ESET Antivirus (NOD32) for Mac OS X Update

On December 6th I wrote a short little post about ESET NOD32 Antivirus 4 Beta for Mac OS X. On January 08 2010 they released an updated build which has the following changelog:

- Fixed GUI failure that had occurred in some cases during configuration imports
- System font warnings no longer display
- Added advanced “About” window and “Splash” screen
- Added information windows about detected and cleaned infiltrations
- Support for selection of multiple items from lists

So compared to my last post, have any of the issues I addressed changed? No they haven’t. So let me go through my experiences with this new build.

USB and Other Removable Drives

When attempting to eject (or unmount) a removable USB drive, you get a message saying “The disk “XXXX” wasn’t ejected because one or more programs may be using it.
To eject the disk immediately, click on the Force Eject button.”

The you can either Cancel or Force Eject.

This issue only occurs when running NOD32, otherwise drives work just fine. Also in certain situations the mounting of drives including network shares can be quite time consuming.

TrueCrypt

I am a heavy TrueCrypt user. When attempting to mount a TrueCrypt volume (I mostly use container or file based volumes) the following error message occurs:

“hdiutil: attach failed – Permission denied”

I also mentioned this error in my previous blog post, and also submitted a ticket to ESET about this. No response.

More…

Of course there are other things we could talk about as well. I still strongly desire that there be a way to remove the system menu icon. There’s already a Dock icon and there should be a way to disable either one of them. At least a way to disable the menu bar icon as it just takes unnecessary space.

Also disabling the real-time protection still does not require administrator authentication. Even if you are logged in as an administrator user you should still be prompted for your password to disable real-time protection.

And one more thing, the uninstaller is not user friendly. Which of course I was forced to do again as without TrueCrypt I’m toast. The uninstaller actually launched a command line script and you’re prompted for your password from a terminal window. This is not something I would expect a normal user to do, and it would be a 15min task to bundle that script into a package just like the installer. Even an applescript bundle is better than that.

So that’s it. I still say good on ESET for doing this, but c’mon, listen to the people who actually use and sell your product.

Update [2010-01-18]

Just got a response from ESET on these issues, and quoting it here:

Thank you for your feedback on our EAV4 beta version for Mac OS. The updates installation package was released to quickly address some most important issues. It is not meant as the next beta version release which will contain more fixes.
Several issues mentioned in your articles are already known to us (dock and menu icon, TrueCrypt error) and will be fixed in the future.
…..

Thanks for the response, and hopefully once the TrueCrypt problem is fixed I can continue testing the product.

ESET NOD32 Antivirus for Mac OS X Review

(Note: An updated review post is now online)

So, this is one of the last things I thought I’d ever do on my mac. But I installed the beta of ESET antivirus on my laptop this last week after it was available.

It’s seems to be just as good as the Windows version, in fact if I could say so I think it’s even better than the Windows version GUI wise. But in fact it’s really much the same.

There’s only one improvement I could suggest, and that’s a way to disable the icon on the apple menu bar. The dock icon is plenty enough.

Wait! There’s more.

It seems that Truecrypt is not able to mount a volume with ESET running, even if the real-time auto protection is disabled. You see an error message that reads “hdiutil: attach failed – Permission denied”
The only solution that I’ve found is to uninstall ESET NOD32, which I’ve done. And I’m running OS X 10.6 (Snow Leopard)

Finally one more thing that I believe could be improved upon, is the real-time protection disablement. In order to disable real-time protection you should be prompted for administrator authentication. Currently that is not the case.