ESET NOD32 V 2.7 - User manual

Version 2.7
Includes Windows Vista
and 64-bit protection
NOD32 Typical
Installation
Guide
Proactive protection
againstViruses, Spyware,
Worms, Trojans, Rootkits,
Adware and Phishing
Best Detection
Fastest Performance
Minimal Resource
Utilization

NOD32 Typical Installation Guide
2
Copyright © 1997 – 2007 ESET LLC. All rights reserved.
No part of this document may be reproduced or transmitted in any form or
by any means electronic or mechanical, for any purpose without the express
written permission of ESET LLC. Information in this document is subject to
change without prior notice.
Certain names of program products and company names used in this
document might be registered trademarks or trademarks owned by other
entities.
ESET, NOD32 and AMON are trademarks of ESET.
Microsoft and Windows are registered trademarks of Microsoft Corporation.
ESET, LLC
610 West Ash Street, Suite 1900
San Diego
California
92101
U.S.A.
http://www.eset.com
For Sales and Technical Support (US and Canada):
Tel: [phone]
Fax: [phone]
Online purchase: http://www.eset.com/purchase/index.php
Sales email:
[email protected]
Technical Support Worldwide:
http://www.eset.com/support/index.php
Then by clicking on your country’s name, you can locate the support details
closest to you.
This guide is frequently updated to reect changes in the product. The latest
version can always be found at
http://www.eset.com/download/manual.htm
This guide was prepared for NOD32 for Windows Version 2.7 (January 2007)

NOD32 Typical Installation Guide
3
Contents
Introduction
Guidebook Conventions
Minimum System Requirements
Section 1: Installation
Installation instructions
Section 2: Dealing with alerts & virus incidents
Dealing with an alert
Sending a sample to ESET
Section 3: Troubleshooting & Information
Appendix A: Troubleshooting
Appendix B: Uninstalling
Page
3
4
5
6
7
8 to 18
19
20
21
22
23
24

NOD32 Typical Installation Guide
4
Introduction
Congratulations, you have just purchased NOD32, the most advanced antivirus
solution available.
NOD32 is very simple to use and you will probably not even need to read
through this guide... however, the following information will help you to get a
better understanding of the many features of NOD32, so that you get the best
protection possible.
NOD32 is more than just a virus scanner – being able to scan for known
viruses is the bare minimum that should be expected from an anti-virus
product, so it should be reassuring to know that NOD32 not only does this
faster, and more reliably than other products, but that it also has an excellent
track record in discovering new threats. In addition, version 2.7 includes
detection for adware, spyware and riskware aswell as rootkit detection with
its Anti-Stealth technology. With NOD32 you can be sure you have the most
advanced and comprehensive virus protection possible.

NOD32 Typical Installation Guide
5
Guidebook Conventions
To highlight the most important points – we have used a set of simple icons
which draw attention to key information and settings.
Key:
The Check Icon indicates a setting that we recommend
you use or enable
The Info Icon higlights important facts and information
about NOD32, to help you make better use of the program
The Hazard Icon highlights areas where potential
problems can arise, or miscongurations occur, to help
you avoid damage or loss of data.
Use the icons as a guide – they will highlight the most important areas of
conguration and usage so that you get the best out of NOD32.
This document uses the following typographic conventions:
C:\type.exe
Used for text that must be typed exactly as shown
ndntenst.exe
Used for le and program names, screen messages and dialogues
username
Used for items like menu options, or objects such as passwords and
usernames

NOD32 Typical Installation Guide
6
Minimum System Requirements
Please make sure that the computer on which you plan to install NOD32
meets the minimum system requirements for the program to run:
Disk Space: 30MB free disk space
Graphics: VGA video card. (SVGA 800x600 recommended)
You must only install ONE anti-virus On-Access
scanner at one time (a scanner that is always running
while your PC is switched on); otherwise you could
cause serious system instability.
If you are installing NOD32 with another anti-virus
program, please make sure you do not enable both
On-Access scanners at once.
If another anti-virus program has previously been installed on your
computer, its scanner may interfere with NOD32. Usually resident
scanners will display an icon in the system tray (the area of the taskbar
near the clock). We recommend removing any other antivirus software,
including older versions of NOD32, before installing NOD32 Version 2.7, to
avoid the possibility of serious problems
Version 2.7 may be installed over your existing NOD32 if it is version 2 or
higher, however, if any problems were encountered, a clean installation is
recommended.
Details on uninstalling NOD32 can be found in Appendix C on page 51.
Operating system CPU RAM
Windows 98/ME 133 MHz/150 MHz 32 MB
Windows NT4/2000 133 MHz 32 MB/64 MB
Windows XP/2003/XP 64 or 32-bit 300 MHz 128 MB
Windows Vista 800 MHz 512 MB

NOD32 Typical Installation Guide
7
‘Typical’
Installation
(default settings)

NOD32 Typical Installation Guide
8
Installation Instructions for
Windows 95/98/ME/NT/2000/2003/XP/Vista
To install from the NOD32 CD, simply insert the CD into the drive. If setup does
not begin automatically, you will need to run NOD32.exe from the CD’s root
directory.
To install the download version (recommended, as it will be the most up-to-
date), rst download the installer from the ESET website:
http://www.ESET.com/download/registered_software.php
For either method, you must have administrator privileges on your PC.
Locate the correct Standard version (not LAN Update
Server version) to suit your PC’s operating system
and click Download. The installer for version 2.7 is
approximately 11 MB in size. You will immediately see
a window similar to this:
Copy & Paste the username and password sent
to you in your license email. (Highlight the text, press
‘Ctrl + C’to copy and ‘Ctrl + V’ to paste into the
required elds)
Click OK and you’ll see a window similar to this:
Click ‘Save’. Choose to save the download to your
desktop (or an Installers folder if you have one)
You will then see the download progress in a window
similar to this:
Once it has downloaded, locate and run the le by
double clicking on it.

NOD32 Typical Installation Guide
9
Whether from a CD or from a download, the installation instructions from this
point are the same.
You will see this screen:
Click Extract to begin the
installation process.
The extraction path can be changed in the "Extract to" box.
This will not affect the final installation directory, only where
the installation files are put during setup. These files can be
removed after NOD32 setup completes.
If installing onto a 64-bit operating system, the installer will
automatically install a compatible version, but the Extract path
will read: C:\Program Files (x86)\ESET\Install
After clicking Extract you
will see the les being
expanded onto the disk:
...and then you should
see the following
message:

NOD32 Typical Installation Guide
10
Once the Setup Wizard has started, you will be presented with the
Installation choices....
NOD32 Installation choices
Typical installs NOD32 with the correct settings for normal usage, and
will make most of the decisions for you about the installation. If you have
no particular requirement to install NOD32 with specic settings, it is
recommended to choose this route. Typical installation is the default
option.

NOD32 Typical Installation Guide
11
End User Licence Agreement
In all installation modes, the next screen will be the End User License
Agreement, on which you must choose I accept and click Next> to continue
installation. You may also Print the license agreement for future reference.
You are advised to read the terms of the license carefully before proceeding
with the installation. If you decline the license terms, the installation cannot
proceed.

NOD32 Typical Installation Guide
12
Conguring Automatic Updates
At this point the Typical, Advanced and Expert installations converge.
You will now be presented with a screen asking you to choose your update
server.
We strongly recommend that you use the setting
<Choose Automatically>
This ensures that updates will be delivered most
efciently.
If you do not enter a username and password
at this point, the product will not receive automatic
updates until you enter them.
You will be prompted to provide a username and password for updates.
You should copy and paste these from your license email to ensure that no
typing errors are made. (Highlight the text, ‘Ctrl + C’ to copy and ‘Ctrl + V’ to
paste into the required elds)
If you do not have this information to hand, you can choose to set update
parameters later, otherwise you will not be able to proceed with the installation
without either entering a username and password.

NOD32 Typical Installation Guide
13
Conguration of Internet Settings
You will now be asked about your Internet Connection settings.
If you use a dial-up modem (not broadband or networked) then you need to
check the I use dial-up (modem) Internet connection option.
This will set NOD32 to update when an internet connection is detected.
You will also be asked whether you use a proxy server, if you don’t or are
unsure, just accept the default setting, as shown, and NOD32 will work it out
for you.

NOD32 Typical Installation Guide
14
ThreatSense.Net™ Early Warning System
This is a system for automatic evaluation of les requiring further analysis in
ESET’s labs and enables their automatic submission. If you choose to enable
ThreatSense.Net™, it will also collect and submit anonymous, statistical data
about detected inltrations, which enables ESET to watch and evaluate the
progress and severity of specic spreading threats.
By clicking the Advanced setup
button, you can amend the default
settings.

NOD32 Typical Installation Guide
15
Detection of potentially unwanted
applications
Some advertising and activity tracking companies complain about detection
that terms their software as Adware or explicitly calls it Spyware. NOD32 2.7
includes the detection of “potentially unwanted applications”. This setting
includes some Adware and other not necessarily malicious applications.
Though not always malicious, some Adware will often ll a computer with
a larger amount of le and memory baggage. This overhead, though not
necessarily a security risk, is extremely irritating and troublesome to many
users.

NOD32 Typical Installation Guide
16
Access MONitor (AMON) Conguration
AMON (Access MONitor) is a memory-resident (always running when
computer is on) le scanning program. Automatic starting of AMON after
computer restart is a fundamental defense against malicious code. Quitting
AMON is not recommended and should only be done under special
circumstances. Execution of two different antivirus monitors (from different
products or companies) is not recommended since it may make your computer
slower and/or cause a system crash, especially on Windows NT systems,
might lead to serious problems.
AMON is the most important line of antivirus defense. It is critically important to
keep it running at all times using the most current version of the virus signature
databases and NOD32 program upgrades. AMON monitors all potentially
threatening actions on protected computers such as opening, executing,
creating or renaming les.
IMPORTANT:
Do not enable another resident
scanner from a 2nd anti-virus
program, otherwise your system
could become unstable.

NOD32 Typical Installation Guide
17
Completion of Setup Conguration
At this point all installation tracks reconverge, and the conguration phase
is complete. This is the last point at which changes can be made to the
selected installation options, before the les are copied and the conguration
completed.
If you wish to change any
conguration parameters, use the
Back button now.
If you have enabled the AMON
module, you should particularly ensure that
you have no other resident (on-access)
anti-virus scanner active before proceeding.
To complete the installation with the selected conguration, click Next>
During the setup,
you will see this
message:

NOD32 Typical Installation Guide
18
After installation has completed you will be required to restart your machine.
You should ensure that no other anti-virus scanner will load at restart, save any
active work, and click Finish to restart the machine.
If you do not wish to restart immediately,
choose Restart later.
NOD32 may not function correctly, and
your computer may not be protected from viruses
until you have restarted your computer.
Once your PC has re-started, open the NOD32 Control Center by clicking
this icon once, in the bottom right hand corner of your screen, look in the
‘Update’ section and press the ‘Update now’ button to ensure you are up to
date with ESET’s virus denitions.
After that, go to the Threat Protection Modules section and click once on
‘NOD32’. In the right hand screen, click the button for an ‘In-depth analysis’.
This will give your machine an immediate and thorough scan.

NOD32 Typical Installation Guide
19
Dealing with alerts
& virus incidents

NOD32 Typical Installation Guide
20
Dealing with alerts and virus incidents
Basic rules to follow if a virus is detected:
Trojans can only be deleted as they do not infect other les and
contain only their own code
Worms in email attachments should be deleted as they contain only
the viral code
If the IMON’s HTTP scanner detects a virus, choose to terminate the
connection to prevent it from saving to the disk.
If you are unsure whether it is safe to delete the particular le without any
side effect on your system’s functionality, we suggest you tick the ‘Copy to
quarantine’ checkbox before you choose to delete it. Please bear in mind
that many viruses copy themselves to system folders such as WINDOWS or
WINDOWS\system32 to confuse the user. Should you have any concerns
about deleting the le and were unable to nd any description of it, either on
our website or on the web, please send the suspicious le to samples@eset.
com for analysis.
Note:
Occasionally, you may get a virus alert where the name of the infection is
“unknown” or “probable...”. This is because one of the NOD32 modules
has detected virus-like characteristics in a le but doesn’t have a matching
signature to verify the virus name. This is most common with very new
infections which have not yet been identied.
NOD32 has an impressive record of catching still-unknown, new viruses and
worms because of the sensitivity and power of these “characteristic” scanning
techniques, also known as heuristics. Since these are very often as-yet-
unknown malware (bad software), we are very interested in receiving samples
of these les for analysis.
•
•
•