Jump to content

Leaderboard


Popular Content

Showing content with the most kudos since 08/31/2017 in Posts

  1. 4 points
    There will be a fix for the issue in both Endpoint and ESET NOD32 for Linux desktop according to the latest news.
  2. 4 points
    Aryeh Goretsky

    Rules of the ESET Security Forum

    Welcome to the ESET Security Forum! ESET is pleased to provide you with this resource in order to make it easy for you to ask questions and receive answers about ESET's products and services. Understand that the ESET Security Forum is a private community for existing customers of ESET, prospective customers who are interested in ESET's software, ESET employees and business partners. Because of this focus, it is not like a general public forum, where conversations take place on a variety of non-ESET and non-security related topics. With that in mind, we have the following rules in place: When registering for an account on the forum, please fill out the information accurately and correctly. Do not enter the Username and Password for your licensed ESET software, but instead choose a username (in Latin) unique to this forum. You should also choose a suitably complex password unique to this forum as well. Do not create multiple accounts. If a person is found creating multiple accounts, ESET reserves the right to take whatever actions it deems necessary, including banning, blocking, deleting and/or merging them. The exception to this rule is ESET staff, who may create multiple accounts for testing purposes. No impersonating other forum users, ESET employees or other people. Use appropriate language in the forum. No vulgar, obscene or rude language will be tolerated. No vulgar, obscene or otherwise offensive images or video will be tolerated. ESET staff have the right to move, edit or modify messages that you post. This may be done for clarity, to move a message to more appropriate forum where it will receive more attention, or for other reasons outlined in these rules. All decisions by ESET staff are final, and not open to discussion. This list may be updated at any time. Please periodically visit this page to review any updates. Do not post direct links to any executable files, malicious/suspicious software or web sites in public messages, even if you think the software or site is clean and incorrectly detected by ESET. Break up the URL by inserting spaces into it, or replacing the protocol handler with an obfuscated one, like . Do not attach malicious or suspicious files to messages, even if you think they are clean. Write a public message, and then use the "report this message" option to send a private message to ESET staff with a link. Do not post any personally identifiable information (PII) about yourself, such as an email or mailing address or phone number, in a public message. Do not post the username and password or license key for your ESET software in a public message. Do not post links to software cracking tools, license key generators, pirated copies of software or other illicit software in the forum. If you wish to report a site, write a public message, and then use the "report this message" option to send a private message to ESET staff with a link. Do not post private correspondence (private messages, email, etc.) publicly within the forum. Do not post "A vs. B" or "Which product is best?" type messages in the forum. Do not post overtly commercial messages in the forum (this includes in your signature). Do not pre-announce releases. Due to differences in scheduling, it may sometimes take several hours after a release has appeared on ESET's web site for the release announcement to appear here in the forum. Do not abuse the forum's rich text controls. Messages and signatures with inappropriate font selection, including size, color and, for signatures, length, may be edited by forum staff to conform to standards of decency. Do not ask other users for logs, especially if they may contain sensitive or other personally identifiable information. Posts made on behalf of a 3rd party company may only be made from accounts registered with an email address from the company's domain (verifiable by ESET staff). Do not use the "Report post" function for other purposes than reporting inappropriate content requiring moderators' attention. Do not report possibly incorrect detections or blocks (false positives) in the forum unless they may affect a lot of users. If you think that your application or website is detected or blocked incorrectly, please report it to ESET as per the instructions at https://support.eset.com/kb141. Be civil, do not post sarcastic, offensive or mocking comments towards any person or entity. Do not post messages that are off-topic, keep the discussion to the point and do not lead it astray. To discuss a different, unrelated issue or question, always create a new topic. If you have any questions or comments, please contact one of ESET's moderators. Last Revised: 5 March 2019.
  3. 3 points
    Marcos

    ESET Memories

    Cherishing memories
  4. 3 points
    I have a local account. I do not use online anytihng for this win10 debacle. I have SHUTUP switch off almost everything. I have no one drive, I have no microsoft accounts. microspasm have, over the years, clearly demonstrated their mistrust, disgust and lack of customer service for the very people who made them the global garbage patch they now are. As for a Linux recommendation, clearly, the front runner for new folk is Ubuntu. The GUI has evolved vastly over the years, it is stable, useful and easy to get to grips with. The standard desktop version contains all the workable software you would likely need. Installing more software is a doddle and there is a world of passionate, dedicated expert-like folk who will gladly offer any free assistance. There is NO activating online. There is (almost) no snooping - firefox, etc will have crash report info sent off but these things can easily be disabled. Almost everything you could want will be available as Open Source or GPL, etc so no worries about purchasing things. Virtualisation runs far better on the Linux platform than windows via KVM/QEMU. The only caveat that I have encountered is that cut/paste between host/guest and shared folders are a bit trickier to set up than would be the case with a windows setup. However, if you don't want a more hardware-centric virtualisation then you can still employ virtualbox which operates as well as virtualbox does anywhere. Software development tools do NOT require 10Gb or more of install as one gets with visual studio. By the same token, no registration is required such as microspasm force one into so they can spy on more of your activities. If one is a non-gaming user, Linux is ideal. If one is a business user, it could also be ideal but for the fact that the bulk of businesses use BackOffice tools - especially exchange/outlook; the latter of which has been altered so it is not so user-friendly any longer. I was weaned on UNIX (SYSV) and have been a ms/windows tech-type since MSDOS 3.x and windows 3. With every subsequent release, I have disliked windows less and UNIX-like more. The day windows is history will be a glorious day for the whole world! P.S. Once you feel confident enough you can even recompile your Linux kernel to streamline it to your tastes and speed-up your boot times. Personally, I have not recompiled a kernel since using Slakware but it is fun to try and would take far less time today than the 4-7 hours it used to take using pre-pentium intel chips back in 1993.
  5. 3 points
    Update (Feb 10, 16:30 CET): 1, A fix tool that will replace ekrn.exe with a fixed version will be ready within today (Feb 10). The tool will need to be run on machines with affected ESET Security products that are malfunctioning. No restart should be needed to get the product work. The tool should work for affected Endpoint v5 as well as v6.5 products also on Windows XP and Windows Server 2003. 2, If you have an affected version of the product and it still works alright, do not restart the computer yet. Tomorrow (Feb 11) we'll be releasing Antivirus and antispyware module which will patch ekrn to fix the issue. 3, We should have 6.5 installers with a fixed ekrn.exe ready by tomorrow and will replace them in the repository too. 4, After remedying the issue, please consider upgrading to the latest Endpoint v7.2 wherever possible. While Endpoint v5 and 6.5 products will work until they reach EOL, we strongly encourage you to use the latest version which not only addresses bugs and issues from older versions but also brings substantially better protection against current threats.
  6. 3 points
    Hi, I just published a brief guide to ESMC implementation in Proxmox : ESET Security Management Center 7 deployment in Proxmox VE I hope it is useful. Regards
  7. 3 points
    As I wrote, there will be a hotfix of ESET NOD32 for Linux desktop that will address the issue.
  8. 3 points
    just my reply : https://www.youtube.com/watch?v=Uh7l8dx-h8M
  9. 3 points
    The ESET Knowledgebase YouTube Channel celebrates its 10-year anniversary today! https://www.youtube.com/user/ESETKnowledgebase/community Check out the infographic for our lifetime YouTube statistics for the channel. The ESET Knowledgebase channel includes step-by-step video tutorials demonstrating the key processes and features of our ESET products, from ESET NOD32 Antivirus and ESET Internet Security to business products like ESET Security Management Center. In addition, our channel is yet another way for our customers to reach us with feedback and questions. We make every effort to respond to support-related comments and yes, we do take video suggestions!
  10. 3 points
    False positive reports To submit a possible False Positive see Submit a suspicious website / potential false positive / potential miscategorization by Parental control to ESET for analysis when you wish to submit via email or use Submit sample for analysis function from the program GUI of ESET product installed on your computer. Whitelisting ESET does provide a whitelisting service for software vendors by which you can submit your software to minimize the chances of false positives, e.g., when your software is being downloaded. This service is intended as preventive measure for trusted and undetected applications to minimize risk of future false positives. Whitelisting service is not a channel for removing existing detections, disputes or solving other unrelated problems. If you want to register your software for whitelisting, please follow the instructions in the KB article How do I whitelist my software with ESET? Requirement for False positive submissions When submitting false positive file(s) via email or via program GUI, it is necessary to send copy of falsely detected file(s) as well as description of the file. I will explain what information is needed and why it is important. 1) Name of the legitimate application the file belongs to. When submitting false positives you must be able to identify what is the name of application that is being falsely detected. No-name false positive reports (when information about the application name is missing) are harder/slower to examine and in many cases indicate correctly detected malware rather then false positive. Example of correctly provided information: “This file belongs to VLC media player 3.0.6.” When you provide the specific version number, it helps. Example how not to submit false positives: “I don’t know what it is and why I have it on my computer but I think it is a false positive.” If you don’t know what the file is, don’t report it as false positive. 2) Name of the application’s author, developer, vendor or website where you downloaded the software Each legitimate software have known author or there is known company who developed it. There is known source/origin where the software can be obtained and you can learn information about it. This information is needed in investigation process. Researchers need to verify whether the software is safe and they may need the full installer to evaluate the software properly. Researchers may need to investigate whether other versions of the same software were affected by false positive or not. It is important to know the source/website where you downloaded the software because some download websites provide different installers than original vendors. 3) Application's purpose Let the researchers know what the application is supposed to do, what value does it offer to you. This information is usually available on vendor’s website but there are many old applications where the website is no longer available, or software was distributed only on CD-ROM/DVD, or the software is custom/in-house developed and the description is not generally available. Examples how of application’s purpose: This is a picture viewer, video convertor, movie player, communication software, printing program, database program, web browser, accounting software, computer game, tool I use for programming, etc. Don’t hesitate to provide any additional information you deem important. You may add the specific detection name you saw when detection occurred. In case some specific circumstances are needed to reproduce the problem, tell it to the researchers how (For example it may happen that the file itself is not detected but it downloads/creates other files that trigger detection). You may submit false positives via email or directly from ESET product via Submit sample for analysis function. In order to use the function open GUI of ESET Internet Security, you will find following icon in Tools and clicking More Tools: Please select “False positive file” option and attach the file you want to submit. Please provide all necessary information (as described above) researchers need to process your false positive submission. Information you provide indeed significantly helps ESET laboratories in the identification and processing of samples. Thank you for your submission!
  11. 3 points
    Actually advanced users love the ability to customize numerous settings. Common users don't need to go to the advanced setup at all since ESET products provide well-balanced protection out of the box.
  12. 3 points
    @AStevens.SHG Hello, Concerning the more options in the reports, some of the changes are going to be introduced, but not all of them. However, we are planning a bigger redesign for the future version, which might make it simpler. Other requests are tracked in the feature backlog (authentication screen changes, AD sync changes, and export of data from "computers screen") and I believe that some of them will be done in the future versions (not in the 7.0, but into the future releases). I can´t comment now about details, as we are still scoping, and setting up the road-map plans. But your votes will be added to already tracked backlog items.
  13. 3 points
    Hello, thank you for the feedback. I have positive news for you - we are continuously improving the ways how reports are built & are adding further filtering options in the soon to be released version. So the filter by action is added in the upcoming version & you are also able to filter out some entries from the "installed applications" report, by choosing condition "is not one of" (screenshots attached).
  14. 3 points
    Hello, we will be rolling out this change by the means of a module update in the upcoming weeks.
  15. 3 points
    I would welcome the changes, as I currently enable strict cleaning to get similar results
  16. 3 points
    Speaking as someone who is hands-on IT management rather than a reseller or MSP: That is how I would expect it to behave and should. My endpoints are configured for strict cleaning so I have not dealt with this issue, however if end users were greeted with option dialogs during an av scan without any way for the admin to suppress I would be quite aggravated with the product.
  17. 3 points
    Nice thread, I have tens of comments to ERA server / functions. ERA is not user friendly in most cases.... I will post something. Description: Dynamic groups rules / tasks Detail: I would like to be able to show all rules/tasks linked to dynamic groups. Or to be able to find where rules are linked. I would love to disable group/rules instead of only delete or edit them to dysfunction it. It is nearly imposible to read ties. Description: task history deletion / filter and so on Detail: I would like to be able to delete (mass delete) task history. I have tens of ASAP task and they are only messing in my log. I would like to be able to see which computers were affected by the single task when pointing to a TARGETS column. Why I have to edit history of the task to see which computer was affected? I would like to click on 1 computer(s) to open the list or show the list. Description: trigers Detail: ASAP. Sometimes ASAP fails and I have no idea why.... Computer was online. I think rule should wait for online status or give me better feedback Description: Failed / Trace message Detail: When I point on the FAILED status I would like to receive more information what happens without opening the HISTORY of the COMPUTER. BTW FAILED ICON should allow me to open history.... Trace message is sometimes to long and I am unable to read whole message. Description: Repository Detail: Choosing ESET version from a repository is not user-friendly. I have to be very careful to chose the right version. Description: Reports Detail: Why I cannot export report Computer name Identifier type Identifier value Adapter IPv4 address Computer nameDevice manufacturerDevice modelOS nameOS versionAdapter IPv4 addressRemoteHost and so on ? When I chose some identifier other identifiers are disabled. Why? I would like to be able to find report using some SEARCH function. Description: ELA Detail: Why I am unable to fully maintain a license that customers gave me under my administration? I am unable to remove computers which are not activated under ERA. I have to open ELA portal using my customer's credentials. Why I can not edit ELA credentials on my ERA server? Description: Upgrade Detail: When I am upgrading EEA using ERA I have to activate them afterward. Why? Product was already activated. Description: Variables in tasks / templates Detail: I would like to have variables in task / dynamic groups. For example I have 4 activation tasks (4licenses). I would like to activate product which is not activated when joining dynamic group based on FOLDER group. When computer from AAA company join the NOT ACTIVATED group, the AAA-ACTIVATE task will be used. When computer from BBB company join the NOT ACTIVATED group, the BBB-ACTIVATE task will be used. Description: Applied policies tree Detail: I would love to see the tree of policies which are applied on a computer and would like to be able to identify which policy rule won the policy over-ride battle. I am not satisfied with list of policies. Description: Threats infection and cleaning Detail: I am not unable to simply perform an action on threats whir where not automatically solved by EEA. For example, I would like to choose threats and click on "DELETE" or "CLEAN" or other things. I am able to mark them only as RESOLVED Description: Sorting / filtering Detail: I can filter columns by STATUs or LAST CONNECTED, but I am unable to do multi filter. For example I would like to sort all computer by WORST FUNCTIONALITY and LAST CONNECTED, because working with offline computer does not make sense. And so on.....
  18. 3 points
    As introduced here (KB News) and here (KB Alerts), I am unpinning those threads and replacing with this one. We now have RSS/email subscriptions for News, Alerts, and Customer Advisories. Information and instructions to subscribe is available here: Subscribe to ESET Knowledgebase Support News, Alerts and Customer Advisories
  19. 2 points
    https://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/
  20. 2 points
    Peter Randziak

    ESET cloud Administrator

    Hello @Christoforos The team responsible was able to determine the root cause of the issue. Fix will be prepared, tested on test environment and deployed to production. Consoles has been restarted to resolve the issue until permanently fixed, so you should be able to access your ECA right now. We apologize for the inconvenience caused, Peter
  21. 2 points
    ESET has been protecting users worldwide for decades already and have always provided state-of-the-art protection. While it was always our digital worlds that ESET has been protecting, now with the epidemic of the SARS-CoV-2 coronavirus the need to protect also users themselves became inevitable. Besides supporting various scientific and charity events, we are now creating a fund to support effective diagnosis of SARS-CoV-2 coronavirus, giving 300,000 EUR to support the purchase of a diagnostic system capable of analyzing 4000 samples per day. By purchasing ESET's products you can be sure that you also support science and charity. Machine translation: https://translate.google.com/translate?sl=sk&tl=en&u=https%3A%2F%2Fwww.eset.com%2Fsk%2Fo-nas%2Fpress-centrum%2Feset-tlacove-spravy%2Fspolocnost-eset-vytvara-fond-na-podporu-ucinnej-diagnostiky-koronavirusu-sars-cov-2%2F Recognizing the seriousness of the SARS-CoV-2 coronavirus spread, ESET has decided to engage in the fight against the epidemic in Slovakia. The ESET Foundation has therefore set up a COVID-19 Effective Diagnosis and Prevention Fund, to which ESET will contribute EUR 300,000. The amount will be increased later if necessary. The aim of the newly established fund is to provide, in the first phase, the necessary equipment for improving the quality of diagnostics and introducing comprehensive testing in Slovakia. Since its inception, ESET has dedicated itself to the diagnosis of computer viruses and is symbolic to support the diagnosis of biological viruses in this situation. Even at such moments, the importance of science, which can make a significant contribution to solving the situation, has been shown. ESET Foundation supports science and research and is the organizer of the ESET Science Award. “We have set up a fund to support the effective diagnosis and prevention of coronavirus because we believe that only a systematic scientific approach will help us manage this epidemic. At the same time, it is essential that we think ahead today and take steps to relaunch the economy. General and systematic testing of the population will help in returning the employees to the work process and thus also help the Slovak economy, ” explains Richard Marko, CEO of ESET. Through the Fund, ESET will support the purchase of high-performance diagnostic equipment, the development of systems for more efficient online diagnostics, or contribute to the cost of operating or collecting and transporting samples. Public and private medical diagnostic institutions and laboratories operating in Slovakia that are authorized to diagnose this type or to take and transport SARS-CoV-2 related samples may receive financial support. These institutions can contact the ESET Foundation at nadacia[at]eset.sk . The expert guarantor in the evaluation of the use of the fund's resources is the recognized Slovak chemist Robert Mistrík. “After the first discussions, we are considering co-financing the purchase of the Roche cobas 8800 System, or co-financing its operation. This device is able to do real-time RT-PCR tests at lower unit cost and shorter time in automatic mode. It can evaluate up to 4,000 samples in a single day. We will look for a partner to operate this device. Of course, the fund will also be open to other solutions supporting its goal, ” concludes Robert Mistrík, the fund's expert guarantor. More information about the Fund for the Support of Effective Diagnosis and Prevention of COVID-19 can be found at www.nadaciaeset.sk .
  22. 2 points
    Nightowl

    ESET Memories

    Just some photos I found on the internet that can bring some good moments and make your white hair shine brighter. Hmmm , I used to love that GUI ! , so simple and basic but powerful.
  23. 2 points
    Microsoft are intent on relegating the desktop PC into a -poor child of their crappy surface tablet. There is little or no point in promoting all this geoloating twaddle on a PC which is, for the most part, quite static in its movements. Laptops are not that mobile really, except for business types. Windows 10 is dire, intrusive, bland. If Linux could offer me better gaming options I'd blow windows out the door and not waste a minute more on it.
  24. 2 points
    We have recently discovered a problem sending customer care requests from the built-in form in ESET NOD32 for Linux desktop. I would recommend contacting ESET LLL via the web form or phone. We are working on a resolution to make the internal form work. We apologize for the inconvenience.
  25. 2 points
    Tonight (CET) we are going to publish links to fixes for Endpoint v5. A bit later we plan to release also a fix that will be smaller in size and will download the appropriate installed of the latest v5 Endpoint instead of having it bundled.
  26. 2 points
    Agreed - we are also seeing this on multiple English systems
  27. 2 points
    @Marcos What about the endpoints that request a username and password when you go to advanced settings after applying the patch? Also any update if we NEED to update after applying the 6.5 patch? Like 10000+ workstations updaten without any era would take a few months.
  28. 2 points
    On machines that have been restarted and where ESET doesn't work (ie. neither update does), it will be necessary to run the fix tool that we are testing right now. We'll announce it here when ready.
  29. 2 points
    MichalJ

    ESET NOD32 Google Chrome 79 crashes

    @Kirill Licenses for ESET products are not sold for a specific product version. Meaning, that with your current license you will be eligible to use the new V7 as well. Linux Endpoint product is the last one running the old version of architecture / scanning core, and it will be updated to V7 soon. We are already running a beta program (available here), V7 should not have this issue at all.
  30. 2 points
    The current up-to-date version for desktop edition is the v4 Endpoint edition v7 is running as BETA currently , once it goes stable I believe they will start looking at building the v7 for desktop. The fix that Marcos talked about would be probably a small fix (hotfix) that will solve the issue with browsers and that's it , not a major upgrade.
  31. 2 points
    Perry

    MDM certificate

    Hi, You should create a full chain certificate which contains SSL cert, intermediate, root and private key. - Download XCA and install it. - Download OpenSSL and install it. 1.) Create a empty file (C:\temp\cert-chain.txt) on your PC and past the following inside it: -----BEGIN CERTIFICATE----- (Your Primary SSL certificate from C:\temp\your_domain_name.crt) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- (Your Intermediate certificate from C:\temp\TheIntermediateCA.crt) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- (Your Root certificate part from C:\temp\TheTrustedRoot.crt) -----END CERTIFICATE----- 2.) Now replace the content inside the brackets with your certificates (which you can export via XCA; PEM txt format). The order above is VERY important so do not mix it! 2.) Export the private key (unencrypted in text format) with XCA from your certificate and store it inside C:\temp\server.pemkey 3.) Now merge everything together as pkcs12 (filename extension for PKCS #12 files is .p12 or .pfx). To do that open a CMD (run as admin) and perform: cd C:\OpenSSL-Win32 openssl pkcs12 -export -inkey C:\temp\server.pemkey -in C:\temp\cert-chain.txt -password pass:ABCD -out C:\temp\certificate(chain_and_key).pfx 4.) Your PFX file is now ready to be used.
  32. 2 points
    Description: Color code failing tasks Detail: The server used to color code the tasks that are failing. I'm running the latest ESMC, and now, that doesn't happen, and I have a hard time figuring out which tasks are failing. Is there a way to color code it again, or where can I see it? All I get is a generic email saying: "At least one client task has invalid configuration and therefore will fail."
  33. 2 points
    BeanSlappers

    Future changes to ESET web portals

    Have full control over devices connected to the account, like remote updates, remote settings, remote scanning etc.
  34. 2 points
    TecM

    Future changes to ESET web portals

    Description: Products updateDetail: Verify if the installed products are up to date
  35. 2 points
    It is very simple. Use SetThreadExecutionState. See: link to Microsoft Windows Dev Center.
  36. 2 points
    Description: Prevent sleep during scan. Detail: Windows can put the computer to sleep before the scan is finished. That is very annoying. There should be an option to prevent that from happening. Oops, it's a coincidence that @zeromido asked someting similar here right above. Before I started typing, I first searched the forum for "scan prevent sleep".
  37. 2 points
    Thomas Stats

    Introduce yourself

    Hi there I am security expert and blogger. I am working in the IT area for over 10 years. All the gathered experience throughout the years I share with people at reviewedbypro.com. Its a cyber security website that helps people deal with various online threats by providing detailed and insightful reviews to those who are interested.
  38. 2 points
    Description: Merge the More tools menu into the Tools menu Detail: The current Tools menu only includes three less commonly used modules and leaves a huge blank space. However, the most commonly used modules (e.g. Log files) are included in the More tools menu, which needs one more click to enter. Merge the More tools menu into the Tools menu can make full use of the space and reduce unnecessary operations.
  39. 2 points
    It's not that big deal in my opinion @nonamelab, It's a way to bring more people to use ESET and in the same time giving the person who invited the other person who doesn't use ESET , a month of usage or more I don't remember exactly.
  40. 2 points
    dwomack

    Welcome to the ESET Security Forum

    Welcome to the official ESET Security Forum! While here, you can ask questions or give feedback about ESET products and services, receive prompt answers from qualified support technicians and interact with the ESET community. Before posting, check out the video below and read the Rules of the ESET Security Forum VIDEO: If you get stuck, please check out our dedicated FAQ section and Help section.
  41. 2 points
    Description: A "Reset to Default" option for different parts of the ERA. Detail: This one has mainly been discovered due to my own fault. There are many things that can be played with within ERA which is great, however I think there are some of us that might play a little too much and then get to a point where we've changed so much of something that it doesn't work or doesn't give you what you want. For areas such as reports and policies, it might be a good idea to have a button that you can click while editing that restores the default values. That way, if you play around too much and feel like you just want it back to how it was before, you have a reset button as a saviour.
  42. 2 points
    Dear forum members, We are considering a change in the product's behavior but before doing that, we would like to consult you, our field experts with regards to the problem and suggested change. We kindly ask you to: Read this message carefully Talk with other people of your support staff, whether they are aware of issues related to current behavior Provide any comments (supportive / negative) towards the proposed change As of now, one of the issues that our customers are facing is the behavior of products in managed environment, related to handling of detections and cleaning of Potentially Unwanted and Potentially Unsafe Applications (hereafter referenced as PUA) The following are prerequisites of the behavior: Default cleaning settings on the Endpoints (normal cleaning) Detection of PUA is enabled. With these settings we were reported the following problems by several customers and resellers / MSPs that we have interacted with directly during a customer research. Main problems are: End users on local machines are forced to respond to an „interactive window“ that is asking for action in case of a PUA detection, which can by triggered by protection modules or the on-demand scanner. They offer the „ignore & continue“ action even in managed environments where the end user should not make decision. Users can try to install a PUA which usually ends with multiple interactive windows appearing. If a PUA is already in the system and you schedule an on-demand scan, it will be reported to the user again and a dialog with action selection is shown to the user. If this happens on a server, it will be never resolved; the dialog eventually expires, and then will be reported again and again to the server upon re-scanning. The only solution currently is to set an exclusion or to set cleaning mode to strict which will automatically remove the PUA detection without asking. What are we planning to do: We are planning to change the product behavior in a way that our endpoints will automatically block / clean PUA detections in managed environments according to the option selected by an administrator, meaning that the end users will never see interactive windows. Alerts (only one) will be reported to the ERA, and it will be up to the security administrator to either set an exclusion or acknowledge such detection. After exclusion, reinstall of the affected PUA will be needed on the target system; restore from quarantine is not enough since „cleaning“ also removes references which are not restoreable (this is valid also now, when Exclusion is „cleaned“). We would like to hear from you and ask for feedback whether you consider this change as risky from the perspective of customer expectations. We do perceive the problem as serious and would like to change the behavior even for existing users by means of a module update. An alternative approach is to change it only in new versions of our products, meaning Endpoint V7 and eventually backport it to a new 6.6 hotfix if that happens in the foreseeable future. How the interactive window looks: How it looks in the logs: How it looks in the ESET Remote Administrator: Please note that we are also bringing a lot of changes into the ESMC: Cleaned „threats“ are automatically going to be marked as resolved (once the behavior is implemented, you will automatically get the PUA cleaned at the „first detection“) and will be automatically „resolved“ in ESMC (no duplicated entries when one clicks „no action“) You will be able to set exclusions directly from the threats section, basically by „one click“; there will be also an option to set „exclusion by HASH“ in EES. Thank you for your feedback & support.
  43. 2 points
    Add option to realtime scanner to block obfuscated Powershell scripts. Option would be dependent upon Win 10 AMSI option enabled in the Eset GUI. Justification Microsoft added a like mitigation in the form of a Windows Defender Exploit Guard ASR mitigation effective with Win 10 1709. ASR mitigations are only effective if Windows Defender is enabled as the realtime scan engine. Further justification is Eset's failure to detect malware in highly obfuscated PowerShell script in a Malware Research Group ad hoc test: https://www.mrg-effitas.com/research/current-state-of-malicious-powershell-script-blocking/
  44. 2 points
    Add - Dark Mode on ESET Nod32 would be great.
  45. 2 points
    That's how it works in ESMC (ERA v7) which is currently in the phase of beta testing and will be released soon.
  46. 2 points
    Chris Todd

    Introduce yourself

    Greetings from Australia. My name is Chris, retired Electronics Engineer. I have been using ESET products for many years and am well satisfied with the protection they give me. I am a bit of a "tinkerer" and have 4 installations Windows 7-32, Windows 8-32 , Windows 10-32 and 64 on the one machine. being able to boot into an old version of Windows for recovery procedures has "saved my bacon" a few time when things went awry or got too scrambled in W10 which I use most of the time. An interesting fact about me ?? Nothing exciting ! I am a traveller, haveing visited over 70 countries on fact finding vacations. I am an AVID chatter using SKYPE and other forums with acquaintances in mainly sanish speaking countries.
  47. 2 points
    This will change as of ESMC (ERA v7) in the way that handled threats will be resolved automatically.
  48. 2 points
    I have checked this with the developers, and we are going to change the behavior in V7. If you select "only computers", all of the computers under "DN" will be synced, not only direct parent ones. So it should behave according to your expectations. With regards to the "users", what is the usecase for you? For what do you use the? Do you manually create linking between users & devices, or use the user variables in policies for Endpoint or MDM?
  49. 2 points
    @fchelp You can open the individual task entry in Admin / Client tasks, by the little "+" expand button, and then toggle a context menu for individual entry. You can remove individual triggers, or eventually even edit targets. Screenshot attached. In the next version (7.0) we will be adding possibility to save a filter set, for a various conditions (un-managed computers, computers without security product installed, computers with a specific security product version ...). You will then get the filtered view on top of all computers by few clicks. However, you won´t be able to automate like you do for Dynamic Groups. However, for the future, we are working on more in-depth server side automation, where defined conditions will result in "tagging" a computer, and automation framework will check "assigned tags" and trigger actions based on them. This won´t be done to 7.0, as the feature is a bit complex, but it´s being worked on. Filter sets are below, on the screenshot.
  50. 2 points
    Description: More information in system cleaner Detail: I have mentioned this previously. System cleaner is the new tool in version 11 that alerts you to system settings that have been changed from default the idea being that they could have been changed by malware. The issue is they give no information on the actual setting just the type of setting. I tested this feature by clicking to change settings hoping I would be shown the changes and able to make a decision. What would make more sense is having a way to see the actual changes and a way to ignore certain changes that the user wants to keep. Many people change things themselves e.g Windows tweakers and this feature could cause issues if they change things without realising. This could always be a more advanced option disabled by default. If this cannot happen at least have a lot for this feature so that advanced users can see the changes made. If eset is changing a Windows option it shouldn't be too hard to log the change somewhere. Also an undo feature might be handy as when I tried it out hoping i would be given options eset just changed them and with no lot I have no idea what got changed
  • Newsletter

    Want to keep up to date with all our latest news and information?
    Sign Up
×
×
  • Create New...