Marcos

First of all, I'd suggest installing EIS v11.1.54. Then navigate to Help and support -> Details for Customer care, click Create advanced logs and run update. After a while stop logging, gather logs with ESET Log Collector and provide me with the generated archive.

Please post a screen shot of the main gui with the error that you are getting. The issue being discussed in our forum recently has been reported only on Win10 x86. Are Ekrn.exe and egui.exe not running in the task manager?

It's a question of time when it reoccurs. I'd suggest temporarily disabling protected service in the HIPS setup and rebooting the computer.

You can do it in the advanced setup -> user interface -> application statuses. However, disabling LiveGrid completely will expose your computer at risk, cleaning capabilities will be deteriorated and Ransomware shield may not be able to protect you from new ransomware without updating modules.

Does temporarily disabling protected service in the HIPS setup and rebooting the machine make a difference?

Please try temporarily disabling protected service in the HIPS setup and reboot the computer. Let us know if that helped.

It should be enough to temporarily disable protected service in the HIPS setup. By disabling HIPS completely, you also disable self-defense, Advanced Memory Scanner, Exploit Blocker and Ransomware shield.

Are you able to boot in safe mode and get the memory dump generated during a crash for further analysis?

Ok. Since you have ESSP 11.1.54 installed, you can generate a pcapng log by clicking "Create advanced logs" in the main gui -> Help and support -> Details for customer care. Then run update, disable logging and collect logs with ESET Log Collector. If the generated archive is too big to attach to a private message, upload it to Dropbox, OneDrive, etc. and supply me with a download link.

One more thing to try - temporarily disable protected service in the HIPS setup and reboot the machine. Does that make a difference?

Could you try installing KB4103721 on 1 pc and see if it resolves the issue? Please let us know about your findings.

Support for Thunderbird was dropped years ago and older versions are not supported in current versions of security products. However, as long as you receive email through POP3(S) or IMAP(S), received email will be scanned for threats anyways.

It is already supported and the feature is called Override mode.

Most likely update files were tampered with on a firewall or proxy. Please provide a Wireshark pcap log from an update attempt.

Have you already deployed ERA agent, e.g. via GPO and is it reporting correctly to ERAS ?

ESET products can be uninstalled the standard way via Program and features. Should that fail (e.g. because the original installer has been unwittingly removed in the mean time), you can run the ESET Uninstall tool in safe mode.

Would it be possible to provide us with the VM image for the time necessary to debug the issue? Afterwards we would dispose of it.

Please gather the following stuff when the issue occurs: - a complete dump of ekrn generated via the advanced setup -> tools -> diagnostics -> create (dump) - logs gathered with ELC Upload a compressed dump together with the archive generated by ELC to a safe location (e.g. Dropbox, Onedrive, etc.) and drop me a private message with download links.

Please follow the instructions posted by Peter Randziak above.

You will lose the possibility to restore the file from quarantine. If you are positive that it's malware which was quarantined, feel free to delete it from quarantine. However, quarantined files are usually quite small so they shouldn't waste disk space and are stored in an encrypted form on a disk.

This will change as of ESMC (ERA v7) in the way that handled threats will be resolved automatically.

Policies are not merged. You can only enforce a particular policy to take precedence over other policies. As of ESMC (ERAv7), it will be possible to merge lists, such as Firewall or Device Control rules.

Does the error / issue occur right after Windows starts up or only later after an update? Please post a screen shot of the Memory pane in Task manager -> Performance tab.

Do all of you have Windows 10 32-bit installed?

The problem is with the license M33F-XXXX-XXXX-XXXX-4KRG which is a leaked one. Please purchase a license or use a 30-day trial version.