[Secure browser handover is slow as can be IE Takes forever to actually open the window then also load up the page]

NM Problem cleared up after a reboot. Don't know what that issue was.

[Secure browser handover is slow as can be IE Takes forever to actually open the window then also load up the page]

I recently had to reactive my Eset IS due to license expiration. I'm on version 14.0.22.0 and I'm not sure if it updated after inserting a new activation key or not. The problem I'm having all of a sudden now is while on Firefox (v86) if I insert an address that should automatically load up a secure browser such as chase.com the handover from normal browser to secured browser takes forever.

The main window will say it's opening secured browser and it just sits there forever before it actually opens the secured browser window. Then that window will take forever to fully load up the page.

I didn't have these issues until I added a new activation key so not sure if Eset IS updated after doing so or not but something is a miss with it taking forever and a day to open the secured browser window then actually load something up in it. Normal browsing is unchanged and normal.

[Unable to access Phatwalletforums for a few weeks since Eset IS update]

Just now, itman said:

I have no issue accessing that web site on Win 10 20H2 using FireFox and Eset IS ver. 14.0.22:

Very odd since a Firefox refresh should have corrected any issues if it were browser related but considering Edge won't load it either that kinda rules out the browser being the issue and the fact I can access it on my mobile device just fine outside of the Eset environment.

[Unable to access Phatwalletforums for a few weeks since Eset IS update]

I'm currently on ver. 14.0.22.0 and it seems ever since it updated I haven't been able to access https://phatwalletforums.com

Doesn't matter what browser I use. IE Newest FF or EDGE I can access the site just fine on FF with my mobile which isn't running Eset IS for mobile I just have this issue on my desktop that is running Eset IS. I've refreshed Firefox also to no avail. I'm pretty sure this issue stems from Eset IS not allowing the page to load. I receive this error no matter the browser used.

 

Secure Connection Failed

An error occurred during a connection to phatwalletforums.com. SSL received a record that exceeded the maximum permissible length.

Error code: SSL_ERROR_RX_RECORD_TOO_LONG

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem.

[ESS Device control is non-functional (red notice/exclamation mark)]

This problem is still ongoing. Sometimes it happens sometimes it doesn't

 

[ESS Device control is non-functional (red notice/exclamation mark)]

I just started having this red exclamation mark on Eset I believe last night which leads to the titled issue. It says to restart which I have done and it doesn't correct the issue. I'm on v. 10.1.219.0

[ICMP flood Attack]

Food for thought it seems maybe Winscribe requires port 443 possibly with their instructions for setting their service up directly with dd wrt

https://windscribe.com/guides/ddwrt

[ICMP flood Attack]

Had a wild hair and ran the Shields up tests upnp, file sharing, common ports, all service ports on my cell and every test passed with flying colors. I'm not running a mobile version of Eset and just using the default android security on it.

My game rig passes the common port test and has the 443 port as stealth so not sure why it shows closed on my daily unless it has something to do with the VPN service. My game rig also passes the all service ports test where as mentioned before it fails on the closed 443. Both my daily and game rig are on the same home network along with the dish boxes. So why one shows 443 as open and the other doesn't.........

Both my phone and the game rig aren't ran through the VPN and are just protected with the routers security so they show the actual broadcast IP where my daily shows the assigned IP from the VPN service. So it may be the VPN service that has something to do with 443 being closed and not stealth. 

 

Well turning off the firewall on the VPN Client (is said to not allow traffic when the client isn't connected) then disconnecting from the vpn client and running the common ports test again I pass and 443 shows secured. While running the all service ports 443 shows secured also. So I guess it's something to get with Windscribe about.

[ICMP flood Attack]

39 minutes ago, itman said:

As I stated previously in this thread if your share files and devices with other people on your home network, the Eset network setting should be Private; otherwise, it should be Public.

As far as any VPN connection, that should be Public. Note - I am assuming your VPN connection is not to your work place.

Ok I set the wired Network 1 to Home/Office and the WindscripeVPN connection to Public again removing 3 other rogue connections. This is all on a home network not work place.

27 minutes ago, itman said:

Appears it is constantly pinging for connectivity purposes - hopefully. Only way to stop that would be to uninstall the software and that hopefully would stop it. You might consider a "paid" VPN. 

I am paying for the lifetime WindscripeVPN service. It has what they claim is a built-in firewall that doesn't allow connections unless the application is connected but I've occasionally been able to still load web pages when it isn't connected. I wrote into them on this matter but haven't received a message back.

I also unblocked my R7000 from the Network Connection/Troubleshooting Wizard.

I've scanned the home network with Eset and it tells me no threats were found yet this computer and the touter show a yellow exclamation point and state: Traffic blocked. Some traffic from this device has been blocked by the firewall.

Flip side I guess after resetting the router I haven't seen the ARP Poisoning attack notices anymore and don't see anything odd in the router log yet either.

[ICMP flood Attack]

12 minutes ago, itman said:

I believe Dish is associated with AT&T.

I have Uverse. It does indeed use port 443 on the WAN side on the router for inbound communication. Something I am not keen on but can't do anything about.

Bottom line - you're OK.

FYI - When you do the GRC Shields Up test. Make sure all applications are shutdown including your e-mail client. 

I'll have to try that again with all the extra background stuff off.

I've removed all the extra network listings in Eset to what I believe are the home and virtual (windscribevpn) What should these be set as public or private? I've also ran a network scan/tree with eset and the router doesn't come up as a notice anymore but my main desktop (the one I'm on) does and states traffic blocked.

I really don't want to spend a day reloading this computer again but it's seeming that I'm heading down that road. Would probably be best to do all 3 of them just to make sure. I obviously need to make sure the router is completely secure first though or I'm just taking a leak toward the wind. lol

I'm not seeing anymore of the notices in the router log since I reset it either but I also haven't turned off windscribeVPN client either or rebooted yet.

Turn off windscribevpn client and the stupid ICMP threat popup from Eset for the router again.

 

[ICMP flood Attack]

Can't add anything else to the above post because it keeps putting the cursor in what I pasted.

The All Service ports test yields the same as above just 443 as Closed the rest of the ports are secured unlike a few posts up where a bunch were open.

This is also what it had to say about the same test:

Solicited TCP Packets: RECEIVED (FAILED) — As detailed in the port report below, one or more of your system's ports actively responded to our deliberate attempts to establish a connection. It is generally possible to increase your system's security by hiding it from the probes of potentially hostile hackers. Please see the details presented by the specific port links below, as well as the various resources on this site, and in our extremely helpful and active user community.



Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.)



Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

So still having some form of issue I think which with the router being hard reset and having to completely set it up again I would think it's the computers on the home network. I wish they taught this when I was in school I would know what I'm doing with this junk.

[ICMP flood Attack]

Well I reset my router and had a heck of a time getting back into it to set it up. Couldn't access it via any of the 3 pc's or my phone which have regularly been on the network prior to the rest. I pulled out my old surface RT tablet and was finally able to connect to the default connection without issue. Makes me wonder if I have 3 pc's and my cell infected with something.

I've gone back through all the settings with changing my router's IP this go around considering all the freakin problems that have been appearing as of late with these notices out of nowhere which are now on 3 pc's (The ICMP flood issue geared toward the router).

I've ran shields up tests again on my daily and got the same UPNP exposure results that say I can't be seen. Now only port 443 shows up in the common ports test but states:

443

HTTPS

Closed

Your computer has responded that this port exists but is currently closed to connections

[ICMP flood Attack]

39 minutes ago, NOD said:

Cache poisoning attacks are not resolved with DNSSEC?
Verify DNSSEC compliance : https://dnssec.vs.uni-due.de/

https://developers.google.com/speed/public-dns/docs/security

 Nice to think it can spoof your own Ip's to make you think it's something on your own network. To make me feel even more secure:

No, your DNS resolver does NOT validate DNSSEC signatures.

I'm about to find some place to hire a security/network professional to fix this . It's all way over my head. I'm quite sure after reading on that Google page about the cache poisoning attacks I've already allowed it through with Eset. :-(

FYI my AirVPN sub was coming due in July and I picked up a lifetime winscribe VPN sub a few days back for cheap so I just installed that this morning and I've removed AirVPN but nothing seems to have changed. So I don't think the VPN service had anything to do with it.

Since switching to a different VPN client I'm running some of the security tests:

File Sharing:

Attempting connection to your computer. . . Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!

Your Internet port 139 does not appear to exist! One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.

Unable to connect with NetBIOS to your computer. All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.

 

UPNP:

THE EQUIPMENT AT THE TARGET IP ADDRESS
DID NOT RESPOND TO OUR UPnP PROBES!

Common Ports:

FAILED Ports 21,22,80,143, and 443 are open

All Service Ports:

21,22,80,143,443, and 587

Solicited TCP Packets: RECEIVED (FAILED) — As detailed in the port report below, one or more of your system's ports actively responded to our deliberate attempts to establish a connection. It is generally possible to increase your system's security by hiding it from the probes of potentially hostile hackers. Please see the details presented by the specific port links below, as well as the various resources on this site, and in our extremely helpful and active user community.



Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.)



Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

Looks like I'm less secure with this VPN or something is on the system/router now that is mucking with more. I only had ports 88 and 89 open prior I believe.

 

[ICMP flood Attack]

I too have a bunch of networks showing up in Eset on my daily/media server while we just have two showing up on my fiances pc and my game rig.

Eset SS on my fiances computer and my game rig both show:

Wired Network 1 Home or Office Network inherited from Network Adapter

Wired Network 2 Home of Office Network Inherited from Network Adapter

While my daily shows the attached image. Looking up the in Network and Sharing center I only show two active networks. The first being Private Network using the Realtech network adapter and the second using TAP Windows Adapter 9. The unidentified network shows no network connectivity yet there is data up and down active on it. I'm not sure if that is the tunneling adapter that AirVPN uses or not.

 

 

 

[ICMP flood Attack]

So I turn off UPNP on the router and now I'm getting this pop up from Eset and another one for a duplicate IP on the home network I didn't catch that one in time before it went away though.

The below "computer" is both my 65" Samsung tv and the Dish hopper in the living room. I'm also getting these notices on my fiances computer since turning off UPNP on the router. If I turn it back on these notices stop.

[ICMP flood Attack]

17 minutes ago, itman said:

You don't have a problem. The router is dropping/blocking those requests on the WAN side of the router. In other words, they are not getting through to your internal network.

Are these ok though:

[UPnP set event: Public_UPNP_C3] from source (My actual computers IP on the network)

[LAN access from remote] from 67.148.153.40:49792 to 192.168.***.***:5101, Saturday, Jun 10,2017 00:41:13 (Dish Hopper IP)
[LAN access from remote] from 67.148.153.44:54215 to 192.168.***.***:5101, Saturday, Jun 10,2017 00:35:37 (Dish Hopper IP)

[LAN access from remote] from 65.55.158.119:3544 to 192.168.***.***:63694, Friday, Jun 09,2017 21:20:18 (My actual computer IP on the network)

 

I don't know what those from IP's are.

[ICMP flood Attack]

6 hours ago, itman said:

Agreed.

You need to examine the source of the echo requests which can on be done by examining the router's firewall log for like activity. If external flooding activity is occurring, it needs to be stopped by the router firewall.

Again, most router firewalls are configured to drop incoming ICMP echo requests by default. Of course, routers can be misconfigured or hacked.

The above that I posted is from the Log. Not exactly where to go from here since if what your saying is in fact what is going on then this is an issue obviously and somehow needs to be stopped. Getting a bit over my head though.

[ICMP flood Attack]

I wouldn't be so sure on the excluding the router from the icmp detection bit. I just checked my log for the heck of it and had these:

[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:56:15
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:56:00
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:55:50
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:54:31
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:54:21
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:53:57
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:52:25
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:52:11
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:52:01
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:51:51
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:51:37
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:51:25
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:51:10
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:50:57
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is drop Thursday, Jun 08,2017 21:50:25

[Eset 10 network protection problems]

Same issue here for the past couple of days. If I click them to turn them on it says I will be disabling them. This is on any of the 3 choices FW, IDS, or Botnet.

 

Can't even connect to the internet on the pc that does have this problem. Shows network but no internet. Try to uninstall eset and it just sits there looking at me like I'm stupid. Can't uninstall in safe mode because the service to do so doesn't run in safe mode.

After about 15-20 minutes last night the uninstall finally finished and I shut down for the night. This morning I install a fresh install of Eset. I no longer have the 3 items red but what I do have now is the stupic ICMP Flood attach error. That of which I haven't had on this pc. Of course like just about everyone else it's related to my router (R7000 in my case) I was on ver 9 something before this problem started happening on my daily. Est SS just updated to 10 on my game rig which is when the 3 red items started with last night being the first time I couldn't even get on over the past couple of days. After removing Eset SS I was able to connect online without issue. Which I'm still able now but there is some issue with v 10 to cause this icmp flood attack error directed at our routers I believe considering it wasn't a problem on v9.

 

[ICMP flood Attack]

Not the only one with this problem as you have stated. I think this started with the last Eset update or maybe even the Creators Update for Win 10. I'm on AirVPN though so I only get the message when not connected through AirVPN which is at boot up as the Eddie program is loading. Once I connect through Air the stupid Eset window goes away and doesn't come back unless I disconnect from AirVPN in the Eddie client.

Having a new issue with Eset though in showing a red box with a 3 in it for Setup. It's showing my Firewall, IDS, Botnet are all red. If I click them it says are you sure you want to disable them. So they aren't off or are they?

[ICMP Flood Attacks????]

20 hours ago, itman said:

Port 88 is used by Xbox Live 360.

Port 89 only use I know of is:

port 89 is a dedicated services port used as a Telnet Gateway between Mass Institue of Technology (MIT) and ___ University (SU)

Note that if you are using a router, the GRC test is reflecting the inbound port status of the router.

Your Flood attacks are most likely due to this:

Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

Again, this can be controlled via router firewall settings. However with some ISP provided routers, ICMP Echo Reply requests are allowed since the ISP uses such to ensure connectivity exists.

So the two ports that are open are ok?

What would I need to do with the router settings for the ping reply? Using R7000 retail non ISP provided.

[ICMP Flood Attacks????]

On 1/7/2017 at 9:27 AM, itman said:

Normally, your router should be configured to block external ICMP echo requests. You can test if that is functional by going to this web site: https://www.grc.com/shieldsup then click on the "Proceed" tab in the displayed web page. Then select the "Common Ports" scan. When it completes, note the results of the "Echo Ping" test. It should state that you passed. If you didn't pass, then your router is not properly configured to prevent ICMP Flood attacks. The router is your first line of defense against ICMP Flood attacks.

If you passed the Echo Ping test, then a number of other scenarios might be occurring. An external DDoS attack might be occurring against your router and it is overwhelming the capability of the router to block such traffic. You should examine your router's log file to determine if this is the case. If an external DDoS ICMP Flood attack is occurring, you need to create a router firewall rule, assuming your router has a configurable firewall, to block all inbound traffic for the IP addresses that are the source of the DDoS attack.

If an external DDoS attack is not the case, then it is possible that your router is "misbehaving." It is normal for some routers to issue an ICMP echo request to establish connectivity with a target device. If there is a problem with this request being acknowledged by the targeted device, it could be the router is stuck in a loop where it is repeatedly sending ICMP echo request transactions and Eset's IPS protection is interpreting this activity as an ICMP Flood attack. 

I have recently been getting this notice while my computer is connecting to AirVPN after reboot. (The VPN service has it's own tunneling adapter which bypasses the windows network from my understanding. Running the link above I yield the following results:

Solicited TCP Packets: PASSED — No TCP packets were received from your system as a direct result of our attempts to elicit some response from any of the ports listed below — they are all either fully stealthed or blocked by your ISP. However . . . Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.) Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

I will add that with using AirVPN I'm claimed to be actually invisible. My IP that comes up is the one from AirVPN and not my actual IP address nor my routers.

While running the other test (upnp) from that page I got these results:

 

THE EQUIPMENT AT THE TARGET IP ADDRESS
DID NOT RESPOND TO OUR UPnP PROBES!

File Sharing test:

Attempting connection to your computer. . . Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!

Your Internet port 139 does not appear to exist! One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.

Unable to connect with NetBIOS to your computer. All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.

 

 

 

Service port check yielded the following:

0

31

32

63

64

95

96

127

128

159

160

191

192

223

224

255

256

287

288

319

320

351

352

383

384

415

416

447

448

479

480

511

512

543

544

575

576

607

608

639

640

671

672

703

704

735

736

767

768

799

800

831

832

863

864

895

896

927

928

959

960

991

992

1023

1024

1055

Solicited TCP Packets: RECEIVED (FAILED) — As detailed in the port report below, one or more of your system's ports actively responded to our deliberate attempts to establish a connection. It is generally possible to increase your system's security by hiding it from the probes of potentially hostile hackers. Please see the details presented by the specific port links below, as well as the various resources on this site, and in our extremely helpful and active user community. Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.) Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

Alot of network stuff is always way over my head but it seems I have two ports open from the above check and that could be where this icmp bit is coming from?

[Eset Anti-Theft infinite test 45+ minutes so far]

I just reloaded my pc with a fresh reformat. So I'm setting things up. When I logged into Anti-Theft there were two instances of this pc listed. The second had a 1 after it. So I deleted the one with the 1 since my pc isn't named that. Well it has been running the test now for over 45 minutes. I've refreshed and it still states test is still running.

 

I initially purchased a 3 pc 1 year Smart Security and have only installed to this pc. Hopefully it didn't take this second install away from one of the 2 remaining pc installs.

 

I also don't see the ghost account when I look at Drive security settings. I hope it didn't make this fresh install the pc with the 1 at the end and I didn't just screw everything up.