Marcos

Try creating 2 rules - a blocking rule that will block communication for all IP addresses and an allowing rule that will allow the communication within the range 1.1.1.1 - 2.2.2.2.

Note the "Exclude from detection" box. If checked and you select No action, the PUA won't be detected at the given location on a disk again.

The application is detected as a potentially unsafe application (an OpenCandy dll is often bundled with free software). This detection is disabled by default.

We ordered an Asus router some time ago and waiting for delivery. If we're able to reproduce the problem, we should be able to debug it and possibly make a fix.

In the main gui, navigate to Setup -> Network -> Configure rules and zones. On the Zones tab, double click "Addresses excluded from active protection (IDS)" to edit the list.

Scheduled tasks can be reverted to default ones for business products by means of ERA. Perhaps the reason why this button is not present is that home users would be able to install a product from scratch easily

The quickest solution would probably be adding PS3 Media Server's IP address to the list of addresses excluded from active protection in the Zone setup.

Ok, apparently there's no problem with Web control but with SSL scanning. If you run certmgr.msc, is an ESET root certificate listed under Trusted Root Certification Authorities -> Certificates?

Please check if the SSL scanner is working properly by downloading the Eicar test file from https://secure.eicar.org/eicar_com.zip. Are websites accessed via http blocked fine by Web control?

Does the issue occur only with your IMAP servers or you're able to reproduce it with gmail as well? What IMAP servers do you use? What version of the Internet protection module do you have installed at the moment?

Hello, does BSOD occur also if you run installation with the computer disconnected from network?

In order to troubleshoot the issue, we'll need to get install logs created per the instructions in this KB article.

When a new network is detected, the firewall asks you if it's a public network or home/work network. Sharing in the network will be disabled if you choose public network. Please open the rule and zone editor and make sure the local subnet is in the trusted zone or add it to TZ manually.

I've just tried it and the whole 77 MB installer was downloaded in ~ 1 minute at an average speed 1,4 MB/s.

Disabling one of the protection modules must have helped if EAV was actually somehow involved in the issue. Did you try disabling HIPS and restarting the computer? What about renaming C:\Windows\System32\drivers\ehdrv.sys in safe mode? If it doesn't help, does uninstalling EAV actually makes a difference?

Please drop me a pm with your activation code, I'll check it out on files. In the mean time, you can either activate a trial license (fully functional) and re-activate it later using your activation key.

Couldn't it be that these are removable media readers with no medium inserted?

Could you please run "sc query edevmon" as an administrator at the moment when the issue occurs and post the output here?

A lot of the mentioned files are crucial system files that are exclusively being used by Windows and access for other applications is denied.

Control Panel -> Admin tools -> Computer management -> Storage -> Disk management -> [drive] -> Change driver letter and paths -> Remove. Nonetheless, I'm not sure if it's safe to do that.

I can imagine this would happen for the following reasons: - a file on a HDD is detected (threat or PUA) and access to the file is blocked by real-time proteciton - a file that takes longer to scan (e.g a larger sfx archive) is copied to the external drive but the backup software doesn't wait until it's scanned completely and returns an error Please post a screen shot of the error.

The log appears ok to me.

Why do you think that ESS is causing the issue? Did disabling some of the protection modules help? If no alert is triggered, it could be only HIPS that might block certain operations.

Do you mean that ESET detects and quarantines the file?

Should the problem occur again, please capture the http communication using Wireshark, upload the log to a safe location and pm me the download link.