INSTALLING NOD32 - ESET NOD32 Antivirus … Setup Tutorial INSTALLING NOD32 ... Place in the Username (UN) ... Send the quarantined file to Eset: [email protected]

NOD32 Setup Tutorial

INSTALLING NOD32

Double clicking on the Nod32 executable file that has been downloaded begins the setup process. 1. Click “Extract”.

Page 1 of 76


1. It is recommended to initiate a “Typical” install unless one has previous experience with Nod32 and is comfortable navigating through the program's settings. 2. Click “Next”.

Page 2 of 76


1. Click on the Radio Button that reads “I agree”. 2. Click “Next”.

Page 3 of 76


Please LEAVE Server as <Choose automatically> for the following reasons: * If a particular server is down, Nod32 will NOT be able to roll on to the next server. * Experience shows that one will have fewer or no problems with updating using this setting. * Let Eset do their job and balance loads on the servers. 1. Place in the Username (UN) that the Partner/Distributor or Nod32 email has provided. 2. Place in the Password (PW) that the Partner/Distributor or Nod32 email has provided. ONLY a UN and PW provided by Eset will work. These are not personalizable entries created. 3. Click “Next”.

Page 4 of 76


1. Leave this Radio Button as is, UNLESS one uses a modem that dials onto the internet. 2. Click “Next”.

Page 5 of 76


Nod32 has been purchased for its ability to protect a computer. Help Eset to continue in its efforts by leaving “Enable ThreatSense.NET Early Warning System” checked. 1. Click here to see what information is sent to Eset. 2. Click “Next”.

Page 6 of 76


1. Make a choice, we hope that one participates and chooses the middle or lower option. 2. The information sent is anonymous. One may want to add an email address here in case Eset would like to have further contact regarding what is being sent.

Page 7 of 76


1. Click on “Next”.

Page 8 of 76


1. Leave this checked so the resident scanner (AMON) will start automatically upon booting one’s system. 2. Click “Next”

Page 9 of 76


1. Click “Next”.

Page 10 of 76


1. Click this Radio Button to restart the system. 2. Click “Finish” to complete the installation.

Page 11 of 76


Welcome to Nod32, this is the Nod32 splash screen that first appears upon bootup of your system (if this option is turned on).

Page 12 of 76


The “Nod32 Control Centre” is located in the “System Tray”, at the bottom right hand corner of the desktop. Double Click on this icon.

Page 13 of 76


AMON 1. Click on “AMON” 2. Click on “Setup”

Page 14 of 76


1. Click on the “Options” tab. 2. Place a check in “Potentially dangerous applications”.

WARNING: enabling this option may result in deletion of Remote Adminstrative programs such as those used by network administrators.

Page 15 of 76


1. Click on the “Actions” tab. 2. Choose a Radio Button that suits one’s needs. If one is new to Nod32 or a novice with a computer, one may want to have Nod32 “Clean automatically”, however, should AMON find a “False Positive” it will delete the file even if it proves to be non-viral at a later date. Though this remains a possibility, it is unlikely for the average user.

Page 16 of 76


If one is having issues with a particular file or directory, one may be directed here in order to exclude such a file or directory. 1. Click “OK”

Page 17 of 76


DMON 1. Click on “DMON”. 2. Click on “Setup”.

Page 18 of 76


1. Click on the “Setup” tab. 2. Place a check in “Potentially dangerous applications”.

Page 19 of 76


1. Click on the “Actions” tab. 2. Choose a Radio Button that suits one’s needs. If one is new to Nod32 or a novice with a computer, one may want to have Nod32 “Clean” if a virus is found and “Delete” Uncleanable viruses, however, should a scan find a “False Positive” it will delete the file even if it proves to be non-viral at a later date. Though this remains a possibility, it is unlikely for the average user. 3. NOTE: ENSURE Quarantine is checked with EVERYTHING that is detected BEFORE one DELETES anything that is ever found. 4. Choose a Radio Button that suits one’s needs. If one is not sure whether it is safe to delete an infected file, quarantine allows restoration of a file at a later time/date. If a “Probable NewHeur_PE virus found”, please do the following: 1. Place a check in the Quarantine check-box 2. Select Delete 3. Send the quarantined file to Eset: [email protected] Files can be found here: C> Program files> Eset> Infected Note: this folder will only be displayed/made when one first receives an infected file and it is sent to Quarantine. NOTE: Quarantine ONLY copies the Virus or Trojan found so it can be sent to Eset for further analysis, it does NOT isolate the Virus or Trojan. 5. The actions chosen are for specific file types, in this instance “Files”. Clicking on the dropdown arrow reveals the next choice.

Page 20 of 76

mailto:[email protected]


Page 21 of 76


1. Choose a Radio Button that suits one’s needs. The same advice for each choice with 1, 2 and 3 can be found in the section that covers DMON> Actions tab. Clicking on the dropdown arrow reveals the next choice.

Page 22 of 76


1. Choose a Radio Button that suits one’s needs. The same advice for each choice with 1, 2 and 3 can be found in the section that covers DMON> Actions tab. Clicking on the dropdown arrow reveals the next choice.

Page 23 of 76


1. Choose a Radio Button that suits one’s needs. The same advice for each choice with 1, 2 and 3 can be found in the section that covers DMON> Actions tab. 5. Click on “OK”.

Page 24 of 76


EMON Note: EMON is only used when Microsoft Office is detected. i.e. MS OUTLOOK 2000, 2002, 2003 etc. (not Outlook EXPRESS) 1. Click on “EMON”. 2. Click on “Setup”.

Page 25 of 76


1. Click on “Scanner” 2. Place a check in “Scan plain text message bodies”. I know, but they said the same thing about jpeg files

Page 26 of 76


1. Click on “Detection”. 2. Place a check in “Potentially dangerous applications”.

WARNING: enabling this option might result in deletion of Remote Adminstrative programs such as those used by network administrators.

Page 27 of 76


1. Click on “Extensions”. 2. Place a check in “Scan extensionless files”.

Page 28 of 76


1. Click on the “Actions” tab. 2. Choose a Radio Button that suits one’s needs. The same advice for each choice with 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 6. Clicking on the dropdown arrow reveals the next choice.

Page 29 of 76


2. Choose a Radio Button that suits one’s needs. The same advice for each choice with 2, 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 6. Clicking on the dropdown arrow reveals the next choice.

Page 30 of 76


2. Choose a Radio Button that suits one’s needs. The same advice for each choice with 2, 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 6. Clicking on the dropdown arrow reveals the next choice.

Page 31 of 76


2. Choose a Radio Button that suits one’s needs. The same advice for each choice with 2, 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 7. Click on “OK”.

Page 32 of 76


IMON 1. Click on “IMON”. 2. Click on “Setup”.

Page 33 of 76


1. Click on the “POP3” tab. 2. Click on “Compatibility Setup” > Setup

This is also where one will be instructed to go if one is having an issue with IMON.

Page 34 of 76


1. IMON’s compatibility setup can be adjusted by sliding this bar. It is best to leave as is, unless advised otherwise. 2. Click on “OK”.

Page 35 of 76


1. Click on the “HTTP” tab. 2. Click on the Radio Button that reads “Automatically deny download of file”. 3. Click on the “Client Compatibility” button. This is where one will be instructed to go if one is having an issue with a particular program. It is recommended to change the compatibility level to "Higher Efficiency" unless one experiences problems with certain applications.

NOTE: With “Higher Compatibility” mode it is possible that Trojans may slip through IMON.

Page 36 of 76


Page 37 of 76


1. Click on the “Miscellaneous” tab.

2. do NOT click this unless you are advised to, or you are seeing a slow internet connection. This button repairs the LSP chain (Winsock). 3. Click on “Scanner> Setup”.

Page 38 of 76


1. Click on the “Setup” tab. 2. Place a check in “Potentially dangerous applications”.


Page 39 of 76


1. Click on the “Actions” tab. 2. Choose a Radio Button that suits one’s needs. The same advice for each choice with 2, 3 and 4 can be found in the that covers DMON> Actions tab. 5. Clicking on the dropdown arrow reveals the next choice.

Page 40 of 76


1. Choose a Radio Button that suits one’s needs. The same advice for each choice with 1, 2 and 3 can be found in the post that covers DMON> Actions tab. 4. Clicking on the dropdown arrow reveals the next choice.

Page 41 of 76



Page 42 of 76



Page 43 of 76


1. Choose a Radio Button that suits one’s needs. The same advice for each choice with 1, 2 and 3 can be found in the post that covers DMON> Actions tab. 4. Clicking on the dropdown arrow reveals the next choice. 5. Click on “OK”.

Page 44 of 76


NOD32

1. Click on “NOD32”. 2. Click on “Run NOD32”.

Page 45 of 76


1. Click on the “Scanning Targets” tab. 2. Ensure ALL Hard Drives are checked.

Page 46 of 76


1. Click on the “Scanning log” tab. 2. Place a check in “Scrolling”.

Page 47 of 76


1. Click on the “Setup” tab. 2. Place a check in everything found within “Scan”. 3. Place a check in “Advanced Heuristics”. A warning box will pop up regarding “Advanced Heuristics” and the use thereof, see the next post for further information. 4. Place a check in “Potentially dangerous applications”.


Page 48 of 76


1. Click on the “Actions” tab. 3. Choose a Radio Button that suits one’s needs. The same advice for each choice with 3, 4 and 5 can be found in the post that covers DMON> Actions tab. Clicking on 2. will reveal one’s next settings choices.

Page 49 of 76


2. Choose a Radio Button that suits one’s needs. The same advice for each choice with 2 and 3 can be found in the post that covers DMON> Actions tab. Clicking on 1. will reveal one’s next settings choices.

Page 50 of 76


1. Click on “More”. 2. Read enough information to satisfy one’s needs to make an informed choice and then close the popup Window.

Page 51 of 76


PROFILES

1. Click on the “Profiles” tab. 2. Place a check in “Run this profile in cleaning mode”. 3. Place a check in “Use this profile for scanning files/folders from with the context menu. 4. Click on “Quit”. 5. Save the changes that have been made. Each profile can have different scanning settings if desired, or Nod32 can scan exactly the same way in all profiles. Nod32 is just giving choices, and choices are good. It’s like having many pizzas and on each a different topping can be chosen. Or one favorite topping can be placed on all pizzas.

Page 52 of 76


Page 53 of 76


UPDATE 1. Click on “Update> Update”. 2. Click on “Setup”.

Page 54 of 76


1. Please LEAVE Server as <Choose automatically>, for many reasons: * If a particular server is down, Nod32 will NOT be able to roll on to the next server. * Experience shows us that one will have fewer or no problems with updating using this setting. * Let Eset do their job and balance the load on the servers. 2. One’s Username and Password will appear here if one has followed this tutorial from the beginning. Do not try to use a UN and PW that one has created, ONLY a UN and PW provided by Eset will work. 3. Click “Change”.

Page 55 of 76


1. It is advised to choose the Radio Button that has Nod32 “Perform program component upgrade if available” and “Offer computer restart if necessary”. NOTE: Due to the size of some program component updates, one may NOT want this setting if on a Dialup Internet Connection. 2. Click on “OK”.

Page 56 of 76


1. Click on “Advanced”.

Page 57 of 76


1. This is where one can set one’s type of connection if Nod32 has not already pre-configured it. 2. Click on Proxy server “Setup”.

1. This is where Proxy Server settings are placed. Click on “OK” until one is taken back to the next screenshot.

Page 58 of 76


1. One should now see this. 2. Click on “OK”.

Page 59 of 76


1. Various Log files can be found here. Should one need to, one can click on an entry in the right hand Window, then click on “Copy selected”. One can then paste what has been copied in to Notepad, or MS Word, etc.

Page 60 of 76


1. This is one of the places where Quarantined files can be submitted to Eset. The actual storage folder for Quarantined files can be found in C Drive> Program Files> Eset> Infected

Page 61 of 76


SCHEDULER / PLANNER NOTE: Adding a scheduled task and choosing one that has been configured with “Run this profile in cleaning mode” enabled will be a silent task (i.e. no user interaction or visible signs of the task being run except through the NOD32 Scanner Logs and the Hard Drive light flashing ☺ ) 1. Click on “Scheduler/Planner”. 2. Click on “Add”.

Page 62 of 76


1. In the dropdown box, choose “Nod32 Kernel – Execution of an external application”. 2. Click on “Next”.

Page 63 of 76


1. Choose a name for your task. 2. Choose a Radio Button that suits your needs. 3. Click on “Next”.

Page 64 of 76


1. Choose a time to run your task. 2. Place a tick in a day or days that you want to run your task. 3. Click on “Next”.

Page 65 of 76


1. Choose a Radio Button that suits one’s requirements. 2. This will prevent overlaps of a Scheduled Task if one chooses the Radio Button in the screenshot. 3. Click on “Next”.

Page 66 of 76


1. Click on the “Finish” button.

Page 67 of 76


1. Click on “Browse”. 2. Browse to where Nod32 is installed, typically where you see in this screenshot. 3. Click on the Eset folder. 4. Click on “Nod32.exe”. 5. Click on “Open”.

Page 68 of 76


Page 69 of 76


1. This is what should be seen. 2. Place in the “Command line” all appropriate “Switches” that suit your requirements. In this screenshot you will see that I am using /local this will scan all of my drives. 3. Click on “OK”. Here are the switches that should give the greatest and maximum strength scan: /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /pack+ /quarantine /quit+ /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+ Your scan settings will start with: C:\ (single space) /switches go here - see screenshot

Or Copy and Paste the following directly into the settings: C:\ /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /pack+ /quarantine /quit+ /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+

Or To scan ALL of the drives do NOT use C:\ use ONLY the following: /local /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /pack+ /quarantine /quit+ /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+ /local = Scan all local drives /adware = Enable detection of adware, spyware and riskware /ah = Enable advanced heuristics /all = Scan all files regardless of their extension /arch+ = Enable archives (ZIP, ARJ and RAR) scanning /clean = Clean infected objects (if applicable) /cleanmode = Enables cleaning mode (the actions taken will depend on the action

Page 70 of 76


settings) /delete = Delete the infected file /heur+ = Enable standard heuristics /log+ = Enable Log file generation /mailbox+ = Enable scanning mailboxes /pack+ = Enable internal runtime packer files scanning /quarantine Copy infected file to quarantine before taking further action (clean/delete) /quit+ = Quit the program after scanning /scanboot+ = Enable boot sectors scanning /scanmbr+ = Enable MBS scanning /scanmem+ = Enable scanning memory /scroll+ = Enable scrolling of the Log /sfx+ = Enable scanning self-extracting archives /unsafe = Enable detection of potentially dangerous applications /wrap+ = Enable text wrapping in the Log file GENERAL /break- = Disable testing intermission /break+ = Enable testing intermission /expire- = Disable the program expiration notice /expire+ = Enable the program expiration notice /help = Display the list of program switches /list- = Include in the Log only the objects infected /list+ = Create the list of all tested objects in the Log /quit- = Do not quit the program automatically after scanning /quit+ = Quit the program after scanning /scroll- = Disable scrolling of the Log /scroll+ = Enable scrolling of the Log /selfcheck- = Self-test disable /selfcheck+ = Self-test enable /sound- = Sound warning disable /sound+ = Sound warning enable /subdir- = Disable the sub-directories scanning /subdir+ = Enable the sub-directories scanning DETECTION /adware = Enable detection of adware, spyware and riskware /all = Scan all files regardless of their extension /arch- = Disable archives scanning /arch+ = Enable archives (ZIP, ARJ and RAR) scanning /exclude=<LIST> = Excludes a single particular file from scanning, multiple files can be selected using wildcards /ext=<LIST> = Add a new extension into the list of tested files. (Multiple entries permitted, e.g., /ext=EXT1,EXT2 /heur- = Disable heuristic analysis /heur+ = Enable heuristic analysis /local = Scan all local non-removable media /mailbox- = Disable scanning mailboxes

Page 71 of 76


/mailbox+ = Enable scanning mailboxes /network = Scan all network disks /pack- = Disable the runtime packer files scanning /pack+ = Enable internal runtime packer files scanning /pattern- = Disable testing using virus signatures/patterns /pattern+ = Enable testing using virus signatures/patterns /scanboot- = Disable boot sectors scanning /scanboot+ = Enable boot sectors scanning /scanfile- = Disable scanning of the files /scanfile+ = Enable scanning of the files /scanmbr- = Disable MBS scanning /scanmbr+ = Enable MBS scanning /scanmem- = Disable scanning memory /scanmem+ = Enable scanning memory /sfx- = Disable scanning self-extracting archives /sfx+ = Enable scanning self-extracting archives /unsafe = Enable detection of potentially dangerous applications HEURISTIC ANALYSIS /ah = Enable advanced heuristics /heur- = Disable standard heuristics /heur+ = Enable standard heuristics /heurdeep = Set deep heuristic sensitivity - technically Deep Heuristics no longer exists as it has a higher chance of producing False Positives. /heursafe = Set safe heuristic sensitivity (minimize false alarms) /heurstd = Set standard heuristic sensitivity PROTOCOL /log- = Disable Log file generation /log+ = Enable Log file generation /log=<FILENAME> = Set the Log file name (e.g.: /log=NOD.LOG) /logappend = Enable Log file append option /logrewrite = Enable rewriting of the Log file /logsize=N = Set Log file to the maximum size of N KB) /wrap- = Disable text wrapping in the Log file /wrap+ = Enable text wrapping in the Log file CLEANING /clean = Clean infected objects (if applicable) /cleanmode = Enables cleaning mode (the actions taken will depend on the action settings) /delete = Delete the infected file /prompt = Offer an action upon virus detection /quarantine Copy infected file to quarantine before taking further action (clean/delete) /rename = Rename the infected file

Page 72 of 76


Note: If the switches: /prompt, /rename, /delete/ or /replace are used concurrently with the /clean switch, the corresponding action will be carried out only if the virus cannot be cleaned. The further a parameter is listed, the higher priority it has. For instance, using the "/clean /delete /prompt " parameters will result in that the "/prompt " parameter will supersede the "/clean /delete" parameters. TEST SCHEDULING /daily = Automatic testing on a daily basis /period=N = Automatic testing once in N days /weekly = Automatic testing on a weekly basis NETWORK (Windows versions only) /centralpath=<PATH> = Specifies the name of the directory for Centralized Update files /msg="<MESSAGE>" = Specifies the message to be sent upon virus deletion. /recipient=<LIST> = Specifies the recipients of the network messages (server/s, group or workstation name). Multiple entries are permitted, e.g., /recipient=SERVER1,SERVER2

Page 73 of 76


1. The “Scheduled scan” just set up will now appear here.

Page 74 of 76


1. Right Click on the new scheduled scan. This will pop up a small window as seen in the screenshot. 2. Click on “Run now”. If the settings are correct, the next screenshot is shown when the scan starts.

Page 75 of 76


1. Using /local shows all local drives that are in the process of being scanned. 2. [4}Locked Files are password protected or Windows System Swap Files, and as such are locked by the Operating System and it is unlikely they will be infected.

Page 76 of 76

Documents

INSTALLING NOD32 - ESET NOD32 Antivirus … Setup Tutorial INSTALLING NOD32 ... Place in the Username (UN) ... Send the quarantined file to Eset: [email protected]