Jump to content

cutting_edgetech

ESET Insiders
  • Content Count

    283
  • Joined

  • Last visited

  • Days Won

    1

cutting_edgetech last won the day on February 18 2018

cutting_edgetech had the most liked content!

Profile Information

  • Gender
    Male
  • Location
    USA

Recent Profile Visitors

1,223 profile views
  1. That's not really the solution I want, but I may try it if all else fails. Thanks! I have to do some Network, and Database work now for school.
  2. Anyway, I still don't understand why Eset requires the user to elevate privileges to create a firewall rule when responding to firewall prompts. I don't believe disabling UAC is a good ideal, so that's not a good solution. Maybe Eset can make a change in their design. As I stated above, it took me 3 attempts to get Windows to boot today. The only change I made to my system was changing Eset to Interactive Mode. I believe all the outbound request from Windows before the desktop had a chance to load was causing Windows to freeze because the UAC prompt was unavailable for me to respond to yet. As soon as the desktop successfully loaded on the 3rd attempt, I had to respond to about 15 UAC prompts one after the other since I had to create 15 outbound rules.
  3. I created an Admin account when installing Windows. It's the only account that was created. I would have to check to see what Accounts Windows creates by default. I believe it still creates an Admin Account that can only be used by the OS. I had to take ownership of a registry key a couple of days ago, and I believe I remember seeing another Admin Account in there that had been created by the OS. This is my first time using Windows in 2 years, so that's why I did not know Eset removed the option in the UI, "Require full administrator rights for limited administrator accounts". I had been using Eset since 2003 up until 2 years ago. I have only been using Linux for the last 2 years (Windows 10 broke compatibility with my MB firmware), but I have to use Windows 10 for some of my classes this semester due to some of the Enterprise Software I use. I will have to get reoriented with Windows since many OS changes have been made over the last 2 years. The last version of Windows 10 I used was Windows 10 Pro version 1709. That was the last version of Windows 10 that was compatible with my PC.
  4. Something from Windows 10 or Microsoft Apps for Enterprise (Microsoft Office) is always requested outbound internet access. I have been creating rules since yesterday and i'm still being bombarded with Microsoft outbound request. I just had to respond to about 15 outbound request, one after the other after the desktop appeared. My computer would not boot the first 2 attempts, it stalled at the login screen, I waited for about 15 minutes, before trying to reboot each time. I believe all the outbound request from Windows before the desktop had a chance to load was causing Windows to freeze because the UAC prompt was unavailable for me to respond to yet.
  5. Why does Eset require users using Full Admin Accounts to answer UAC prompts if they choose to remember the action they took (create a firewall rule) when responding to firewall prompts? I'm using a Full Admin Account. I'm the only account on the system other than the default accounts that come preinstalled on Windows 10, like the the built in Admin Account that is used by the OS itself. I've tested all the other major AV vendors at one time or another and none of them have required using UAC to respond to a firewall prompt.
  6. How do I stop Eset from requiring me to elevate my Windows privileges each time I respond to Eset's firewall prompts in Interactive Mode?
  7. Where has the setting for, "Require full administrator rights for limited administrator accounts" been moved to? Eset is driving me insane by having to elevate my window's privileges each time I respond to Eset's Firewall in Interactive Mode. I don't understand the purpose of this option, i'm not a limited Admin, yet Eset always makes me elevate my privileges to respond to firewall prompts. I'm the only Admin on the Computer other than the System Admin Account that is built into Windows 10 by default. I'm using Eset 13.2.18.0 on Windows 10 x64 Pro version 2004.
  8. I'm still waiting on a top notch behavior blocker, or a more usable HIPS like itman has also requested. I would like to see a behavior blocker that can be tuned to different levels of sensitivity. If Eset is worried about it causing false positives, especially in test like AV comparatives then just leave it disabled by default.
  9. hxxp://www.eset.com/int/about/technology/#advanced-memory-scanner "Advanced Memory Scanner complements Exploit Blocker, as it is also designed to strengthen protection against modern malware. In an effort to evade detection, malware writers extensively use file obfuscation and/or encryption. This causes problems with unpacking and can pose a challenge for common anti-malware techniques, such as emulation or heuristics. To tackle this problem, the Advanced Memory Scanner monitors the behavior of malicious processes and scans them once they decloaks in the memory. This allows for effective detection of even heavily obfuscated malware. Unlike Exploit Blocker, this is a post-execution method, which means that there is a risk that some malicious activity could have been performed already. However, it steps into the protection chain when everything else fails." I assume you had something like Emsisoft's Behavior Blocker in mind when you made this request. Just wanted to mention the purpose of AMS and what it does. hxxp://static3.esetstatic.com/fileadmin/Images/INT/Docs/Other/ESET-Technology-Overview.pdf Edit: This PDF literally explains the ins and outs of the software itself and what happens behind the scene on the back-end systems. Every customer/user that is interested in this kind of geek information (it is very informative) should take time and read through the whole PDF. Sorry for the late reply. I have not been on the forum in a while. I didn't think I was going to get a reply to my post. Thank you for the .pdf manual. I will have to look more at AMS, but I don't think it is the same as something like Emsisoft's BB. Marcos said AMS only triggers a memory scan here. https://forum.eset.com/topic/5283-behavior-blocker/So the question is if it only triggers a memory scan then is it only looking for already blacklisted executables.
  10. It would be nice to see Eset incorporate a Behavior Blocker into their products. If something slips through then the behavior blocker can help detect the malware when it executes. They could have the feature disabled by default if they are worried about it causing false positives when being tested by independent test organizations.
  11. I think you misunderstand my request. I'm requesting an option to log all dropped/blocked packets per application that violates any packet filter rule that comes preset with ESS. Many rules come by default. I don't want to just log blocked packets for a rule I have created. The only option currently is to log all traffic for an application. Logging allowed traffic consumes the log file, and makes it hard to find what I'm looking for. It probably also makes ESS a little heavier on the system.
  12. It's already there. Just click on "configure HIPS" and you'll get a huge rules editor where you can add very specific rules. HIPSOptions_ConfigureMarked.pngHIPSRulesEditor.png Thank you! I had already looked at that, and overlooked the tab for the source application. I just hope they continue to add more options on what to monitor like physical memory access, remote code, remote data modification, use DNS API, keyboard access, etc.. Yes, that's expected. But nobody forces you to use the interactive mode. And if you create some rules (e.g. with the learning mode like you did) then you get less prompts. That's the whole point I made though. Learning Mode did not do anything to eliminate the prompts. I used learning mode for about 1 1/2 hours, and ran all my applications while in learning mode. I also used learning mode while rebooting 3 times. I received 15 minutes of none stop prompts before I had to give up trying to use interactive mode. I actually clicked the allow button for 15 straight minutes. Interactive mode was useless on my system. That's why I say they need to use whitelisting with interactive mode to make it more usable. If a rule was correctly created then it shouldn't be blocked. If it still does then it surely wasn't created correctly or only a similar rule was created which doesn't cover the actions the application did later. For troubleshooting this we would need to know the exact application, HIPS rule(s) and more information about how you If the rules were not created correctly then it was not due to any error on my part. I used learning mode to create the rules. I did not make a list of the applications that were being blocked in policy based mode, but I do remember Tor Browser being one of them. I ran all the applications that were being blocked in learning mode multiple times. Policy Mode behaved more like an AE than a HIPS. Policy Mode would have been great if it prompted me for an action instead of blocking the application. Yes, this is expected in the policy-based mode. In this mode HIPS only applies the rules and blocks every other action. And again if you want to receive a prompt you have to use the interactive mode of course. Well, I just responded to this one above. Great, so you found the mode(s) which fit's to you. That's the sense of these modes. Use the one you like. And as you complained about the crowd of messages from interactive mode I would have recommend you the Smart mode anyway. There you have a huge "whitelist", so you will only be prompted for very suspicious actions. Smart Mode is actually not the Mode that fits me. It does not provide the leak protection I am looking for. Smart Mode is the only mode I found usable other than Automatic Mode With Rules.
  13. Rug, I can't get this forum to allow me to multiquote you to specifically address each one of your responses. I'm not sure why. I just tried multiple time, and lost my post for all my trouble. I'm so tired of loosing my post on this forum. I multiquote on other forums all the time without any problems. If someone could tell me how I would appreciate it. The multipquote button is not working. It's like it is not giving me the option since you already multiquoted me.
×
×
  • Create New...