Jump to content

Zardoc

Members
 View Profile  See their activity

  • Posts

    120

  • Joined

  • Last visited

 Content Type 

Posts posted by Zardoc

    PGP Disk and NOD32

    in ESET NOD32 Antivirus

    Posted

    On 8/16/2019 at 12:32 AM, Marcos said:

    I see that PGPlsp.dll is registered as LSP in Winsock. Also you have Windows 10 installed where ekrn runs as a protected service by default.

    We have recently found out that under unknown circumstances (probably after some Windows update), ESET gets removed from Winsock. Subsequently the system attempts to load a 3rd party dll into ekrn which obviously fails, causing Winsock initialization to fail as well.

    What you can do is reinstall ESET so that it gets re-registered in Winsock.

    Good call.

    That's what I did initially.

    Thanks.

    PGP Disk and NOD32

    in ESET NOD32 Antivirus

    Posted · Edited by Zardoc
    Because i'm not perfect :)

    Hi all,

     

    Just updated Symantec Encryption Desktop 10.4.2.MP3 (PGP Disk) on three machines. After each install I get Issues with NOD32 Antivirus. If I uninstall and reinstall NOD 32, issues go away. I'm not sure if the problem is related to PGP PGPWLD pwflt.dll.

    One machine out of three updated without the problem of module updates not working.

    I cleared the update cache to no avail.

    Marcos, got any ideas why this is happening with this update of PGP and did not with other updates ? SEE Images

    Thanks.

    Eset 001 2019-08-11_19-00-42.png

    Eset 002 2019-08-11_19-00-42.png

    Eset 003 2019-08-11_19-00-42.png

    Eset live grid servers cannot be reached

    in ESET NOD32 Antivirus

    Posted

    System settings have not been modified or changed in the past month. Only added feature is update to Symantec Encryption Desktop_10.4.2 MP1 HF1

    After that, issues started with server. Proxy settings were not touched. I uninstalled NOD 32 completely and reinstalled. So far, no messages. I did same update of Symantec Encryption Desktop_10.4.2 MP1 HF1 on another computer and same issues happened. I have another computer that was not updated and nothing has gone wrong so far. There seems to be a conflict between Symantec Encryption Desktop and NOD 32.

    Update 11.1.42 Event error ScRegSetValueExW

    in ESET NOD32 Antivirus

    Posted

    On 2018-04-25 at 12:54 AM, Marcos said:

    Please refer to my post above. The new version has absolutely nothing to do with the event in question and will be addressed in HIPS module 1316+. Currently module 1317 is available on pre-release update servers.

    OK Marcos, so it doesn't. The new pre-release HIPS doesn't show the error. When is the release scheduled?

    Update 11.1.42 Event error ScRegSetValueExW

    in ESET NOD32 Antivirus

    Posted

    19 hours ago, Samoréen said:

    Also, note that the messages you get in the Events log are the same as those I got when I encountered this issue.

    So, unfortunately, I tried your fix and it does not work.

    I backed up to version 11.0.159.9 and no issues to report.

    I really am fed up of wasting almost an hour every month to deal with issues concerning updates with my AV. I've been a long time user of NOD (since the days Aryeh was with the MVP program) and I remember that it wasn't the case with NOD in the beginning. At least if someone could explain the problem and the solution expected would be appreciated.

    The new business attitude: ''The bigger you get the less you care.''

    Update 11.1.42 Event error ScRegSetValueExW

    in ESET NOD32 Antivirus

    Posted

    OK, so now we all agree it's a service and that this issue is a known problem with antivirus software.

    My specialty is building machines and optimizing them. I don't have any knowledge in programming or maintenance of antivirus software.

    This is one of the few software services that not only do I pay for but have to participate actively in it's maintenance.

     

    Now I don't have any idea why I have this error but like I mentioned before, I pay for this service to fully protect my machine and even if I don't see any known issues with the software, it is very disconcerting knowing that it is flagging an error.

    Some people don't believe in antivirus software but It gives me piece of mind when it works. Now it's not working properly.

     

    Marcos, what's the fix please?

    Update 11.1.42 Event error ScRegSetValueExW

    in ESET NOD32 Antivirus

    Posted

    5 hours ago, Marcos said:

    I'm not getting those records in the system event log after upgrade to v11.1.42.1. If you clear the ESET event log, are those errors logged again after a computer restart?

    No it does not.

     

    1 hour ago, itman said:

    Here's what I believe is causing the ScRegSetValueExW Event 7006 Access denied event.

    Eset has two services dependent upon ekrn.exe; ekrn and ekrnEpFw which is titled Eset firewall helper service.

    The ekrn service is set to Automatic which means it is started up as part of the Windows boot process.

    The ekrnEpFw service is set to manual which means it won't start until the service dependency i.e. ekrn.exe is started.

    I believe the Windows Service Control Manager which manages all Windows services execution assumes manually started processes will occur sometime after the boot process has fully completed. For starters, it is unusual to have two services started by a non-Windows process. Microsoft designed svchost.exe to do that.

    What I believe is happening is the ekrnEpFw service is trying to start up during the boot process due to ekrn.exe having begun execution. However when the ekrn service starts up, it does so as a protected process. When ekrnEpFw service starts up and due to its manual startup type, Service Control Manager is trying to write to its associated registry key. It can't do so since ekrn.exe which is running has prevented via its self-protection feature any writes to the registry key.^_^

    Things to explore. Perhaps make both services start Automatic - not sure of this one. Create a separate protected program to start ekrnEpFw service running as a child process to ekrn.exe? Additionally, both services are attempting to set ekrn.exe as a protected process which might also be the cause of the issue. Also the ekrnEpFw service has a dependency of the Base Filtering Engine service being started whereas the ekrn service has no dependancies. What needs exploring is if the ekrnEpFw service was set to Automatic but not protected and the ekrn.exe set to Manual but protected, would it change ekrn.exe to protected mode?

    Unfortunately, the ekrnEpfw service is protected and can't be modified. :(

    Update 11.1.42 Event error ScRegSetValueExW

    in ESET NOD32 Antivirus

    Posted

    Since update 11.1.42 an error in event log has started showing up.

    ScRegSetValueExW Event 7006 Access denied.

    After searching the web, I found that this error is often related to anti virus software. Kaspersky, AVG etc. have had this error. So my guess is that Eset must know the fix.

    I haven't noticed any functional issues but an error related to my Antivirus software is not something that I take lightly.

    So, Marcos, I created a specific post for this problem. Can you please explain the problem?

    BTW, I used uninstaller to remove and reinstall software. Problem disappears for a few hours then returns.

     

    Included, original install logs.

     

     

    Logs 2018-04-03_05-27-48.png

×
×
  • Create New...