INSTALLING NOD32. NOD32 Setup Tutorial. Page 1 of 76. Double clicking on the Nod32 executable file that has been downloaded begins the setup process.

Transcription

1 INSTALLING NOD32 Double clicking on the Nod32 executable file that has been downloaded begins the setup process. 1. Click Extract. Page 1 of 76

2 1. It is recommended to initiate a Typical install unless one has previous experience with Nod32 and is comfortable navigating through the program's settings. 2. Click Next. Page 2 of 76

3 1. Click on the Radio Button that reads I agree. 2. Click Next. Page 3 of 76

4 Please LEAVE Server as <Choose automatically> for the following reasons: * If a particular server is down, Nod32 will NOT be able to roll on to the next server. * Experience shows that one will have fewer or no problems with updating using this setting. * Let Eset do their job and balance loads on the servers. 1. Place in the Username (UN) that the Partner/Distributor or Nod32 has provided. 2. Place in the Password (PW) that the Partner/Distributor or Nod32 has provided. ONLY a UN and PW provided by Eset will work. These are not personalizable entries created. 3. Click Next. Page 4 of 76

5 1. Leave this Radio Button as is, UNLESS one uses a modem that dials onto the internet. 2. Click Next. Page 5 of 76

6 Nod32 has been purchased for its ability to protect a computer. Help Eset to continue in its efforts by leaving Enable ThreatSense.NET Early Warning System checked. 1. Click here to see what information is sent to Eset. 2. Click Next. Page 6 of 76

7 1. Make a choice, we hope that one participates and chooses the middle or lower option. 2. The information sent is anonymous. One may want to add an address here in case Eset would like to have further contact regarding what is being sent. Page 7 of 76

8 1. Click on Next. Page 8 of 76

9 1. Leave this checked so the resident scanner (AMON) will start automatically upon booting one s system. 2. Click Next Page 9 of 76

10 1. Click Next. Page 10 of 76

11 1. Click this Radio Button to restart the system. 2. Click Finish to complete the installation. Page 11 of 76

12 Welcome to Nod32, this is the Nod32 splash screen that first appears upon bootup of your system (if this option is turned on). Page 12 of 76

13 The Nod32 Control Centre is located in the System Tray, at the bottom right hand corner of the desktop. Double Click on this icon. Page 13 of 76

14 AMON 1. Click on AMON 2. Click on Setup Page 14 of 76

15 1. Click on the Options tab. 2. Place a check in Potentially dangerous applications. WARNING: enabling this option may result in deletion of Remote Adminstrative programs such as those used by network administrators. Page 15 of 76

16 1. Click on the Actions tab. 2. Choose a Radio Button that suits one s needs. If one is new to Nod32 or a novice with a computer, one may want to have Nod32 Clean automatically, however, should AMON find a False Positive it will delete the file even if it proves to be non-viral at a later date. Though this remains a possibility, it is unlikely for the average user. Page 16 of 76

17 If one is having issues with a particular file or directory, one may be directed here in order to exclude such a file or directory. 1. Click OK Page 17 of 76

18 DMON 1. Click on DMON. 2. Click on Setup. Page 18 of 76

19 1. Click on the Setup tab. 2. Place a check in Potentially dangerous applications. Page 19 of 76

20 1. Click on the Actions tab. 2. Choose a Radio Button that suits one s needs. If one is new to Nod32 or a novice with a computer, one may want to have Nod32 Clean if a virus is found and Delete Uncleanable viruses, however, should a scan find a False Positive it will delete the file even if it proves to be non-viral at a later date. Though this remains a possibility, it is unlikely for the average user. 3. NOTE: ENSURE Quarantine is checked with EVERYTHING that is detected BEFORE one DELETES anything that is ever found. 4. Choose a Radio Button that suits one s needs. If one is not sure whether it is safe to delete an infected file, quarantine allows restoration of a file at a later time/date. If a Probable NewHeur_PE virus found, please do the following: 1. Place a check in the Quarantine check-box 2. Select Delete 3. Send the quarantined file to Eset: samples@nod32.com Files can be found here: C> Program files> Eset> Infected Note: this folder will only be displayed/made when one first receives an infected file and it is sent to Quarantine. NOTE: Quarantine ONLY copies the Virus or Trojan found so it can be sent to Eset for further analysis, it does NOT isolate the Virus or Trojan. 5. The actions chosen are for specific file types, in this instance Files. Clicking on the dropdown arrow reveals the next choice. Page 20 of 76

21 Page 21 of 76

22 1. Choose a Radio Button that suits one s needs. The same advice for each choice with 1, 2 and 3 can be found in the section that covers DMON> Actions tab. Clicking on the dropdown arrow reveals the next choice. Page 22 of 76

23 1. Choose a Radio Button that suits one s needs. The same advice for each choice with 1, 2 and 3 can be found in the section that covers DMON> Actions tab. Clicking on the dropdown arrow reveals the next choice. Page 23 of 76

24 1. Choose a Radio Button that suits one s needs. The same advice for each choice with 1, 2 and 3 can be found in the section that covers DMON> Actions tab. 5. Click on OK. Page 24 of 76

25 EMON Note: EMON is only used when Microsoft Office is detected. i.e. MS OUTLOOK 2000, 2002, 2003 etc. (not Outlook EXPRESS) 1. Click on EMON. 2. Click on Setup. Page 25 of 76

26 1. Click on Scanner 2. Place a check in Scan plain text message bodies. I know, but they said the same thing about jpeg files Page 26 of 76

27 1. Click on Detection. 2. Place a check in Potentially dangerous applications. WARNING: enabling this option might result in deletion of Remote Adminstrative programs such as those used by network administrators. Page 27 of 76

28 1. Click on Extensions. 2. Place a check in Scan extensionless files. Page 28 of 76

29 1. Click on the Actions tab. 2. Choose a Radio Button that suits one s needs. The same advice for each choice with 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 6. Clicking on the dropdown arrow reveals the next choice. Page 29 of 76

30 2. Choose a Radio Button that suits one s needs. The same advice for each choice with 2, 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 6. Clicking on the dropdown arrow reveals the next choice. Page 30 of 76

31 2. Choose a Radio Button that suits one s needs. The same advice for each choice with 2, 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 6. Clicking on the dropdown arrow reveals the next choice. Page 31 of 76

32 2. Choose a Radio Button that suits one s needs. The same advice for each choice with 2, 3, 4 and 5 can be found in the section that covers DMON> Actions tab. 7. Click on OK. Page 32 of 76

33 IMON 1. Click on IMON. 2. Click on Setup. Page 33 of 76

34 1. Click on the POP3 tab. 2. Click on Compatibility Setup > Setup This is also where one will be instructed to go if one is having an issue with IMON. Page 34 of 76

35 1. IMON s compatibility setup can be adjusted by sliding this bar. It is best to leave as is, unless advised otherwise. 2. Click on OK. Page 35 of 76

36 1. Click on the HTTP tab. 2. Click on the Radio Button that reads Automatically deny download of file. 3. Click on the Client Compatibility button. This is where one will be instructed to go if one is having an issue with a particular program. It is recommended to change the compatibility level to "Higher Efficiency" unless one experiences problems with certain applications. NOTE: With Higher Compatibility mode it is possible that Trojans may slip through IMON. Page 36 of 76

37 Page 37 of 76

38 1. Click on the Miscellaneous tab. 2. do NOT click this unless you are advised to, or you are seeing a slow internet connection. This button repairs the LSP chain (Winsock). 3. Click on Scanner> Setup. Page 38 of 76

39 1. Click on the Setup tab. 2. Place a check in Potentially dangerous applications. WARNING: enabling this option might result in deletion of Remote Adminstrative programs such as those used by network administrators. Page 39 of 76

40 1. Click on the Actions tab. 2. Choose a Radio Button that suits one s needs. The same advice for each choice with 2, 3 and 4 can be found in the that covers DMON> Actions tab. 5. Clicking on the dropdown arrow reveals the next choice. Page 40 of 76

41 1. Choose a Radio Button that suits one s needs. The same advice for each choice with 1, 2 and 3 can be found in the post that covers DMON> Actions tab. 4. Clicking on the dropdown arrow reveals the next choice. Page 41 of 76

42 1. Choose a Radio Button that suits one s needs. The same advice for each choice with 1, 2 and 3 can be found in the post that covers DMON> Actions tab. 4. Clicking on the dropdown arrow reveals the next choice. Page 42 of 76

43 1. Choose a Radio Button that suits one s needs. The same advice for each choice with 1, 2 and 3 can be found in the post that covers DMON> Actions tab. 4. Clicking on the dropdown arrow reveals the next choice. Page 43 of 76

44 1. Choose a Radio Button that suits one s needs. The same advice for each choice with 1, 2 and 3 can be found in the post that covers DMON> Actions tab. 4. Clicking on the dropdown arrow reveals the next choice. 5. Click on OK. Page 44 of 76

45 NOD32 1. Click on NOD Click on Run NOD32. Page 45 of 76

46 1. Click on the Scanning Targets tab. 2. Ensure ALL Hard Drives are checked. Page 46 of 76

47 1. Click on the Scanning log tab. 2. Place a check in Scrolling. Page 47 of 76

48 1. Click on the Setup tab. 2. Place a check in everything found within Scan. 3. Place a check in Advanced Heuristics. A warning box will pop up regarding Advanced Heuristics and the use thereof, see the next post for further information. 4. Place a check in Potentially dangerous applications. WARNING: enabling this option might result in deletion of Remote Adminstrative programs such as those used by network administrators. Page 48 of 76

49 1. Click on the Actions tab. 3. Choose a Radio Button that suits one s needs. The same advice for each choice with 3, 4 and 5 can be found in the post that covers DMON> Actions tab. Clicking on 2. will reveal one s next settings choices. Page 49 of 76

50 2. Choose a Radio Button that suits one s needs. The same advice for each choice with 2 and 3 can be found in the post that covers DMON> Actions tab. Clicking on 1. will reveal one s next settings choices. Page 50 of 76

51 1. Click on More. 2. Read enough information to satisfy one s needs to make an informed choice and then close the popup Window. Page 51 of 76

52 PROFILES 1. Click on the Profiles tab. 2. Place a check in Run this profile in cleaning mode. 3. Place a check in Use this profile for scanning files/folders from with the context menu. 4. Click on Quit. 5. Save the changes that have been made. Each profile can have different scanning settings if desired, or Nod32 can scan exactly the same way in all profiles. Nod32 is just giving choices, and choices are good. It s like having many pizzas and on each a different topping can be chosen. Or one favorite topping can be placed on all pizzas. Page 52 of 76

53 Page 53 of 76

54 UPDATE 1. Click on Update> Update. 2. Click on Setup. Page 54 of 76

55 1. Please LEAVE Server as <Choose automatically>, for many reasons: * If a particular server is down, Nod32 will NOT be able to roll on to the next server. * Experience shows us that one will have fewer or no problems with updating using this setting. * Let Eset do their job and balance the load on the servers. 2. One s Username and Password will appear here if one has followed this tutorial from the beginning. Do not try to use a UN and PW that one has created, ONLY a UN and PW provided by Eset will work. 3. Click Change. Page 55 of 76

56 1. It is advised to choose the Radio Button that has Nod32 Perform program component upgrade if available and Offer computer restart if necessary. NOTE: Due to the size of some program component updates, one may NOT want this setting if on a Dialup Internet Connection. 2. Click on OK. Page 56 of 76

57 1. Click on Advanced. Page 57 of 76

58 1. This is where one can set one s type of connection if Nod32 has not already preconfigured it. 2. Click on Proxy server Setup. 1. This is where Proxy Server settings are placed. Click on OK until one is taken back to the next screenshot. Page 58 of 76

59 1. One should now see this. 2. Click on OK. Page 59 of 76

60 1. Various Log files can be found here. Should one need to, one can click on an entry in the right hand Window, then click on Copy selected. One can then paste what has been copied in to Notepad, or MS Word, etc. Page 60 of 76

61 1. This is one of the places where Quarantined files can be submitted to Eset. The actual storage folder for Quarantined files can be found in C Drive> Program Files> Eset> Infected Page 61 of 76

62 SCHEDULER / PLANNER NOTE: Adding a scheduled task and choosing one that has been configured with Run this profile in cleaning mode enabled will be a silent task (i.e. no user interaction or visible signs of the task being run except through the NOD32 Scanner Logs and the Hard Drive light flashing ) 1. Click on Scheduler/Planner. 2. Click on Add. Page 62 of 76

63 1. In the dropdown box, choose Nod32 Kernel Execution of an external application. 2. Click on Next. Page 63 of 76

64 1. Choose a name for your task. 2. Choose a Radio Button that suits your needs. 3. Click on Next. Page 64 of 76

65 1. Choose a time to run your task. 2. Place a tick in a day or days that you want to run your task. 3. Click on Next. Page 65 of 76

66 1. Choose a Radio Button that suits one s requirements. 2. This will prevent overlaps of a Scheduled Task if one chooses the Radio Button in the screenshot. 3. Click on Next. Page 66 of 76

67 1. Click on the Finish button. Page 67 of 76

68 1. Click on Browse. 2. Browse to where Nod32 is installed, typically where you see in this screenshot. 3. Click on the Eset folder. 4. Click on Nod32.exe. 5. Click on Open. Page 68 of 76

69 Page 69 of 76

70 1. This is what should be seen. 2. Place in the Command line all appropriate Switches that suit your requirements. In this screenshot you will see that I am using /local this will scan all of my drives. 3. Click on OK. Here are the switches that should give the greatest and maximum strength scan: /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /pack+ /quarantine /quit+ /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+ Your scan settings will start with: C:\ (single space) /switches go here - see screenshot Or Copy and Paste the following directly into the settings: C:\ /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /pack+ /quarantine /quit+ /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+ Or To scan ALL of the drives do NOT use C:\ use ONLY the following: /local /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+ /pack+ /quarantine /quit+ /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+ /local = Scan all local drives /adware = Enable detection of adware, spyware and riskware /ah = Enable advanced heuristics /all = Scan all files regardless of their extension /arch+ = Enable archives (ZIP, ARJ and RAR) scanning /clean = Clean infected objects (if applicable) /cleanmode = Enables cleaning mode (the actions taken will depend on the action Page 70 of 76

71 settings) /delete = Delete the infected file /heur+ = Enable standard heuristics /log+ = Enable Log file generation /mailbox+ = Enable scanning mailboxes /pack+ = Enable internal runtime packer files scanning /quarantine Copy infected file to quarantine before taking further action (clean/delete) /quit+ = Quit the program after scanning /scanboot+ = Enable boot sectors scanning /scanmbr+ = Enable MBS scanning /scanmem+ = Enable scanning memory /scroll+ = Enable scrolling of the Log /sfx+ = Enable scanning self-extracting archives /unsafe = Enable detection of potentially dangerous applications /wrap+ = Enable text wrapping in the Log file GENERAL /break- = Disable testing intermission /break+ = Enable testing intermission /expire- = Disable the program expiration notice /expire+ = Enable the program expiration notice /help = Display the list of program switches /list- = Include in the Log only the objects infected /list+ = Create the list of all tested objects in the Log /quit- = Do not quit the program automatically after scanning /quit+ = Quit the program after scanning /scroll- = Disable scrolling of the Log /scroll+ = Enable scrolling of the Log /selfcheck- = Self-test disable /selfcheck+ = Self-test enable /sound- = Sound warning disable /sound+ = Sound warning enable /subdir- = Disable the sub-directories scanning /subdir+ = Enable the sub-directories scanning DETECTION /adware = Enable detection of adware, spyware and riskware /all = Scan all files regardless of their extension /arch- = Disable archives scanning /arch+ = Enable archives (ZIP, ARJ and RAR) scanning /exclude=<list> = Excludes a single particular file from scanning, multiple files can be selected using wildcards /ext=<list> = Add a new extension into the list of tested files. (Multiple entries permitted, e.g., /ext=ext1,ext2 /heur- = Disable heuristic analysis /heur+ = Enable heuristic analysis /local = Scan all local non-removable media /mailbox- = Disable scanning mailboxes Page 71 of 76

72 /mailbox+ = Enable scanning mailboxes /network = Scan all network disks /pack- = Disable the runtime packer files scanning /pack+ = Enable internal runtime packer files scanning /pattern- = Disable testing using virus signatures/patterns /pattern+ = Enable testing using virus signatures/patterns /scanboot- = Disable boot sectors scanning /scanboot+ = Enable boot sectors scanning /scanfile- = Disable scanning of the files /scanfile+ = Enable scanning of the files /scanmbr- = Disable MBS scanning /scanmbr+ = Enable MBS scanning /scanmem- = Disable scanning memory /scanmem+ = Enable scanning memory /sfx- = Disable scanning self-extracting archives /sfx+ = Enable scanning self-extracting archives /unsafe = Enable detection of potentially dangerous applications HEURISTIC ANALYSIS /ah = Enable advanced heuristics /heur- = Disable standard heuristics /heur+ = Enable standard heuristics /heurdeep = Set deep heuristic sensitivity - technically Deep Heuristics no longer exists as it has a higher chance of producing False Positives. /heursafe = Set safe heuristic sensitivity (minimize false alarms) /heurstd = Set standard heuristic sensitivity PROTOCOL /log- = Disable Log file generation /log+ = Enable Log file generation /log=<filename> = Set the Log file name (e.g.: /log=nod.log) /logappend = Enable Log file append option /logrewrite = Enable rewriting of the Log file /logsize=n = Set Log file to the maximum size of N KB) /wrap- = Disable text wrapping in the Log file /wrap+ = Enable text wrapping in the Log file CLEANING /clean = Clean infected objects (if applicable) /cleanmode = Enables cleaning mode (the actions taken will depend on the action settings) /delete = Delete the infected file /prompt = Offer an action upon virus detection /quarantine Copy infected file to quarantine before taking further action (clean/delete) /rename = Rename the infected file Page 72 of 76

73 Note: If the switches: /prompt, /rename, /delete/ or /replace are used concurrently with the /clean switch, the corresponding action will be carried out only if the virus cannot be cleaned. The further a parameter is listed, the higher priority it has. For instance, using the "/clean /delete /prompt " parameters will result in that the "/prompt " parameter will supersede the "/clean /delete" parameters. TEST SCHEDULING /daily = Automatic testing on a daily basis /period=n = Automatic testing once in N days /weekly = Automatic testing on a weekly basis NETWORK (Windows versions only) /centralpath=<path> = Specifies the name of the directory for Centralized Update files /msg="<message>" = Specifies the message to be sent upon virus deletion. /recipient=<list> = Specifies the recipients of the network messages (server/s, group or workstation name). Multiple entries are permitted, e.g., /recipient=server1,server2 Page 73 of 76

74 1. The Scheduled scan just set up will now appear here. Page 74 of 76

75 1. Right Click on the new scheduled scan. This will pop up a small window as seen in the screenshot. 2. Click on Run now. If the settings are correct, the next screenshot is shown when the scan starts. Page 75 of 76

76 1. Using /local shows all local drives that are in the process of being scanned. 2. [4}Locked Files are password protected or Windows System Swap Files, and as such are locked by the Operating System and it is unlikely they will be infected. Page 76 of 76