Jump to content

Leaderboard


Popular Content

Showing content with the most kudos since 01/13/2020 in Posts

  1. 2 points
    Perry

    MDM certificate

    Hi, You should create a full chain certificate which contains SSL cert, intermediate, root and private key. - Download XCA and install it. - Download OpenSSL and install it. 1.) Create a empty file (C:\temp\cert-chain.txt) on your PC and past the following inside it: -----BEGIN CERTIFICATE----- (Your Primary SSL certificate from C:\temp\your_domain_name.crt) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- (Your Intermediate certificate from C:\temp\TheIntermediateCA.crt) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- (Your Root certificate part from C:\temp\TheTrustedRoot.crt) -----END CERTIFICATE----- 2.) Now replace the content inside the brackets with your certificates (which you can export via XCA; PEM txt format). The order above is VERY important so do not mix it! 2.) Export the private key (unencrypted in text format) with XCA from your certificate and store it inside C:\temp\server.pemkey 3.) Now merge everything together as pkcs12 (filename extension for PKCS #12 files is .p12 or .pfx). To do that open a CMD (run as admin) and perform: cd C:\OpenSSL-Win32 openssl pkcs12 -export -inkey C:\temp\server.pemkey -in C:\temp\cert-chain.txt -password pass:ABCD -out C:\temp\certificate(chain_and_key).pfx 4.) Your PFX file is now ready to be used.
  2. 2 points
    Marcos

    Win32/TrojanDownloader.Delf.BTT

    You have a rootkit there. Either boot from a clean medium (e.g. ESET SysRescue) and run a full disk scan, or do the following: - start Windows in safe mode - move C:\Windows\System32\Ms96FB23EEApp.dll to another folder, e.g. to c:\eset - start Windows in normal mode - run a full disk scan.
  3. 1 point
    Marcos

    EFS Scan Log Viewer UI Bug

    This seems to be a known issue that doesn't exist in Endpoint v7.2. It will be fixed in ESET File Security 7.2. Unfortunately I can't tell when it's due for release at the moment.
  4. 1 point
    Marcos

    Eset Uninstalled by itself

    First of all, installing an antivirus without taking other measures, such as keeping the OS fully up to date and patched, avoiding opening suspicious email attachments, clicking suspicious links or keeping RDP enabled without restrictions is not enough. Moreover, no security solution can ever protect from 100% of threats. Not sure what happened, if your files were encrypted by ransomware or what you actually paid for. Technical support is provided to our users for free. Also without any further logs, proof and information what actually happened it's unfair to blame ESET.
  5. 1 point
    The patch was included in the Jan. cumulative update for Win 10 release last Tues.. For Win Server 2016 and 2019 which are also vulnerable, one will have to check with Microsoft on how the patch is being delivered or download the patch from the Win Catalog web site.
  6. 1 point
    walleyeman

    ESMC 7.1 sorting in GUI

    I expanded column header and found 2 columns that were also configured cleared them and everything is working properlu Thank you
  7. 1 point
    Microsoft has already released a hotfix for the vulnerability: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
  8. 1 point
  9. 1 point
    Rami

    Chrome 79 always starts a core dump and crashes

    You can find that here : I believe Google did some kind of change in Chrome that change is making problems with the legacy code of v4. EDIT : Also I am sorry If I was rude or aggressive with my reply , I didn't mean that. But you made me angry
  10. 1 point
    I restored c:\Program Files\Apache Software Foundation\Tomcat 7.0\webapps\era\ from Backup and now I can login again. Thank you for your help !
  11. 1 point
    denixx

    Chrome 79 always starts a core dump and crashes

    Sorry for pressure. My fault. But you are just looking at wrong browser, it would not be affected at all, as I understood. Also (not for being rude, but for numbers and talking about the same things) - the problem potentially affects more than a half of users of linux platform. The ones, who use ESET product for this platform, actually.
  12. 1 point
    Mirek S.

    MDM certificate

    Hello, As @Perry noted 3rd party certification authorities typically provide pem or pkcs#12 web certificate which does not contain root CA as that is not required for common webservers - this certificate is typically preinstalled on devices so that chain of trust can be established. MDM does a "bit more" than typical webserver - during enrollment we also install root CA to enrolled device to establish trust (we can't guess whether certificate is selfsigned or signed by CA already trusted by device) so we have extra requirement. I'll look into improving documentation wrt to 3rd party certificates as openssl command line how to convert between formats and appending root CA to existing certificates should help some users. HTH
  13. 1 point
    Mirek S.

    MDM certificate

    To have "secure" as in trusted by browser, You need to purchase 3rd party certificate from common internet certification authority. One of such certificate authorities is let's encrypt who provide certificates for free. ESMC creates self-signed certificates which are not trusted unless their root CA is imported into device certificate store. @Command IT What You probably mean was certificate chain installation which was required till 6.5 due to TLS layer we used. In 7.0+ we use different TLS layer on windows (openssl) and PKCS#12 is newly required to contain entire certificate chain including root CA - system certificate store is not used anymore.
  14. 1 point
    As for the files that could not be opened and scanned, just ignore those messages. They all seem to be standard files that are exclusively used by the OS or you don't have permissions to access them. As for the scan time, most likely it was not the first on-demand scan you've run so the scanner already had information about whitelisted files and skipped them.
  15. 1 point
    This appears to be a problem of a particular proxy server which responds with 304 Not modified even to non-conditional requests which is not in concordance with RFC.
  16. 1 point
    Hello guys, I opened a ticket with the dev team to check the logs provided by @Camilo Diaz In case you have the logs (as described by Marcos), or are willing to record them feel free to provide me with them so I can have them checked... Regards, Peter
  17. 1 point
    Marcos

    Multiple Notifications of exact same type

    Site blocking is often interconnected with malware being active on a machine. E.g. if there's an undetected downloader running on a machine that continually attempts to download payload from a url that is blocked by Web access protection, alerts about blocked urls give the user an indication that something bad is going on there which should be looked at.
  18. 1 point
    Marcos

    Win32/TrojanDownloader.Delf.BTT

    As I wrote, it's a rootkit so you and other apps / AVs won't normally see it. You should see it in safe mode.
  19. 1 point
    Hello, What you have to do is to configure the proxy for both the agent, and the mac security product. In case the macs are showing not correct "last connected time" it would mean that they are not able to connect to the server at all, which is the thing you should troubleshoot. To confirm this, please check the status.html of one of the mac agents. Also, what makes me confused is, that you mix topic of proxy and mirror. When you refer to mirror, do you mean actual offline generated mirror by mirror tool, or you utilize the proxy caching function. In this case, you just need to configure both agent / endpoint to communicate via proxy, and they should get the updates from there automatically. Please note, that in ESMC 7.1 you can configure proxy details for the agent live installer, and also choose a policy that will be applied to the machine. @Marcos can you please move this to "ERA" portion of the forum?
  20. 1 point
    You are lying here. Yes, NOD32 maybe does not specifically affect browsers. But to intercepting launching viruses you installing intercepting library affecting all applications. Even which launched via systemd. Error SIGILL (Illegal instruction from Chrome output in terminal) usually means that application was compiled for newer CPU which have instructions which you CPU does not have. In past Chrome already started to SSE2 instructions which was not on Pentium 4 and some Atoms CPUs. But in this particular case reason is different since after uninstalling ESET Chrome 79 starts working normally. Maybe during injection your code in Chrome (from library libesets_pac.so ) something leads Chrome (or maybe ESET) to execute illegal instruction. Besides Chrome CUPS subsystem (printers) not working with ESET. I don't know since when. In logs both says "ERROR: ld.so: object 'libesets_pac.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored." Maybe because of NOD32 unable to inject libesets_pac.so code using LD_PRELOAD in Chrome and inject successfully some other library then it leads to inconsistent behavior. Visually Chrome 79 with ESET installed blinking randomly with some freezes. Chrome uses dedicated processes for rendering pages which only "streaming" rendered content to main process with UI for presenting to user. Maybe Chrome 79 using some new IPC methods to transfer rendered content which NOD32 intercepts and parsing for too long (causing blinking in main UI process' OpenGL Context). I've never looked to Chromium source code so I'm not sure if I'm right about new IPC (if it is new). Also I mine cause graphical system in Ubuntu is X11. It is better to other victims of such error to reply if you are using Wayland (in case X11 do not answer to prevent flooding in thread). It is maybe related. To check which system you are using enter in terminal following command: echo $XDG_SESSION_TYPE
  21. 1 point
    Marcos

    Apache HTTP Proxy

    That's a huge number so a dedicate machine with http proxy will likely be necessary. ESET Dynamic Threat Defense runs files potentially carrying malware in a sandboxed EDTD cloud environment. It leverages multi-stage analysis, where it combines advanced detection techniques with behavioral analysis and machine learning. Scan results are shared among all computers in an organization. In combination with Mail Security products, EDTD allows for delaying email delivery until a result of scan is received and only then clean email is passed to mailboxes. EDTD substantially improves protection from malware spreading in Office documents for instance. As of Endpoint 7.2, it's possible to block execution of files downloaded via email clients and browsers until the scan result from EDTD is received. If you are interested in trying out ESET Dynamic Threat Defense, please contact your local ESET distributor or drop me a message. Another product for enterprise users that we offer is our EDR solution ESET Enterprise Inspector which provides you with insight into what's going on in your network. With more than 200 pre-defined rules you get a good overview of possible security incidents that you can subsequently respond to or track them back to the source.
  22. 1 point
    Marcos

    Files encrypted by ransomware

    In fact, I provided a proof that on Windows 10 ESET detected and blocked execution of the ransomware and protected the user where the other "free" AV failed. If you have a proof that ESET doesn't protect users well, please provide a proof and support it with logs and other necessary stuff.
  23. 1 point
    Marcos

    Undetectable Virus

    The fact that a particular AV detects more than ESET doesn't make it better. Rogue applications also find a lot of issues even on clean operating system and it doesn't make them better, quite the contrary. If you think that ESET has missed a threat, feel free to submit MBAM's quarantine to samples[at]eset.com and we'll most likely confirm that the object is not subject to detection.
  24. 1 point
    Marcos

    Undetectable Virus

    I respectfully disagree. MBAM typically ranks lower than ESET in tests and from my personal experience if it detects something that ESET doesn't it's something that is not subject to detection, e.g. benign registry values, folders left after malware infection or PUA, etc.
  25. 1 point
    StudioMaX

    EM008K_64.DLL BSOD 0x1D , Windows 10

    Do you know when this update will be released publicly? Or how can I avoid this error? At the moment, I get a BSOD several times a day, as well as data loss in some programs due to incorrect file saving. The minidump shows the same driver with the same parameters. As an option, I see only the complete removal of ESET Internet Security, since it is not known when the update will be released.
  • Newsletter

    Want to keep up to date with all our latest news and information?
    Sign Up
×
×
  • Create New...