[LNK/Exploit.CVE-2010-2568 not deleted]

14 hours ago, itman said:

 

Ref.: https://www.scmagazine.com/lnkexploitcve-2010-2568/article/558054/

Verify all your endpoints are patched.

@itman All ESET endpoint were installed with ver 6.5.2107.1. The computers had detected and move them to Quarantine folder, but it can't delete.. And continues to detect when accessing share files to the server. Make sure that the endpoint was fully updated DB!

[LNK/Exploit.CVE-2010-2568 not deleted]

@JamesR As followed your advice in this case, i have checked on ERA and even login these user account on their computer, ESET product has been installed (ESET Endpoint Antivirus ver 6.5.2017.1) and fully updated.

Ensures that the computer is protected. So how can we prevent this kind of detection again?

Please give me some advice!

Thanks a lot.

[Banking & Payment protection is non-funtional]

As the same with Products for Business, they appear suddenly and i don't know why?

[Non-Functional in NETWORK (Endpoint)]

16 hours ago, Marcos said:

Now advanced protocol filtering logging was enabled but there's still an epfw etl log missing in the Diagnostics folder. Make sure that you actually enable advanced firewall logging. You can leave logging enabled while collecting logs with ELC so that I can verify from configuration if you have actually enabled it.

I followed your advice, Enable advanced firewall logging, then restart the computer and finally collect logs with ELC,...please check with logs update lastest as below:
hxxp://www.fsend.vn/download/UbxmCApH1660ILfH5-OShe2IERFcc379 

[Non-Functional in NETWORK (Endpoint)]

@Marcos

updated: hxxp://www.fsend.vn/download/23ZnLLhyhalcmszevJ8ArXGl-bdf0nLA 

[Non-Functional in NETWORK (Endpoint)]

Have any ideas about this issue? Please let me know... Thank so much!

[Non-Functional in NETWORK (Endpoint)]

@Marcos

Please help to review with log collected as link below:

hxxp://www.fsend.vn/download/wDvpggNE3OT9UCoVu_CoVU0_8V6ADcan 

[Non-Functional in NETWORK (Endpoint)]

Hi all,

i don't know why today i received a notice as below

Try with disable and Enable 3 functions, but it's still like that. I'm using Eset Endpoint Security ver 6.5.2094.0. It was normal a few days ago, but today it's wrong... Some info for you:

How can i fix this issue? Please show me please! Thank in advance

 

[System is Freeze or Hangs after ESET Endpoint Antivirus installed on MAC OS]

18 hours ago, Peter Randziak said:

Hello Hien,

this one has Kaspersky AV installed on the system :-)

You can see it it the "launched_daemons.txt" log from the collecting script.

Regards, P.R.

Noted with thank @Peter Randziak

[System is Freeze or Hangs after ESET Endpoint Antivirus installed on MAC OS]

@Peter Randziak
Today my client after installed Endpoint Antivirus for MacOS get problem with their computer.

Please help me to check log with details as link below, thank you so much

hxxp://www.fsend.vn/download/oSgAXn-RKqM36rPetul3aHlBVHmkuPvy

[System is Freeze or Hangs after ESET Endpoint Antivirus installed on MAC OS]

11 minutes ago, Peter Randziak said:

Hello Hien,

my colleague check the logs and both of the systems has other AV solution (Avira) installed, uninstall it and the system freezes should not occur anymore.

Please share the result back.

Regards, P.R.

Thanks for your useful information

Have a nice day!

[System is Freeze or Hangs after ESET Endpoint Antivirus installed on MAC OS]

Hello @Peter Randziak,

Please download log files with link below:

hxxp://www.fsend.vn/download/r6kRICbZwctia7vgT9jUdnmwr5W0Krq3

There are 2 client using Macbook Air get as the same this issue.

By the way, i'm wondering How can i collect log files by Run the Info_get.command while the system is freezes or hangs, unable to manipulate anything?

[System is Freeze or Hangs after ESET Endpoint Antivirus installed on MAC OS]

Hi all,

My client using Macbook Air with version OS as details below

After Eset Endpoint Antivirus for MacOS ver 6.4.246 installed, some systems (using ver OS 10.11.6 and 10.12.6) are freeze or hangs and can't do anything. Some cases, can't login perform restart the computer!

It still freezes or hangs now, so How can i create log files and sent it to ESET Technical support?

Please give me some advices how can fix it!

Thank in advance.

 

[BSOD on Windows 10 with epfwwfpr.sys?]

@Marcos 

Thanks for sharing.. Ohh sorry,i have a mistake, that's Eset Endpoint Antivirus ver 6.5.2107.1..

As you said, it might be to resolved when start in safe mode and rename this driver? Please show me Which paths can i go to rename the driver epfwwfpr.sys? 

Thanks so much!

[BSOD on Windows 10 with epfwwfpr.sys?]

Hi everyone,

My clients had installed EES ver 6.5.2107.1 three weeks ago, but today, they get a problem with OS Windows 10 x64.. It cannot start and show detail as below:

As i see, it related to "epfwwfpr.sys", which is an ESET Personal Firewall.. but follow the last topic, 

So far, i still not to see a clear solution about this, Can anyone help to share with me how to fixed issue and explain the cause of it?!

Thanks in advance!

[Threat not ACTION on ERA]

8 hours ago, TheMalwareDiscoverer said:

Summarizing what I said: you must set strict mode (if you haven't done this) both on Real time file system protection and on On-Demand computer scan in the advanced configuration menu

Hi @TheMalwareDiscoverer

Thanks for sharing, but Are you sure that if i set "Strict Cleaning" mode both on Real-time and On-demand scanning, it will be show Actions in the column?

[Threat not ACTION on ERA]

54 minutes ago, Marcos said:

Changing the cleaning mode to strict cleaning would cause the scanner not to wait for users action and all files (including PUAs and archives containing also clean files) would be cleaned automatically.

Hi @Marcos, @TheMalwareDiscoverer

I sure that i have set "strict cleaning" mode, try with re-scan..but still have not information in "Action" column. 

[Threat not ACTION on ERA]

Dear @MichalJ

Today i have problem as the same. I'm doing PoC with customer, they asked me that why don't have any "Action" occurred on Dashboard? Seems ESET Product can't not deleted these viruses? (See pic below)

Please help to explain and confirm that How to Eset products can detected and deleted the viruses on Dashboard?

This is very important in evaluating PoC were succeeded or failed!

Thanks so much!

[Bandwidth for per Client?]

Hi Marcos,

Thanks for your info 

[Bandwidth for per Client?]

Hi all,

For example, i have 100 clients in my company, i just installed ERA Server and deploy for all clients completed.

So may i know "How many bandwidth for per client when connect to update DB Virus signature?" (through HTTP Apache proxy on ERA Server or direct connection to internet)

How can i track this? Please share with me..

Thanks.  

[Action column in THREATS section!]

Hi everyone,

On ERA webconsole will be display all threats found on clients, but have you noticed that sometime display "Deleted" or "Cleaned by deleting", even nothing there. So, Can someone help to explain the principle display in column "Action", please?

Thanks a lot!

[Not appear Products on ERA Webconsole!]

13 hours ago, Miami said:

I had similar issue which was caused when client was installed first and agent last. I didn't had time to play with that so I have uninstalled Agent and client and did new installation afterwards.

Hi Miami,

In this case, the client was installed by all-in-one package installer, i tried with other package created from ERA again, but still got the same issue. I don't know what happened meanwhile the connection make sure that completely normal!

[Not appear Products on ERA Webconsole!]

14 hours ago, Marcos said:

Check C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html on a client (Windows Server) for possible errors. Are there any? Also checking trace.log might shed more light.

@Marcos

As i see, nothing is abnormal!

[Not appear Products on ERA Webconsole!]

Hi all,

I installed Eset File Security on Windows Server 2016 Standard from all-in-one package. After that, check out the Win Server 2016 console, has been fully installed.

But, when i login ERA Webconsole, click on this computer -> Show Details -> Tab "Overview", i just only see component is "ERA Agent", NOT Product as picture below

Make sure that the connection between Server-Agent is completely normal. I tried reboot, reinstall with other package all-in-one created from ERA Server (Appliance) but it still doesn't appear on this!

Help me to explain and any solutions how to resolved it?

Thanks in advance!

 

 

[ESET AV REMOVER can not scan old AV on client]

I used to see this thing. Last time, i removed AV exist by Tools Remover of Eset, but still not found any AV applications...