Jump to content

Marcos

Administrators
 View Profile  See their activity

  • Posts

    36,507

  • Joined

  • Last visited

  • Days Won

    1,453

 Content Type 

Posts posted by Marcos

    EFS HIPS Question

    in ESET Products for Windows Servers

    Posted

    It's nothing unusual, I have several similar records as well:

    Time;Application;Operation;Target;Action;Rule;Additional information
    5/28/2019 4:38:13 PM;C:\Windows\System32\svchost.exe;Get access to another application;C:\Windows\System32\winlogon.exe;blocked;Self-Defense: Do not allow modification of system processes;Modify state of another application

    So unless you are experiencing issues caused by SD, consider it normal.

    Import Offline License in NOD32 for Linux

    in ESET Endpoint Products

    Posted

    The product will work without activation because it doesn't support it. A brand new version of Endpoint for Linux with the activation system will be available probably next year.

    If you plan to update the computer from a mirror, just set the path to the mirror through a policy. If the client will access it through a network share, also the username and password for authentication to the mirror folder will be needed which is not needed if the mirror is accessible via http.

    If the machine has Internet connection and you plan to update it from ESET's update servers, just send a software install task to the client and the agent will add a username/password for authentication against ESET's update servers in the configuration.

    ESET Dynamic Threat Defense - change of servers' IP address

    in ESET Endpoint Products

    Posted

    For those who have a license for ESET Dynamic Threat Defense and connect through a firewall with the communication restricted to IP addresses, as of June 3 we are going to add a new server in the US which also brings a change of the IP addresses of EDTD servers as follows:

    https://support.eset.com/kb332/#EDTD:

    Hostname IP address
    r.edtd.eset.com

    137.117.138.135     (Europe)

    13.83.244.211     (USA)

    d.edtd.eset.com

    137.117.138.135    (Europe)

    13.83.244.211     (USA)

    The nearest server for communication will be picked based on your IP address. We recommend allowing communication with both IP addresses.

    ESET Endpoint Antivirus Sotware Updates

    in ESET PROTECT On-prem (Remote Management)

    Posted

    By default ESET security products check for new version of modules in 1 hour interval plus we also employ streamed updates and LiveGrid check for maximum protection.

    If you mean program updates, currently you need to create and send a software install task on clients when you want to upgrade a security product to a newer version. However, we now have so-called micro program component updates ready which will allow for automatic update to the latest version if you configure program updates to be installed automatically.

    EEI making information up

    in ESET Inspect On-prem (Detection and Response)

    Posted

    Ok, so this is most likely what happened:
    - the support agent received encrypted files from a customer
    - upon saving the encrypted files on a disk, Ransomware shield detected a suspicious behavior and triggered a detection which was not logged locally in the Detection log due to a bug but it was reported to EEI

    What I would suggest:
    - Excluding the ESET folder in which files from customers are saved to
    - Editing ACL and denying the permission to read & execute files in the folder to prevent the support agent from executing malicious files that might be saved there.

    Malware

    in Malware Finding and Cleaning

    Posted

    0b36728a48fbff17a45be400c628052e6dca95fc - NSIS/CoinMiner.T trojan
    NsCpuCNMiner32.exe - a variant of Win32/CoinMiner.DQ potentially unwanted application
    NsCpuCNMiner64.exe - a variant of Win64/CoinMiner.CZ potentially unwanted application

    The first one is a NSIS archive, the detection was added in April 2018. The other 2 executables (PUAs) are inside the NSIS archive, the detection was added in July 2017.

×
×
  • Create New...