.


Setting - Notifications

Setup - Notifications

The Notifications tab is used to configure communications between NOD32 and a remote user or system administrator. There are two type of messages that NOD32 can send remotely:

  1. Virus warning messages
  2. Event notification messages

Two alternative communication channels (mechanisms) can be configured to send messages:

  1. SMTP (e-mail)
  2. Windows® messenger system

To send messages via SMTP server:

  1. Check the Send notifications via SMTP check-box
  2. Enter the SMTP server name
  3. Enter the sender address (e.g. nod32@domain.com)
  4. Enter the recipients' addresses, separated by semi-colons (;), if more than one.

NOTE: More than one addressee can be specified. Enter multiple addresses separated by the ";" character.

To send messages via the Windows® messenger service:

  1. Select the “Send warnings to a LAN computer” check-box
  2. Enter the destination computer names

You can also specify advanced features of the NOD32 message system. To do so, click the Setup button located in the Advanced tab.


Log Maintenance

A vital feature of NOD32 system is the generation of log files. Unless properly managed, the log files would eventually take up too much space. To prevent this from happening, logs in the NOD32 system have a defined lifetime. This can be set in the Log Maintenance Tab. It is recommended to keep the 30-day log lifetime.

The Log Lifetime group contains two check-boxes. The upper one pertains to general log events, such as updates, upgrades, and virus detections by the on-access scanner (AMON). The lower check-box deals with on-demand scanner logs only.

The Maintenance group is used to set parameters for the defragmentation procedures of various log files. It is not recommended to change the default settings.

To trigger defragmentation manually, click the Defragment button.


Extended Setup

Advanced Setup

The Advanced Setup tab serves to configure special features of the NOD32 Control Center.

Automatically close message windows – to close pop-up windows automatically after a certain period of time, select this check-box and specify the time interval.
Terminal Server / XP Fast User Switching – warning messages are sent to the user whose actions triggered the messages. If a user can not be identified (the action triggering the message has been caused by the system), the message will be sent to the user specified in the text box.
Quarantine folder – all infected (or potentially infected) files are stored in this directory, encoded to prevent execution. Storing files in this directory by different NOD32 modules needs to be specified during the configuration process of each particular module.


Remote Administration

The Remote Administration tab serves to specify the connection parameters of the Remote Administration Server.


Scan setup

Scan setup window contains basic scanning options (objects and methods) of the on-demand scanner, the way the output scanning log is formatted and named and, finally, the way system reacts when a virus is detected.

To select a particular type of objects to scan, select desired checkbox in the Objects to diagnose specific group in the list (Files, Boot sectors, Operating memory, Runtime packers, Archives and E-mail files(databases)).

The first three of the aforementioned options are set in the default mode. Selection of archive scanning should only be used under special circumstances.

Diagnostic methods group contains two chceckbox to select method of diagnostic. There are two basic scanning methods:

Virus signatures - The signature scanning relies on analysis of previously know virus infiltrations and their corresponding virus signature database.

Heuristics - Is a sophisticated suite of algorithms which allows detection of yet unknown viruses.

It is not recommended to disable any of the above scanning methods. The highest protection is provided by concurrent use of both the aforementioned methods.

Heuristics sensitivity, a relating group in the right hand side of the Tab, has been carefully optimized and the Standard level should be used. Selection of Deep level might result in increased number of false alarms.

The System groups contains three checkbox:

"List all files" checkbox, if selected, will result in inclusion of all scanned file in the scanning log.

"Sound alert" checkbox sets the sound alert of the on demand scanner triggered by detection of a virus.

"Use MAPI interface" provides MAPI support to scan Microsoft (R) Outlook databases.

The Scanning Log group defines basic characteristics of the scanning log. Selection of the "Append" radio button casuses new scanning log to be appended to the old one.

If the size of a new scanning log is larger than the value defined by the "Maximum size" parameter, the old scanning log is deleted completely, however, the new scanning log is saved entirely, in spite of its volume beingin excess of the defined limit.

To change the list of the extensions of the files to be scanned, click the Extension button.

To set advanced features of the on-demand scanner (communication/warning messages), click the Advanced button.


Actions

A virus can be detected in a number of different objects, such as: files, archives, self-extracting archives, run-time packers, and e-mail).

To specify the action performed when a virus is detected in a particular object:

  1. Select the type of object from the pull down menu
  2. Click desired radio button from the list

The default selection is recommended. In some special cases of a false alarm, immediate deletion of the supposedly infected file might lead to loss of data.

If a file cannot be cleaned, the follow-up action can be selected from the menu on the right side of the Tab. In any case, the infected file can be stored in the quarantine folder.

To restore the default set of actions, click the Default button.


Virus Alert

The Virus Alert window is displayed when a virus is detected.

A brief message describing the name and location of the infected file is displayed and actions selected in the Action Tab are offered.

In the default mode, the “Display this warning window” check-box is selected. Disabling this option is not recommended. If the option is disabled, make sure that sending of warning messages to the system administrator or a dedicated person is enabled and configured.


Display of the alert window

Display of the Warning Window

The Warning Window dialog allows the selection of the action to be executed when the window is displayed. The Warning Window can be turned off altogether, which may be needed in the case of a massive infection where a particular automatic action is desired.


Notification Messages Setup

NOD32 virus warning and notification messages have a predefined default format. The default format will be optimal for most situations. In some circumstances (for example, if you have an automated email processing system) you may need to change the message format. Keywords (strings separated by % signs) are replaced in the message by the actual information specific to the alert. The following keywords are available:

  • %TimeStamp% - date and time of the event
  • %ProgramName% - the module that generated the alert
  • %ComputerName% - NetBIOS name of the computer where the alert occurred
  • %InfectedObject% - name of infected file, message, etc.
  • %VirusName% - identification of the infection
  • %ErrorDescription% - description of a non-virus event

Use the Default button to reset the formats to their default values.

To change the length of the interval between notification (if any) sent via LAN, enter the desired time interval in seconds.


Change password

To change the password protection for the Setup Parameters:

  1. Click the Setup button in the General Tab of NOD32 System Setup window
  2. Enter the old password
  3. Enter the new password
  4. Confirm the new password by entering it again

You can also select the “No password” button to remove password protection.


Password

To avoid unauthorized modification, the setup parameters can be password protected. This feature is especially convenient if a computer is accessed by less experienced users. To remove the password protection, click the No Password button.


Enter Password to Unlock

Password protected settings can only be modified if the correct password is entered.


Add new extension

The list of file extensions to scan are pre-selected, by default, for optimum safety and efficiency. If a new threat requires addition of a new extension, Eset will release a new update. Therefore, in normal use, we do not recommend selecting the option: “Scan all files”, since this would slow down the scanning process unnecessarily.

WARNING! Removal of any default extension is not recommended and could lead to loss or damage of your data.

The Extension Editor window also has options for scanning all files and files with no extension (generally unnecessary).


Extension Editor

The Extension Editor is a special feature and its use is not recommended unless you are an advanced user. The set of file extensions to be scanned is constantly being updated and you are provided with regular updates as needed. Removing any of the default extensions might result in an infection of your computer!

Extensions list

The list of file extensions to be scanned is presented in the main section of the window. Use the scroll bar on the right-hand side of the window to navigate through the list. To highlight an extension, click on it with your mouse.

Buttons

  • Confirm - Any modifications to the list of extensions must be confirmed using the Confirm button.
  • Cancel - The Cancel button closes the window and returns control to the Setup tab.
  • Add - To add an extension, click on the Add button, fill out the dialog line, click on OK and the Confirm button.
  • Remove - To remove an extension (may result in security threat), highlight it, click on the Remove and Confirm button.
  • Default - To restore the default set of extensions (recommended) click on the Default button and Confirm.

Checkboxes

  • Scan extensionless files - This checkbox includes scanning of files with no extension.
  • Scan all files - Select this option to scan all files by default. When this option is selected the Extension Editor reverses the function of the main dialog box: a list of extensions of the files to exclude from scanning can be created in the extension window. In addition, a new checkbox appears allowing exclusion of extension-less files from scanning.


NOD32 Scanner Log

NOD32 Scanner Logs

The NOD32 (On-Demand) Scanner log lists the following information:

  • Scan Date & Time
  • Description of directories scanned
  • Total number of scanned, infected, and cleaned files
  • Scan status

Double-clicking any entry with the mouse will show more detail about that scanning session. To delete an entry right-click on it and select "Delete selected" from the pop-up menu.


Scanner setup

Scan setup window contains basic scanning options (objects and methods) of the on-demand scanner, the way the output scanning log is formatted and named and, finally, the way system reacts when a virus is detected.

To select a particular type of objects to scan, select desired checkbox in the Objects to diagnose specific group in the list (Files, Boot sectors, Operating memory, Runtime packers, Archives and E-mail files(databases)).

The first three of the aforementioned options are set in the default mode. Selection of archive scanning should only be used under special circumstances.

Diagnostic methods group contains two chceckbox to select method of diagnostic. There are two basic scanning methods:

Virus signatures - The signature scanning relies on analysis of previously know virus infiltrations and their corresponding virus signature database.

Heuristics - Is a sophisticated suite of algorithms which allows detection of yet unknown viruses.

It is not recommended to disable any of the above scanning methods. The highest protection is provided by concurrent use of both the aforementioned methods.

Heuristics sensitivity, a relating group in the right hand side of the Tab, has been carefully optimized and the Standard level should be used. Selection of Deep level might result in increased number of false alarms.

The System groups contains three checkbox:

"List all files" checkbox, if selected, will result in inclusion of all scanned file in the scanning log.

"Sound alert" checkbox sets the sound alert of the on demand scanner triggered by detection of a virus.

"Use MAPI interface" provides MAPI support to scan Microsoft (R) Outlook databases.

The Scanning Log group defines basic characteristics of the scanning log. Selection of the "Append" radio button casuses new scanning log to be appended to the old one.

If the size of a new scanning log is larger than the value defined by the "Maximum size" parameter, the old scanning log is deleted completely, however, the new scanning log is saved entirely, in spite of its volume beingin excess of the defined limit.

To change the list of the extensions of the files to be scanned, click the Extension button.

To set advanced features of the on-demand scanner (communication/warning messages), click the Advanced button.


Interval of Task Execution

The scheduled task will be executed repeatedly, on the interval specified in the dialog.