NOD32 Installation Guide - ESET

NOD32 Installation Guide16Configuring UpdatesThe Advanced and Expert installation routes allow you to configureupdating options at this point.Clicking on the Change button will give control over program and signatureoptions, all of which can be configured after installation. It’s recommendedthat you leave these options as they are.ESET release regular updates to keep NOD32’s protectioncurrent, we strongly advise that automatic updating isleft enabled, to ensure that your computer has the bestprotection possible.

NOD32 Installation Guide17General SetupAdvanced and Expert mode installation now give several other options.The Silent modeoption can beset, so that onlyan administrator(set later) is sentmessages that do notrequire some userintervention.There is also anoption to ‘passwordprotect’ the settings– if you work on ashared computer, andyou don’t want otherpeople to be able tochange the NOD32configuration, youcan set a passwordof your ownchoosing (NOT the license password that was sent to you by ESET)on the configuration options, so that only you will be able to change theconfiguration.

NOD32 Installation Guide18Disabling ESET’s custom graphics & theNOD32 splash screenAt this point, Expert mode will also give you the option to use a standardwindows interface rather than the NOD32 default, and to disable the“Splash Screen” (a banner with NOD32 information on it) that comes upeach time you log onto Windows.

NOD32 Installation Guide19Warning distributionIf you wish to send a notification message to an administrator for example,this window gives you 2 options: to send a warning message by emailand/or by Windows Messenger system. If you are a single-user, there is noneed to check these boxes.In the next window, you will be able to enter the details of the recipients.

NOD32 Installation Guide20SMTP / Messaging OptionsIf your SMTP server requires authentication you mayconfigure that once the NOD32 installation has completed.At this point, you will only be able to enter the addressinginformation.Expert mode now allows you to configure alerting and messaging options.NOD32 has several configurable messaging options, which are particularlyuseful for networked computers, where an administrator looks after severalmachines. To configure the options at this point, you will require thefollowing details:Note: The example information in this screenshot has been added toillustrate the options - the options will be blank when the screen ispresented to you.SMTP ServeraddressDefault senderaddress andrecipient emailaddress(es)Windows MessengerrecipientsYou will need to ascertain the computer names, domain names or IPaddresses from the systems administrator in your network.If you did not check one or other of the boxes on the previous screen, thenthe unchecked option will be greyed out in this screen. If you chose neitheroption on the previous dialogue, this screen will not be shown.

NOD32 Installation Guide21ThreatSense.Net Early Warning SystemAt this point the Typical, Advanced and Expert installations converge.This is a system for automatic evaluation of files requiring further analysisin ESET’s labs and enables their automatic submission. If you chooseto enable ThreatSense.Net , it will also collect and submit anonymous,statistical data about detected infiltrations, which enables ESET to watchand evaluate the progress and severity of specific spreading threats.By clicking the Advanced setupbutton, you can amend the defaultsettings.

NOD32 Installation Guide22Detection of potentially unwantedapplicationsSome advertising and activity tracking companies complain aboutdetection that terms their software as Adware or explicitly calls it Spyware.NOD32 2.7 includes the detection of “potentially unwanted applications”.This setting includes some Adware and other not necessarily maliciousapplications. Though not always malicious, some Adware will often filla computer with a larger amount of file and memory baggage. Thisoverhead, though not necessarily a security risk, is extremely irritating andtroublesome to many users.

NOD32 Installation Guide23Access MONitor (AMON) ConfigurationAMON (Access MONitor) is a memory-resident (always running whencomputer is on) file scanning program. Automatic starting of AMON aftercomputer restart is a fundamental defense against malicious code. QuittingAMON is not recommended and should only be done under specialcircumstances. Execution of two different antivirus monitors (from differentproducts or companies) is not recommended since it may make yourcomputer slower and/or cause a system crash, especially on Windows NTsystems, might lead to serious problems.AMON is the most important line of antivirus defense. It is criticallyimportant to keep it running at all times using the most current versionof the virus signature databases and NOD32 program upgrades. AMONmonitors all potentially threatening actions on protected computers such asopening, executing, creating or renaming files.IMPORTANT:Do not enable another residentscanner from a 2nd anti-virusprogram, otherwise your systemcould become unstable.Typical installation: jump to page 30Advanced installation: continue to next pageExpert installation: continue to next page

NOD32 Installation Guide24Options for On-Demand ScannerConfiguration of On-demand scanning integration is available in the Expertand Advanced routes at this point.To allow easy access to the NOD32 On-Demand scanner, an icon can beplaced on the desktop during installation, if this is not desirable, this actioncan be prevented here.Context menu scanning (Enable on-demand scanner using mouse) allowsthe user to right click on a file or folder in Windows, and choose to scan itwith NOD32. This integration into the context menu can be disabled here.Neither of these options can be enabled after installation. Ifthey have been disabled here, the program will requirere-installation to enable these options.We recommend these options are left checked.

NOD32 Installation Guide25Document MONitor (DMON) ConfigurationMicrosoft Office documents (Word, Excel, etc.) can sometimes containviruses which infect other files when the document is opened. DocumentMONitor (DMON) provides protection against this sort of threat. Laterversions of Internet Explorer allow Microsoft Office documents to beopened within the browser, directly from the internet. DMON will monitorthese documents and prevent infiltration of a virus should an infecteddocument be opened.DMON is enabled by default in all installation modes, but can be disabled ifdesired in Advanced and Expert modes.

NOD32 Installation Guide26Internet MONitor (IMON) ConfigurationWhile the role of AMON is to provide real-time, resident, anti-virusmonitoring of a system and user actions, the IMON module protects yourcomputer from email and internet threats. To allow scanning of POP3 emailand while also using the internet, we recommend having IMON enabled.IMON is enabled by default in all installation modes, but can be disabled ifdesired in Advanced and Expert modes.IMON’s primary role is to monitor incoming email. The key advantage ofIMON is its ease of use. There is virtually no setup necessary since thismodule works with all email programs. IMON works on the winsock level(operating system level).If IMON is not enabled, the AMON module will still preventthe opening of infected attachments saved from email andthe internet. However, it is strongly recommended thatIMON be enabled while using email or the internet.

NOD32 Installation Guide27IMON Configuration (email)IMON will work correctly with most POP3 email clients, however there maybe cases where some incompatibility occurs, in which case, you can reducethe efficiency of IMON, to ensure that it works correctly.Notifications ofchecking can beadded to email,and this option canbe configured here(in Advanced andExpert routes)Reducing the efficiency of IMONmay mean that some features aredisabled, or that the performancemay be affected.Generally, it is not recommendedto enable IMON when installingNOD32 onto a server, as somesystem instability may occur.

NOD32 Installation Guide28IMON Configuration (HTTP)IMON can also check for infiltrations coming through the internet browser.The default option is to offer a choice of actions to the user whenan undesirable object is detected. IMON can also be configured toautomatically deny the download of the infected file.HTTP checking is enabled by default, but can be disabled during Advancedand Expert installations.

NOD32 Installation Guide29Email MONitor (EMON) ConfigurationEMON (Email MONitor), a complementary resident module, scans emailsincoming via MAPI interface. The MAPI interface hooks into the differentinterfaces of Microsoft Outlook. MAPI interface is used also when receivingemails from the Microsoft Exchange Mail Server via the Exchange protocol.Even if the MAPI Interface is not used on the computer, EMON will stillbe installed. E-mails incoming via the POP3 protocol will be checkedby IMON.

NOD32 Installation Guide30Completion of Setup ConfigurationAt this point all installation tracks reconverge, and the configurationphase is complete. This is the last point at which changes can be madeto the selected installation options, before the files are copied and theconfiguration completed.If you wish to change anyconfiguration parameters, use theBack button now.If you have enabled the AMONmodule, you should particularly ensure thatyou have no other resident (on-access)anti-virus scanner active before proceeding.To complete the installation with the selected configuration, click Next During the setup, you will see this message:

NOD32 Installation Guide31After installation has completed you will be required to restart yourmachine.You should ensure that no other anti-virus scanner will load at restart, saveany active work, and click Finish to restart the machine.If you do not wish to restart immediately,choose Restart later.NOD32 may not function correctly, andyour computer may not be protected from virusesuntil you have restarted your computer.Once your PC has re-started, open the NOD32 Control Center by clickingthis icononce, in the bottom right hand corner of your screen, look in the‘Update’ section and press the ‘Update now’ button to ensure you are up todate with ESET’s virus definitions.After that, go to the Threat Protection Modules section and click once on‘NOD32’. In the right hand screen, click the button for an ‘In-depth analysis’.This will give your machine an immediate and thorough scan.

NOD32 Installation Guide32Configuration.after installation

NOD32 Installation Guide33Configuring Profiles for manualor ‘On-Demand’ scanningThe first thing you might want to do is review the defaultprofiles so that NOD32 is scanning exactly what youwant, when you want. Open the Control Centre byclicking this iconin the bottom right hand corner ofyour screen (in the system tray near the clock).Then under the section ‘Threat Protection Modules’click ‘NOD32’and in the resulting right hand window, click ‘RunNOD32’.

NOD32 Installation Guide34Scanning TargetsAfter a few seconds, you will bepresented with the ScanningTargets window where you canchoose which drives are scanned(the ones selected will have a redcheck mark through their icon).

NOD32 Installation Guide35SetupNext, move to the Setup tabwhere you can alter the defaultsettings to suit your personalpreferences of what is scannedwhen running NOD32 for an‘On-demand scan’. You canadd or exclude certain file typesif desired and you can sendmessages of warnings to anothermachine or an administrator.Details for the latter need to beentered in the NOD32 System Setup Notifications area.

NOD32 Installation Guide36ActionsThen move to the Actions tab where you can change the default settings ifyou wish.You can select: Files Boot sectors Archives Self-extracting archives Runtime packers Email Email folders Operating memory(depending on your selectionsin the next section: ‘Setup’) and choose what actions youwould like NOD32 to perform ifan infiltration is detected.You can choose to ‘Quarantine’a suspicious file for most of thetypes of objects just mentioned,which means that a copy of the‘malware’ will be placed in the ESET folder(C:\All Programs\ESET\infected). This canthen be sent to ESET for analysis if absolutelynecessary.If you choose ‘Clean’ as the action to take ‘If a virusis found’ and it is not possible for technical reasonsto clean a particular file, there are some secondaryactions that can be activated in the right hand column in this window.(Refer to Dealing with alerts and virus incidents on page 46, for moreinformation)

NOD32 Installation Guide37Profile savingThe last tab in this section is for Profiles. By default, the program will usethe Control Center Profile. If you’ve made some changes on the previoustabs, you can now save them to Control Center Profile, or to My Profile ifyou wish.There are also some pre-set Profile headings for Floppy Disk, In-DepthAnalysis and Local Disk scanning, so there are numerable variations forOn-Demand Scanning options.The Context Menu Profile refers to scanning an individual file or folder byright-clicking on it. When you do so, a drop down panel will give you varioussystem options; one of them isto get NOD32 to scan the fileor folder for infections. This is avery useful quick check beforeopening any file.Some users might want to set upanother profile for some specificscanning of certain media. Youcan create a new name for it hereby clicking the Profiles buttonin the lower part of the window.Then you can setup some newparameters and save them underthis profile.It’s also possible to use Password Protection to stop otherusers changing profile settings.First, you must setup Password Protection. You mayhave already selected this during installation. In the mainControl Center window, enter the NOD32 System Toolssection and then look in the NOD32 System Setup area.Then click ‘Setup’ and you will see the area for settingyour password. The password is totally of your inventionand should NOT be confused with the username andpassword that ESET send you with your license email.Make sure the password is easy for you to remember,but if you did forget it, you can “unlock” NOD32 again bygetting this unlocking utility from our website:http://www.eset.com/files/unlock.exe

NOD32 Installation Guide38Finally, the Scanning Log tab shows exactly what’s going on when a scan isinvoked.Scan buttonThis will invoke a scan of yourselected drives (as you’vespecified in Scanning Targets)and you will see all the files beingscanned in the window. If theOn-demand scanner finds aninfiltration or potential infiltration,it will be displayed in red in thiswindow. You can then eitherchoose to click the ‘Scan & Clean’button as described below, or rightclick on the log entry and from thedrop down context menu, choose‘Clean’. The latter is the far quickermethod if any infections aredetected.Once the scan has been started, the ‘Scan’ button changes to a ‘Pause’button. This might be useful in case you wanted your PC to perform a taskin another application while the scan is running, with as little performanceslow-down as possible.Once the scan has been started, the ‘Scan & Clean’ button changes to a‘Stop’ button in case you wanted to terminate the scan before it finishes.Scan & Clean buttonThis will also invoke scanning of your selected drives and directories, butwill automatically perform the relevant action (Clean, Prompt for an action,No action, Rename, Delete, Replace, Copy to Quarantine) that you havechosen in the ‘Actions’ tab.

NOD32 Installation Guide39ScanningThe Scanning Log window does not need to be watched in real time .youcan wait until it’s finished to review the complete log entries. The scan cantake a few seconds or several minutes, depending on what you have askedto be scanned and in how much depth. When finished, you can review thescanning log. Any suspicious files will be shown in red and the path will beshown of where they are residing on your machine. You can right-click onthese red notes and choose ‘Clean’ at this point.In the screenshot above you will noticethe items C:\pagefile.sys - error opening(Access denied) [4], C:\hiberfil.sys error opening (Access denied) [4], etc.This is perfectly normal and is nothing to worryabout. The files are being exclusively used by youroperating system and nobody, not even NOD32,has permission to look inside them. At the end of thescan, you will see a brief comment of explanation(see inset screenshot above).At any time you can review previoussystem scans in the Logs section in theControl Centre. Look in NOD32 ScannerLogs.Equally, you can review details in the Threat Logif any infections have been found and the EventLog will give details of updates, connection errors,warnings, etc.

NOD32 Installation Guide40On-demand scanningSo, you’ve setup the scanning profiles to your liking, or maybe you’vechosen to stick with the default settings, and run a scan of your PC. Nowyou can instigate a scan of a specific drive on your computer, or specificfiles, or a Floppy disk or CD, etc. using your pre-defined setups savedunder the Profiles tab. This iscalled an On-demand scan.In the Control Centre, under‘Threat Protection Modules’,click ‘NOD32’ and in the righthand window click one ofthe 4 buttons that suits yourrequirements: ‘Local’ to instantly start a scanof all local drives ‘Run NOD32’ to open the setuptabs as previously mentionedin Profiles on page 32 ‘Diskettes’ to instantly start ascan of any floppy diskettes ‘In-depth analysis’ to instantly scan everything on your machine withmore depth than a standard scan. This scan has it‘s own prESET, indepth parameters, with everything set to maximum, so is not governedby the Profile(s) you have previously setup. This scan could thereforetake much longer than a normal scan.

NOD32 Installation Guide41On-access scanning (AMON)This is when you attempt to open a file and NOD32will automatically check it f

NOD32 Installation Guide 4 Introduction Congratulations, you have just purchased NOD32