First Look: NOD32 antivirus version 3

Although it has it's annoyances, in general, I like NOD32 antivirus vesion 2, from ESET. But a new version was recently released and new software scares me. As I wrote about in November, I hold this truth to be self-evident:

All new software contains bugs and design mistakes.

I recently worked on a Windows XP computer whose copy of NOD32 version 2 had expired the day before. If it's possible to renew a copy of NOD32 v2, then finding out how eluded me. After clicking around everywhere in the user interface, and not being able to learn anything about renewing, I gave up and un-installed it.

(Credit: ESET)

The only indication I found, that the software had expired, was a single message buried in the middle of one of the log files. It would seem that a novice user could continue on their merry way without a warning that their software had expired.

But, that's a version 2 issue and I moved on to version 3, hoping that it was ready for prime time. Since the initial release, NOD32 version 3 has been revised three times.

Here is a first look.

The first thing any anti-malware (malicious software) program has to do just after it's installed is update itself with new malware definitions. This has been true since the product category was invented.

At this point in the game, it's reasonable to expect some sort of notice that the virus definitions are old and need to be updated. But NOD32 is mute. After installation, the user interface just sits there. It doesn't say anything or ask anything. In fairness, it might have triggered a warning from the Windows Security Center, but I turn off the Security Center because it is next to useless.

Turns out that NOD32 is smart enough to determine that an update is needed, and it performs the update in the background. But, just like Spyware Doctor, this is kept secret while the update is in-flight.

Despite the web site touting a 30 day free trial, I installed the trial software on January 1, 2008 and the license was only valid until January 19, 2008. Doesn't inspire confidence.

One of the first things I did was run some scans and then view the scan log. The difference here between Spyware Doctor and NOD32 was night and day. Whereas Spyware Doctor hardly logs anything about each scan, the NOD32 logs are very detailed and a pleasure to review (if you like that sort of thing).

In the course of running some custom scans, I noticed that each new scan included the files and folders selected for the prior scan (great activity logging). This turned out to be a small bug in the display of files/folders selected for the scan.

As the screen shot on the right shows, the selection tree view is pretty standard stuff. What is not standard however, is the checkboxes next to folders with sub-folders. As you can see, all the checkboxes are white, which normally means that no files or folders under that folder are selected. The bug is that there were some selected sub-folders but since the checkboxes were not the standard gray color, I didn't realize it.

While a scan is in-flight NOD32 shows the percent completed so far. During one scan, however, a second percentage was displayed underneath the main one. Adding to the confusion, the bottom percentage went up, then down, then back up, then down again, etc. etc. etc. I think this is because a large zip file was being scanned and my guess is that the bottom percentage is within the zip file. But other files didn't show a processing percentage, and it doesn't explain why the percentage kept going up and down.

Like version 2, a full scan with NOD32 version 3 generates oodles of messages, many of them errors. Again, I appreciate the level of detail, but some of the errors seem avoidable. The first one, as shown above, was an error opening the Windows page file. Windows has had a page file for a very long time. You would think ESET could have learned to deal with it by now.

The second error above was a problem opening a file. I mention it because the file, CACHE.NDB, belongs to NOD32. One part of the product is protecting files from being scanned by another part of the product.

Not to be too negative, the revised user interface in version 3 is an improvement. One thing in particular stands out, the option to use the product with a simple or advanced interface. I think this is a great idea, as it lets both non-technical and technical people use the software with an interface they are comfortable with.

But, there is more

This should have been the end of the story. When I first started writing this, it was. But the next morning (January 2nd), the computer owner contacted me about an error from NOD32. As the screen shot below shows, it complained about a userid and password.

To understand the error message you need to know that instead of simply getting a serial number as proof of ownership, ESET gives their customers a userid and password. When you install the free trial, a default userid and password is generated for you. The password is obscured, on one computer the userid was eavtrial48.

When you install the version 3 trial, none of this explained. All you are told is to enter the userid/password that ESET provides after you pay for the software. Nowhere in the instructions does say what trial users are supposed to do.

In this case, the same user/password that worked on New Years day, was now invalid.

Since I no longer had direct access to the computer in question, I downloaded the trial version of NOD32 v3 another Windows XP computer.

The download procedure had also changed overnight. On the first computer, I had to fill in a form on a web page and provide an email address before I could download the trial software. Not any more.

The basic installation of NOD32 on the second machine went fine, but then this copy too, couldn't update itself. It failed with the same error about an invalid userid/password. And, like the first computer, the trial expired on January 19th rather than in the advertised 30 days.

I contacted technical support at ESET and they responded fairly quickly:

"... In regards to your inquiry, the user name and password that was provided during installation has expired on our end and is not your fault. We are currently working on this issue. As soon as a new user name and password has been issued for the trial version you will be able to download and/or update your trial version of NOD32. If you have additional questions regarding your case or if the issue continues to persist please let us know by replying to this email..."

Three revisions to version 3 were apparently not enough. This is all too typical. As I mentioned earlier, new software scares me. It should scare you too.

Update: January 4, 2008. The problem with the invalid userid/password cleared itself up with no action on my part. The issue was on an ESET server, not on my computer. Added the simple and advanced interfaces.

FYI: CPU magazine just gave NOD32 an excellent review. They also tested the core anti-virus functionality, which I didn't. I'm just a blogger.

Technical information about NOD32 version 3 on the second computer
Product version 3.0.566.0
Virus signature database: 2658 (20071114)
Update module: 1019 (20071030)
Antivirus and antispyware scanner module: 1100 (20071112)
Advanced heuristics module: 1066 (20070917)
Archive support module: 1065 (20071109)
Cleaner module: 1021 (20071101)

See a summary of all my Defensive Computing postings.

[ruminator]

Dude, the truth you hold to be self-evident is so self-evident as to be trivial. Your neighbor's 1st grade child probably knows new software is buggy. In fact, your point is very confusd. You go on to say even 2nd and 3rd revisions are not much better than the original. So, your revised self-evident truth should leave out "new," and simply say "ALL SOFTWARE IS BUGGY AND HAS DESIGN MISTAKES." After all, is there any software new (still undefined by you) or old (also undefined) that is free of bugs and design flaws in your opinion? I wouldn't necessarily be scared of "new" software--use it all the time; but I am scared by anyone who expresses the opinions above.

[mhinnewyork]

Ruminator: It's obvious you are the same person that used to logon as tenc21. The only purpose to any of your comments is to argue. If I said the sun would rise in the morning, you would logon to disagree. Perhaps in real life you are a lawyer, someone used to living an adversarial life. Stop wasting everyone's time and do something productive. You're nothing but a stalker.
Michael Horowitz

[ezsurfer]

I have to log in to agree with you Michael, new software is notoriously "buggy". As long as multiple platforms with so many configurations are possible, won't it always be?

That said, why attempt to run an anti-virus software this buggy with so many options on the market? I didn't see a strong case for why this is the choice of defensive computing when it appears it doesn't even warn you when it's no longer operational???

[RWATTA]

have had nothing but prob. with nod 32 wont even update from late nov.
i have talked with a few people about this and was told that they have a big prob. on there end.
(nod) cant get any help or suport from nod...
i have lost all faith in this product !!!!!!!!!!!!!! i will be looking for a new program today.

[Dloadaholic]

though not very good on a computer, And brake almost every security rule in thier fine print Nod 32 held up. but since Eset they have a small problem. Nod doesnt Reconize me it w ont reconize my user name or password so had to go back and decide witch one of the 7 sec suites i bought last year. Oh boy thats peanuts compared to the others! (ill update when you feacher them later on. Get Well Soon Dloadaholic.

[1moreX]

I was impressed with NOD32. Used the trial the whole 9 yards. Instead of buying it from their website. I went to Newegg.com and purchased it from them. I had no problem with the cd installation. Current updates were right there,plus no username and password problems either.

[VODAVON]

[parbhakar321]

It's best 4 downloading softwares,games,pop music with various versions it's good 4 knowledge & have breif info of softwares inside

[hatawpablo]

i will download NOD32

[celil_akatli]

[vinothgskmr]

it's a good for all