NOD32 file scanner error

MarcLister · 26 Jul 2009 at 19:38

Noticed this with NOD32 for a while now but getting fed up with it. Whenever I get sent a file on MSN, NOD32 will scan the file for me. I get the black command prompt window opening up as my ecls.exe scans the file. However for some length of time now I get an error that implies that the file wasn't scanned. Until I close down the window the file isn't properly sent. Pic is below. Anyone got any ideas what is wrong? Running NOD32 x64 v4.0.437. Will post this on Wilder Security forums as well in case its a niche problem or something.

theheyes · 26 Jul 2009 at 19:45

Looks like the command line scanner needs administrator rights to function correctly. Not sure how you'd go about fixing that. Maybe try setting "run as administrator" in the properties of ecls.exe - it should prompt you for your password* next time it is run.

edit - *or UAC prompt

MarcLister · 26 Jul 2009 at 19:47

Could have sworn I'd done that ages ago. :confused:

Perhaps moving from v3 to v4 meant I should have done that again.

I'll get someone on MSN to send me a file to see if that's fixed it.

MarcLister · 26 Jul 2009 at 19:57

Nah not working now. Getting "The virus scan could not be completed. Please check your settings in Tools > Options > File Transfer." when I get sent a file.

MSN set to this scanning command.

"C:\Program Files\Nod32\ecls.exe""C:\Program Files\ESET\ESET NOD32 Antivirus\ecls.exe" /adv-heur /adware /arch /auto /boots /files /mail /no-log-all /pattern /quarantine /rtp /sfx /subdir /unsafe /unwanted

CurlyWhirly · 27 Jul 2009 at 21:37

MarcLister said:
Could have sworn I'd done that ages ago. Perhaps moving from v3 to v4 meant I should have done that again.

I've never done that administrator rights function and I don't get your problem when someone sends me a file on WLM :confused:

I'm also running v4 of NOD32.

MarcLister · 27 Jul 2009 at 22:02

Do you have anything explicity set in the options for WLM to scan using a specified AV? Or just leave it blank? I always thought it was better to actually enter something in there.

CurlyWhirly · 28 Jul 2009 at 21:12

MarcLister said:
Do you have anything explicity set in the options for WLM to scan using a specified AV? Or just leave it blank? I always thought it was better to actually enter something in there.

I have set mine up so that any files sent to me using WLM are scanned for viruses but I don't get the administrator error that you get!

I have "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" entered in the box where you have to enter the antivirus file name.

MarcLister · 28 Jul 2009 at 21:16

Thanks CurlyWhirly. So you have nothing after the file location? Looking at the NOD32 manual it says to use ecls.exe. I suppose by using the egui.exe any files with threats in them can be cleaned/deleted/quarantined etc because you have the actual GUI to use. Hmm might be worth a play.

CurlyWhirly · 28 Jul 2009 at 21:38

MarcLister said:
Looking at the NOD32 manual it says to use ecls.exe

I've never read the NOD32 manual

MarcLister said:
I suppose by using the egui.exe any files with threats in them can be cleaned/deleted/quarantined etc because you have the actual GUI to use. Hmm might be worth a play.

I used to use a different file name when I was on V3 (of NOD32) and, although I never got an error, the scan didn't work when someone sent me a file via WLM which isn't an ideal scenario because of security issues.

I just experimented and found that egui.exe works best for me.

I'd be interested if it works for you also

CurlyWhirly · 28 Jul 2009 at 21:39

MarcLister said:
So you have nothing after the file location?

Sorry, I don't know what you mean.

Duke · 28 Jul 2009 at 21:48

CurlyWhirly said:
Sorry, I don't know what you mean.

He means the command switches (options) i.e. "/adv-heur /adware /arch /auto /boots /files /mail /no-log-all /pattern /quarantine /rtp /sfx /subdir /unsafe /unwanted" after the short cut link you posted, like in his one

MarcLister · 28 Jul 2009 at 21:54

CurlyWhirly said:
I've never read the NOD32 manual

Neither had I until yesterday.

CurlyWhirly said:
I used to use a different file name when I was on V3 (of NOD32) and, although I never got an error, the scan didn't work when someone sent me a file via WLM which isn't an ideal scenario because of security issues.

I just experimented and found that egui.exe works best for me.

I'd be interested if it works for you also

I'll try it now!

CurlyWhirly · 30 Jul 2009 at 16:47

MarcLister said:
I'll try it now!

Did it work?

AbsenceJam · 30 Jul 2009 at 16:50

I'd suggest disabling that setting in MSN, the files will checked by the resident scanner - there's no need for an on demand scan of them.

MarcLister · 30 Jul 2009 at 17:13

CurlyWhirly said:
Did it work?

Erm well I got a mate to send me a file and then I realised I hadn't changed MSN to use the egui.exe.

So don't know yet.

AbsenceJam said:
I'd suggest disabling that setting in MSN, the files will checked by the resident scanner - there's no need for an on demand scan of them.

Well this is what I'm thinking. Do I need WLM/MSN to actually use a named AV or will NOD32 take care of it for me?

AbsenceJam · 30 Jul 2009 at 17:55

MarcLister said:
Erm well I got a mate to send me a file and then I realised I hadn't changed MSN to use the egui.exe. So don't know yet.

Well this is what I'm thinking. Do I need WLM/MSN to actually use a named AV or will NOD32 take care of it for me?

Those settings are a throwback to a long, long forgotten era of no resident scanners. So as I said before you don't need it.