Basic Concept Of Nod32 System Update; Nod32 Mirror Creation; Generation Of Nod32 Scanner Loading Modules - ESET NOD32 ANTIVIRUS - FOR LINUX-BSD FILE SERVER Installation Manual

6.1. Basic concept of NOD32 system update

In order to keep the anti-virus system effective, it is necessary to keep NOD32 virus signatures databse up to date.
The nod32update utility has been developed for this purpose. To get details on the operation of the utility, read the
nod32update(8) manual page. Basic concept of the NOD32 system update is composed from two parts.

6.1.1. NOD32 mirror creation

First, the mirror of all relevant so-called NOD32 precompiled modules have to be created from the origin ESET
server(s). In the product developed for Linux OS and BSD OS the precompiled NOD32 modules introduced above are
downloaded by default in directory
/var/lib/nod32/mirror
The Linux RedHat Ready and Novell (SuSE) Ready product downloads the modules in directory
/var/opt/eset/nod32/lib/mirror
The NOD32 modules are divided into two categories; engine category and component category. The modules of
component category are currently only for use on the MS Windows OS.
Currently the following types of engine category modules are supported: base scanning modules (prefix engine)
containing virus signatures database, archives support modules (prefix archs) supporting various file system archive
formats, advanced heuristics modules (prefix advheur) containing implementation of so-called advanced heuristics
method of virus and worm detection, packed worm scanner modules (prefix pwscan) used on MS Windows OS, NOD32
utilities modules (prefix utilmod) used on MS Windows OS and ThreatSense.NET technology support modules (prefix
charon).
These modules are always necessary for proper running of any NOD32 anti-virus scanner based application and
therefore are all downloaded by default at each download process. On the other hand the component category modules
are platform dependent and language localization dependent and thus the download of component category modules
is optional.
After download of precompiled NOD32 modules the ‚update.ver' file is created in the mirror directory as well. This
file contains the information about the modules currently stored in the newly created mirror. The newly created mirror
thus serves as fully functional modules download server and can be used to create subordinate mirros, however, some
more conditions have to be fullfilled yet. First, as the update utility uses http protocol to download the NOD32 modules
there must be a http server installed on the computer where the modules are going to be downloaded from. Second, the
NOD32 modules to be downloaded by other computers have to be placed at the directory path
/http-serv-base-path/nod_upd
where ‚http-serv-base-path' is a base http server directory path, as this is the first place where update utility looks
the NOD32 modules for.

6.1.2. Generation of NOD32 scanner loading modules

Second part of the update process is the compilation of NOD32 modules loadable by NOD32 scanner from those
stored in the local mirror.
Typically the following NOD32 loading modules are created: base module (nod32.000), archives support module
(nod32.002), advanced heuristics module (nod32.003), packed worm scanner module (nod32.004), windows utilities

NOD32 for Linux/BSD File Server