Marcos

This is by design. We had to change the way egui starts in order to comply with Microsoft certification.

Does temporarily disabling protocol filtering in the advanced setup make a difference? If not, what about renaming "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEpfw.dll" in safe mode?

Try uninstalling ESET, removing all possible remnants in safe mode using the ESET Uninstall tool and install the latest v10.1 from scratch. Let us know if that resolved the issue.

As stated in the blog by Avast: As only two smaller distribution products (the 32 bit and cloud versions, Windows only) were compromised, the actual number of users affected by this incident was 2.27M.

Please see my suggestion above and let us know if it resolves the issue.

Please contact your local customer care so that the issue is properly tracked. At the time when the program asks for a computer restart, the upgrade process should be already completed and the restart is required only for updated drivers to load.

What about this setting?

Should you encounter such issue again, please provide a Wireshark log from an attempt to update.

Do you have protocol filtering and web access protection enabled in the advanced setup?

I'm sorry but if the issue persists after completely uninstalling ESET it's highly unlikely that it's ESET related.

If you have no firewall rules applied via an ERA policy, continue as follows: Create a Procmon log at the time when the error occurs. For instructions, see the FAQ section at the right-hand side of this forum. When done, compress the dump, collect logs with ELC, upload both files to a safe location and pm me download links. If rules are applied by a policy, learning mode will not work.

Please continue with the discussion here: https://forum.eset.com/topic/13175-ccleaner-v5336162-and-ccleaner-cloud-v1073191-had-been-compromised/.

ESET has detected it since update 16099: Win32/CCleaner.A, Win32/CCleaner.B. At that time KAV didn't detect it at VirusTotal yet.

Do you have protocol filtering enabled? If so, please do the following: - enable advanced firewall logging in the advanced setup -> tools -> diagnostics - restart the computer - collect logs with ELC - disable logging Upload the generated archive to a safe location and pm me a download link.

Now advanced protocol filtering logging was enabled but there's still an epfw etl log missing in the Diagnostics folder. Make sure that you actually enable advanced firewall logging. You can leave logging enabled while collecting logs with ELC so that I can verify from configuration if you have actually enabled it.