Marcos

I'm not sure if it's feasible since it could be misused, e.g. by malware.

You would need to disable self-defense in Endpoint and reboot the machine.

Try restarting the ERA Agent service.

Does temporarily setting the ESET Remote Administrator Agent service to not start automatically and rebooting the system make a difference? This would confirm or deny that it's cause by applying an ERA policy.

Remove all exclusions and exclude the path * with the detection name @NAME=MSIL/HackKMS.E.

Built-in rules can be displayed after checking the appropriate box in the rule editor. For communications with no rule the user is asked about action to take.

Unfortunately we still do not know what is triggering the issue. A customer that our engineers were working with said that the issue stopped occurring without any intervention or changes made. If we have some news, we'll let you know. Leaving scanning of sent email is basically safe since users do not normally attach fresh malware to email and even in such case the file would be scanned by real-time protection.

If you are ok with Coinminer running on the machines, did you exclude @NAME=JS/CoinMiner.D and @NAME=JS/CoinMiner.F for whole drives, ie. with * as the path?

Most likely you have Win32/UwS.GlaryUtilities and Win32/UwS.DriverTalent extensions installed. Try running a full disk scan with no exclusion set up.

I think you have an incorrect filter set. Instead of the condition "is" you should use "contains".

It's weird anyways. I didn't find the Password value in your ESI log, only Username was there but have no clue why. Downloading the latest installer from ESET's download page and installing it from scratch is a good idea before troubleshooting possible issues further.

There was a problem installing drivers. In particular, the signature could not be verified. We've got one ticket with the very same error so far but even engineers could not find out what exactly in the OS is failing that is causing drivers' signatures to verify. I'm afraid the only solution would be reinstalling Windows. Also I've found quite a lot of recent errors in the Windows system event log, some of them indicating hard disk failures: Do you have UAC enabled? Have you tried running chkdsk to find out if the disk is faulty? If you right-click C:\Program Files\ESET\ESET Security\Drivers\eamonm\eamonm.cat, select Properties -> Digital signature and double-click the signature in the list, is it valid or not?

To start off, collect logs with ELC. It could be that there''s an issue with registry permissions or whatever.

Do you mean that the issue hasn't occurred with procmon logging? We've got a Procmon log in the meantime where SearchProtocol.exe was holding an update file which prevented ekrn from renaming the folder.

Is 192.168.1.10 the IP address of your notebook?

Not sure which of these blocked communications could cause the issues. Will pass it to developers for investigations.

Never come across such issue yet. Moreover, there's no relation between downloading updates and protocol filtering. I'd suggest contacting customer care so that the case is properly tracked.

The Diagnostics folder is empty. That would happen if you don't enable advanced firewall logging under Tools -> Diagnostics in the advanced setup.

This is being discussed here: https://forum.eset.com/topic/14766-home-network-issues/. We kindly ask you to provide logs as requested in order to tell what is causing the issue. This topic is rather about incorrectly set up trusted zone.

Without checking your EIS settings and diagnostics logs we can only speculate about what's going on. It could be that the firewall is not configured properly and blocks inbound non-initiated communication as it's supposed to in automatic mode. Please continue as follows: - In the advanced setup -> Tools -> Diagnostics enable advanced firewall logging - Reboot the computer - Reproduce the problem - Stop logging - collect logs with ELC. Then upload the logs to a safe location (e.g. Dropbox, Onedrive, etc.) and drop me a message with a download link and information about your computer's and TV's IP address.

Press F5 to open advanced setup.

Please note that you have ESET NOD32 Antivirus installed. It's a product which doesn't have the firewall so obviously you cannot find firewall settings there. You can either install ESET Internet Security which contains the firewall provided you have an EIS license purchased, or keep ESET NOD32 Antivirus where you don't configure network options.

You can change the type of network here:

That explains it. You expect to have firewall settings in ESET NOD32 Antivirus which doesn't contain the firewall.

Could you temporarily uninstall EEA and install ESET Internet Security? Activate a 30-day trial version. I assume the same error should be reported. Then enable Advanced firewall logging in the advanced setup -> Tools -> Diagnostics and reboot the computer. Next disable logging and collect logs with ELC. Upload the generated archive to a safe location (Dropbox, OneDrive, etc.) and drop me a message with a download link.