You buy an antivirus for one reason—to keep malicious software from infesting your computer, stealing your data, and otherwise making your life miserable. Sometimes, though, you get more than just that core protection. ESET NOD32 Antivirus goes beyond the basics with bonus features—some surprisingly powerful—and scores well in lab tests. However, it turned in poor scores in some of our hands-on tests. Our Editors’ Choice winners remain Bitdefender Antivirus Plus and Norton AntiVirus Plus. Both score better with the labs, and both include significant collections of bonus security features.
How Much Does NOD32 Cost?
A NOD32 subscription costs $39.99 per year, and each additional license (up to five) adds $5 per year. Bitdefender, Trend Micro Antivirus+ Security, Webroot, and quite a few others come in at or near that $39.99 price for one license. McAfee costs $64.99 per year, but that lets you install McAfee protection on every device in your household, including devices running Windows, macOS, Android, iOS, and even ChromeOS.
It's not immediately obvious, but your NOD32 subscription offers its own limited kind of cross-platform security. You can use your licenses to activate an installation of ESET Cyber Security for Mac, if you wish.
Getting Started With NOD32
Just about every antivirus program includes the ability to detect and remove potentially unwanted applications (PUAs)—programs that, while not actively malicious, cause problems that outweigh any virtues they may have. Some default to removing these PUAs, while others leave them alone by default. During installation, NOD32 makes you actively choose whether to detect PUAs or leave them alone. I enabled PUA detection, and I advise you to do the same.
Similar Products
Bitdefender Antivirus Plus
Norton AntiVirus Plus
McAfee AntiVirus
G Data Antivirus
Malwarebytes Premium
Sophos Home Premium
Webroot AntiVirus
Total Defense Essential Anti-Virus
Trend Micro Antivirus+ Security
After installation, NOD32 launches a scan, but I halted this initial scan for testing purposes, saving a full scan for later when I could time it.
It's Surprisingly Easy to Be More Secure Online
Longtime ESET aficionados will notice, perhaps with sadness, that the company’s blue-eyed cyborg mascot no longer graces the main window. In the current layout, the bottom half of that window is simply unused space. In the middle, three buttons let you update the product, launch a scan, or view a security report. A color-coded banner above those buttons reflects security status. Finally, a menu on the left offers seven options: Overview, Computer Scan, Update, Tools, Setup, Help and Support, and ESET Home. I’ll discuss ESET Home below.
Selecting Setup displays options to toggle a handful of computer and internet protection options. All are enabled by default except for Gamer mode and Device Control. You turn on Gamer mode as needed, while Device Control offers security at a level that may be too technical for some users.
Those users who do have a technical bent can click on Advanced Settings. Doing so reveals a dizzying collection of detailed configuration choices. As with Norton AntiVirus Plus, you don't have to go through all those options to find the one you want—you can just start typing in the search box. You’ll rarely need to touch the advanced settings, as the software's default configuration is tuned for optimal security.
Good Lab Results
Two of the four independent testing labs I follow include NOD32 in their testing, and its scores range from good to excellent. Tests by London-based MRG-Effitas are especially grueling. ESET passed both tests, as did Bitdefender Antivirus Plus and Malwarebytes. All the other tested products failed at least one of the two.
At AV-Comparatives, testers don't assign numeric scores. A product that passes any test receives Standard certification, while those that go beyond the minimum passing score can take Advanced or Advanced+ certification. In the three such tests that I follow, NOD32 took one Advanced and two Advanced+ ratings. That’s good, but a half-dozen products, among them Avast, Bitdefender, and McAfee, reached Advanced+ in all three tests.
Experts at AV-Test Institute examine antivirus products for three important criteria: Protection, Performance, and Usability. Antivirus tools can earn up to six points in each category for a maximum score of 18. In past years, ESET frequently reached a perfect 18 points or a near-perfect 17.5. However, this lab’s latest tests haven’t included ESET. Likewise, SE Labs has awarded AAA certification to ESET in the past but hasn’t tested it for several years.
For each product that receives scores from at least two labs, my scoring algorithm maps all the results onto a 10-point scale and generates an aggregate lab score. ESET's 9.4 aggregate score is good, though Malwarebytes and AVG, also tested by two labs, reached 9.6 and 9.8, respectively. At the top, Bitdefender, Kaspersky, and McAfee achieved a perfect 10 points, based on results from three labs.
Unusual Scan Choices
I timed a full scan of my standard clean test system and found that NOD32 finished in under two hours. That's a bit slower than the current average of 94 minutes. During that initial scan, NOD32 also optimizes for subsequent scanning, marking known good programs that don't require another look. A second scan finished in just 10 minutes, an improvement of more than 90%.
NOD32 doesn't offer the quick scan option found in many antivirus products, but it gives you several custom scanning choices. You can drop suspect files or folders on the scan page for a quick checkup. It offers to scan each removable drive you mount. From the custom scan menu, you can scan memory, boot sectors, or any local or network drive.
The boot sector scan I mentioned also triggers NOD32's UEFI scanner. UEFI—which stands for Unified Extensible Firmware Interface—is what modern computers use instead of the antique BIOS. The UEFI scanner also runs in the background, ensuring no malware has subverted your firmware. I assume it works, but I have no way to trigger its protection for testing purposes. Firmware protection is important. Any malware that weaseled into the firmware would have total control over your computer. One aim of the stringent security requirements for running Windows 11 is to protect the firmware and the entire boot process.
NOD32 can actively scan the WMI database. WMI (Windows Management Instrumentation) is best known to programmers as a source of system information. For example, my boot-time performance test for security suites queries WMI to get the start time of the boot process. The WMI scan looks for references to infected files within the database and for malware embedded as data. Likewise, the Registry scan checks for such references and embedded malware throughout the Registry. As with the UEFI scan, I take these activities on faith, as there’s no easy way to test them.
Mixed Malware Protection Scores
I’m always happy to have results reported by the independent labs, but not every product makes it into those reports. Even when results are available, I still run hands-on malware protection testing to see the product's defenses in action.
When I opened the folder containing my current collection of malware samples, NOD32's real-time protection gave them the once-over. However, it only eliminated 22% of them at this point. Granted, not every antivirus checks files on sight, but ESET has the lowest detection rate among those that do. Avast wiped out 89% of the same samples as soon as they were displayed, and Bitdefender whacked 81%.
Notably, NOD32 recognized only half of the ransomware samples on sight. Of a dozen other products whose real-time protection wipes out known threats on sight, one immediately eliminated 10 of 12 samples, and the rest wiped out every single one.
Continuing the test, I launched the remaining samples. Clearly, the real-time malware checker applies a tougher standard to programs that are about to launch. It prevented quite a few samples from launching at all. That included all the remaining ransomware samples, some of which it identified by name. It did flag some samples as PUAs, and I chose to delete all of those. In other cases, it caught a malware component during the installation process.
NOD32 detected 84% of the samples in one way or another. However, the fact that it let several samples install executable files brought its overall score down to a dismal 7.2 points, even worse than the 7.9 points it scored against my previous malware collection. Tested with this same sample set, Malwarebytes managed 98% detection and a near-perfect 9.8 points. McAfee and Webroot SecureAnywhere AntiVirus came close, with 95% detection and 9.4 points. Guardio and PC Matic matched the scores achieved by Malwarebytes. Note, though, that both required special treatment—PC Matic works strictly by allowlisting, and Guardio only checks files downloaded in Chrome.
NOD32’s score in this test is among the lowest of any product tested with the current sample set. That result doesn’t line up with its lab test scores. When my results don’t jibe with the labs, I give the labs a bit more weight.
It takes me quite a while to collect and analyze a new set of malware samples, so those necessarily stay the same for months. To check a product's protection against the latest in-the-wild threats, I start with a feed of malware-hosting URLs detected in the last few days by researchers at MRG-Effitas. I launch each URL individually and note whether the antivirus prevents access to the URL, eliminates the malware payload, or utterly fails to detect any threat.
While some antivirus tools rely on browser extensions to filter out dangerous websites, NOD32 functions below the browser level. That means it can extend its protection to any internet-capable app. In testing, NOD32 blocked the browser’s access to 33% of the malware-hosting URLs. For most of these, it displayed a red warning page. In a few cases, it displayed a yellow warning of potentially dangerous content—I also counted these results as successful detections. The antivirus eliminated another 57% of the threats before the download could finish.
NOD32’s total score of 90% protection is just middling. The same number of competitors scored higher as scored lower. Five managed a perfect 100%, Bitdefender, Sophos, and Trend Micro among them.
Decent Phishing Protection
Writing code to hide from antivirus tools and steal people's passwords is hard, bitter work. Bamboozling people into just handing over those passwords can be much easier. Phishing websites imitate secure sites, from online banking systems to gaming sites. The netizen who logs in to one of these frauds has just given away access to the real account. It's possible to spot phishing scams if you're alert, but having help from your antivirus means you're protected even when your eyelids are drooping.
To start the phishing test, I collect reported frauds from websites that track such things, making sure to include some so new they haven't yet been analyzed and blacklisted. Phishing sites are ephemeral, and the newest ones are typically both the most effective and the hardest to detect. I launch each suspected URL in a browser protected by the product under test and simultaneously in instances of Chrome, Firefox, and Edge protected only by the browser's built-in phishing detection.
If a URL doesn't load properly in any of the four test systems, I toss it. If it doesn't fit the profile for a phishing site—meaning it's trying to steal login credentials—I toss it. Analyzing those that remain gives me a clear idea of the product's phishing protection skills.
NOD32 detected 93% of the verified phishing frauds, about the same as in its last few tests. It did beat all three browsers, but others have scored much better. Ten products currently score 98% or higher, and five top out at 100%, McAfee AntiVirus Plus, Norton Genie, and ZoneAlarm among them.
I tested ESET Cyber Security for Mac with the same set of samples and found that its behavior doesn't track with the Windows-based product. In fact, ESET on macOS caught just 36% of the phishing frauds. It’s clear from the Windows version’s score that ESET has the technology to detect phishing frauds effectively. I hope it eventually reaches the Mac edition, but this disparity has existed for years.
ESET Home Online Dashboard
Modern security offerings go beyond simply protecting one device. Even the simple antivirus reviewed here can protect multiple Windows or macOS devices. A central hub to manage all your installations is more important than ever. That’s where ESET Home comes into play.
There's an ESET Home account entry in the application’s left-side menu. You can also navigate to home.eset.com from any browser. Once you log in, you can view all your licenses and protected devices. For each license, it shows the total number of devices, the number in use, and the number still available. Right from this dashboard, you can open a license and add protection to the current device or send an email link to protect another.
Shifting to the devices view, you can quickly see if your devices have security issues. You can get details on any problems, but you must go to the affected computer to do anything about those issues. There’s no remote configuration control such as Sophos, Webroot, and a few others offer.
This page offers another opportunity to add protection to more devices. One odd limitation is that protected macOS devices still don’t appear in ESET Home.
The online dashboard is also the spot to manage the ESET's parental control, password management, and anti-theft components. However, those components aren’t part of this standalone antivirus.
HIPS Blocks Exploits
ESET's suite products add full-blown firewall and network protection, but even the standalone antivirus offers a Host Intrusion Prevention System (HIPS). To see this component in action, I hit the test system with 30 exploits generated by the CORE Impact penetration tool. The HIPS detected and blocked many of these attempts to exploit security vulnerabilities.
None of the exploits penetrated security since the test system is fully patched. NOD32 detected and blocked 34% of the attacks, identifying most of them using the official exploit number. Scores in this test have been gradually dropping. Currently, Vipre and Bitdefender top the list, at 55% and 53%, respectively.
Uneven Ransomware Protection
NOD32’s real-time antivirus components eliminated all my ransomware samples in testing. For additional protection against brand-new ransomware, the HIPS system includes a separate layer specific to ransomware protection. I turned off the regular real-time protection to evaluate this component but left HIPS toggled on. With the virtual machine isolated from the internet for safety, I tried launching a dozen real-world ransomware samples. The results weren’t pretty.
Two of the samples refrained from taking any actions; without ransomware behavior, the ransomware detector naturally didn’t react. Four file encrypting samples proceeded to do their dirty deeds without any reaction from NOD32, as did one whole-disk encrypting sample. NOD32 detected and foiled four of the remaining five.
The remaining sample proved problematic. NOD32 did detect it but required a restart for a full cleanup. After the restart, I found dozens of files with ransom notes scattered around the system. I also found almost 900 files encrypted by the ransomware. These weren’t important documents or system components but rather logs and manifests. But the fact remains, NOD32’s protection proved incomplete.
As with ransomware protection layers in other antivirus products, NOD32's anti-ransomware layer isn’t intended as the app's first line of defense or even its second. With all cylinders firing, NOD32 eliminated almost half the samples on sight and wiped out the rest when they tried to launch. This suggests the ransomware-specific protection layer could use another round of enhancements.
Comprehensive Device Control
NOD32's Device Control is a feature more suited to business settings than to consumer use. Out of the box, this feature is disabled. To enable it, you must reboot the system. With Device Control active, you can prevent the use of a wide variety of device types while making exceptions for trusted devices. Among other things, Device Control can prevent anyone from stealing data by copying it to unauthorized external drives and head off infestation by USB-based malware.
ESET isn't the only security company offering such a feature. Device Protection in Avira Antivirus Pro lets you whitelist or blacklist specific devices, and you can password-protect settings so nobody can mess with the lists. However, even when password protection is active, users can whitelist a new, unknown drive. G Data Total Security offers advanced device control, and it can prevent others from adding exceptions. Note, though, that this is G Data’s top-tier mega-suite. ESET puts device control in its basic antivirus. It's an excellent, if technical, bonus feature for an entry-level product.
The Device Control system in NOD32 is the most elaborate I've seen. You can create rules for several types of devices, including card readers, imaging devices, Bluetooth devices, and more traditional external drives. Each rule sets an action for a device type, an individual device, or a group of devices. Available actions include blocking the use of the device, opening it in read-only mode, or allowing full read/write privileges. You can also configure a rule to warn that policy limits access to the device and that accessing it despite the warning will be logged.
As with G Data and others, using this system is a game of rules and exceptions. For example, you could start by forcing read-only use of CD/DVD drives so nobody can burn secrets to disk. On top of that, you might create an exception allowing you, but nobody else, to burn disks. Or you could ban removable drives but permit specific authorized ones.
In a super-techie household, you might set different access levels for different user accounts, with full access for you but limited access for others. Note, however, that NOD32 relies on the awkward Select Users or Groups dialog to pick user accounts rather than providing a more user-friendly account list.
Yes, even less technical consumers can probably manage to configure NOD32 so the kids can't corrupt the system with infected thumb drives, but it's not easy. Most users should leave this feature turned off.
Security Tools
Device Control isn't the only feature that takes NOD32 beyond simple antivirus. There's a whole page of tools to enhance your security experience. Some are useful to all; others require a technical mindset.
Several tools give you views of what NOD32 has been doing for you. The Security Report shows how many applications, web pages, and other objects NOD32 has scanned. You can peruse logs of malware detections, HIPS events, and more.
Bringing up the Running Processes list shows you every process running, with much more information than you'd get just by looking at Task Manager. Drawing from ESET's LiveGrid analysis system, it reports the reputation, number of users, and time of discovery for each process. This chart, like the chart of file system activity, may be more useful to a tech support agent examining your system remotely.
Many security suites offer a system cleaner that wipes out junk files and erases traces of your computer and web-surfing history. With NOD32, System Cleaner has a different meaning. Like Webroot's similar feature, it aims to correct and restore system settings malware may have modified. For example, some ransomware replaces your desktop wallpaper with a ransom note, even before attempting encryption behaviors that might trigger an antivirus reaction.
Everybody should run the SysInspector tool right after installing NOD32. This scanner logs tons of details about your PC’s configuration, including what services are active, the status of critical system files, and the values of essential Registry entries. The report alone might be valuable to a tech support agent, but the key is SysInspector's ability to compare two reports and tell you what changed. If you run into any system problems, comparing the current status with a no-problem baseline should give you a clue as to the cause.
Even if you always get someone else to help you out of computer jams, you should still run a baseline SysInspector report. Your tech-savvy niece or remote-control tech support agent will find it extremely helpful.
Bonus Features Require Unusual Expertise
Apart from an interface makeover, the latest release of ESET NOD32 Antivirus hasn't changed much else. Indeed, the product has been mostly static for the last several years. It earns good scores from the independent testing labs but doesn’t do nearly as well in our hands-on tests. The Device Control system is the most comprehensive we've seen, but like many of the bonus features, it requires serious tech expertise. All users, techie and otherwise, should also consider Bitdefender Antivirus Plus, which packs in even more bonus tools than NOD32 and routinely earns perfect scores from the independent labs. Norton AntiVirus Plus also gets good lab scores, its ransomware protection far outstrips NOD32’s, and it too includes plenty of useful bonuses.
ESET NOD32 Antivirus combines tech-heavy bonus features with test results that range from excellent to poor.
Like What You're Reading?
Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
Sign up for other newsletters
