ESET NOD32 for Linux Server 2.70.4
Installation of NOD32 was pleasingly well-designed, with an install script which made sense, and set things up just so. I barely even needed the simple instructions provided along with the product submission.
Once set up, the overall user experience was equally well thought out. While many of the other products in this review dropped their components into obscure locations with convoluted and unpredictable filenames, here I speculatively typed ‘nod32’ and got a nice polite response, urging me to provide some more specific options, while a standard –h call gave lucid and detailed information on usage.
Similarly, the on-access component was controlled by a proper init script in the standard location, responding to the standard instructions. The only issue I had with the configuration involved the logging, which seemed not to work whether left in its default or using the option to write to a specific file. This problem was easily overcome, however, by piping the output directly to a file by hand.
NOD32 was another product using Dazuko for its file hooking, and like the others in this class the on-access component was simple to set up, fast and efficient. The speeds recorded were even more eyebrow-lifting than usual, with the screen a blur of detections.
Sadly for ESET, my usual pleasure in using the product was marred, initially in a very minor way by missing one of the added sets of DOS samples (a strangely appropriate 32 samples, in fact), which spoiled a flawless record held by the product for some time now. More seriously, a false positive was generated in the older part of the clean set, caused by an apparently accidental upward tweak to the heuristics settings for DOS files in this build of the Linux product. Although the use of 'probably' in the log alert made the decision less than straightforward, rescanning the clean set with auto-deletion switched on resulted in the loss of the file in question, and combined with the commonness of 'probably' detections in ESET's heuristic-heavy product, this was adjudged too severe to be classed as a mere 'suspicious file', resulting in NOD32's first failure to achieve the VB100 for five years - its last having been the last time VB conducted tests on SuSE Linux, in 2002 (see VB, April 2002, p.16).
Update: after further investigation and careful consideration, VB now deems that the file NOD32 alerted on was inappropriate for inclusion in the clean test set. The file will be removed from the clean test set with immediate effect. A VB100 is therefore awarded to NOD32. No other products were affected.
ItW: 100.00%
ItW (o/a): 100.00%
File infector: 100.00%
DOS: 99.78%
Macro: 100.00%
Polymorphic: 100.00%
Worms & bots: 100.00%
Linux: 100.00%