Focus on the ESET NOD32 antivirus system

Transcription

1 INTERNATIONAL JOURNAL OF NETWORK MANAGEMENT Int. J. Network Mgmt 2006; 16: Published online in Wiley InterScience ( Focus on the ESET NOD32 antivirus system By Gilbert Held*, SUMMARY One of the software programs we take for granted is antivirus software. Perhaps part of the reason for not being excited about protecting our computers resides in the fact that most PCs marketed over the past few years are bundled with an antivirus solution. When you initialize the computer you also start your virus protection program, which will often provide you with only a short period of protection before pop-up messages appear reminding you to renew your antivirus program license to ensure your protection is up to date. What is more than likely never mentioned to consumers is the fact that the antivirus software bundled with your computer was positioned there due to the software vendor paying the computer manufacturer a fee. While most third-party software placed on new computers must pass a certain level of quality assurance, the computer manufacturer is more interested in the placement fee than whether the software is the best for the purchaser of the computer. Thus, one of the things we should do when our antivirus software license expires, if not sooner, is to look at other possible solutions beyond the software bundled with the computer. One such antivirus product that warrants our attention and which is the focus of this column is ESET s NOD32 for Windows antivirus solution, which was originally developed in Slovakia. 1. OVERVIEW Currently ESET offers versions of its NOD32 antivirus program for Windows NT, 2000, XP and 2003 that support 32- and 64-bit microprocessors; a version for computers running Windows versions 95 and 98; a version of NOD32 for DOS; and versions for Linux, BSD and various mail server platforms, such as Kerio, Lotus Domino and Microsoft Exchange. The Windows versions of the program are available in 15 languages including traditional and simplified Chinese, and most European languages as well as English. For my review I used the English version of NOD32 for Windows on a Microsoft XP-based tablet computer. 2. INSTALLATION The installation of NOD32 is similar to most modern software programs in that a wizard is used to simplify the installation of the program. Figure 1 illustrates the initial NOD32 setup program screen display. Note that you have three installation options (Typical, Advanced, and Expert), with the first option being the default selected option. According to ESET, the Typical option is designed to provide a high degree of security out of the box for networked computers, while other options are for deploying with a custom configuration and troubleshooting. From the setup wizard a series of additional screen displays will prompt the user to agree to the terms of the software license, select a destination folder for the program, set up automatic updates, specify the type of Internet connection used and define the types of updates. Concerning the latter, Figure 2 illustrates how you can control automatic updates to include the program s default settings. With the default *Correspondence to: Gil Held, 4-Degree Consulting, 4736 Oxford Road, Macon, GA 31210, USA gil_held@yahoo.com Copyright 2006 John Wiley & Sons, Ltd.

2 376 G. HELD Figure 1. The NOD32 setup wizard provides users with three methods to install the program settings, NOD32 will not notify you prior to downloading updates to its virus signature database but, as shown in the referenced screen, you can simply click on the applicable box to be notified prior to updates occurring. For those of us wary of programs that automatically reboot the computer at the end of an installation process, NODE32 will provide a restart option that will allow you to continue your work prior to having to restart your computer. In addition to the options mentioned, NOD32 s setup permits you to select a silent mode where only messages requiring user intervention are displayed. You may also protect your configuration settings with a password. 3. THREATSENSE.NET EARLY WARNING SYSTEM Another valuable configuration option that is common to all installation options is the NOD32 Threat- Sense.Net early warning system. Enabling this option allows NODE32 to collect and submit anonymous statistical data concerning detected infiltrations, which enables ESET to obtain firsthand information about new threats as well as evaluate the progress and severity of those threats. Figure 3 illustrates the ThreatSense.Net dialog box, which allows you to control the operation of this option. By enabling this option and providing a contact address, you not only assist the vendor

3 SOFTWARE SPOTLIGHT 377 Figure 2. NOD32 update options Figure 3. Threat.Sense.Net options enable users to submit information about new threats to ESET to assist their fight against viruses

4 378 G. HELD in obtaining information about spreading threats but, in addition, may be able to obtain specific countermeasures or other information while the vendor is working on developing a widespread solution. 4. AMON Similar to other virus protection programs, NOD32 includes a memory-resident service that scans files for malicious code. This activity is handled by several modules, the most important of which is the Access Monitor (AMON) module, or AMON for short. AMON is critical to the protection of a computer since it monitors all disk and file activity for potentially threatening actions using the archive, heuristics and virus signature updates provided by ESET. Because running multiple memory-resident antivirus programs from different vendors can at best significantly slow down a computer and possibly cause the computer to become unstable, both the manual and installation process warn users not to enable a second resident scanner. Other installation options include the ability to select a desktop icon for on-demand scanning, context menu integration which allows a user to right-click on a file or folder and select it to be scanned by NOD32, and the ability to enable the Document Monitor (DMON) and Internet Monitor (IMON) threat protection modules. The former recognizes the fact that the modern Internet Explorer browser allows Microsoft Office documents to be opened within the browser with data from the Internet. Thus DMON monitors such documents as a preventive measure. In comparison, IMON was developed to protect your computer from and Internet threats. To do so, it scans POP3 when your computer is connected to the Internet. Both DMON and IMON are simply enabled with a mouse click. IMON operates at the Winsock level and supplements AMON, since the latter will still prevent the opening of infected attachments saved from and the Internet. While space does not permit a full listing of security features included in NOD32, it s worth mentioning that in addition to providing protection against viruses it also provides protection against Spyware, Adware Rootkits, Worms, Trojan horses and other types of malicious programs. 5. THE CONTROL CENTER Once NOD32 is installed you can easily review the program settings for each threat protection module by first clicking on the program icon added to the Windows system tray. This action will result in the display of the NOD32 Control Center, which is shown in the left portion of Figure 4. From the Control Center you can select a threat protection module to either review or change setup parameters or even unload the module. Selecting the NOD32 threat module allows you to perform on-demand scans as illustrated in the right portion of Figure 4. Returning to the Control Center, the update entry enables you to immediately update the program or review and, if necessary, make changes to update setup properties. The logs entry provides you with the ability to view Event, Threat, and NOD32 scanner logs. The scanner log can be helpful as it indicates the date and time of scans, the number of files scanned, the number of infections encountered and cleaned and the status of the scan. Concerning the latter, by examining the status indicator you can note scans that completed as well as scans you interrupted, perhaps because you had to perform some file-intensive operation. The last portion of the Control Center provides NOD32 users with a series of system tools. Those tools include a quarantine feature which allows you to send a suspicious file or files for analysis to a scheduler that allows you to schedule NOD32 tasks. A third tool, labeled Information, provides information about the antivirus system as well as the platform it is running on. The fourth tool, which is labeled NOD32 System Setup, displays the state of the program s major settings and allows you to alter one or more settings.

5 SOFTWARE SPOTLIGHT 379 Figure 4. The NOD32 Control Center 6. CONCLUSION NOD32 is one of the fastest and certainly the most feature-loaded antivirus programs used by this author. To test the scanning time this author used a tablet PC with approximately 30 GB of documents, pictures, video clips and Excel spreadsheets. After using the bundled antivirus program that was on the tablet PC I disabled it and ran the NOD32 program. According to the log of each program NOD32 was approximately 45 seconds faster for performing a total scan. However, of more interest was the log capability of each program, with the bundled software providing the scanning date, time and number of files scanned. In comparison, the NOD32 scanning log indicated files that could not be scanned due to being locked for a system operation. While this comparison was not truly scientific, it did indicate the old adage that You get what you pay for and the free antivirus program bundled with your computer may not be the best choice for protecting your investment. NOD32 Antivirus System ESET, LLC 1172 Orange Avenue Coronado, CA Web: Telephone: Fax: