ScottWStewart

One computer on my network is being detected by other PCs as sending an ARP cache poisoning attack. The computer that is being detected as sending an ARP attack has the latest ESET Endpoint Security and defs. One note, the user that uses this workstation complains about the PC being slow. How to I stop the computer doing the attacking to stop? Below is details and screenshot from ESET Remote Administrator. Thanks in advance Computer Name accounting3-pc COMPUTER DESCRIPTION THREAT NAME RULE NAME RULE ID OCCURRED 2017 Nov 13 10:33:39 EVENT Detected ARP cache poisoning attack SOURCE ADDRESS 10.19.67.96 SOURCE PORT 0 TARGET ADDRESS 10.19.67.75 TARGET PORT 0 PROTOCOL ARP INBOUND Yes PROCESS NAME ACCOUNT COUNT 3 Any help would be much appreciated.

One computer on my network is being detected by other PCs as sending an ARP cache poisoning attack. The computer that is being detected as sending an ARP attack has the latest ESET Enpoint Security and defs. One note, the user that uses this work station complains about the PC being slow. Below is details and screenshot from ESET Remote Administrator. Thanks in advance Computer Name accounting3-pc COMPUTER DESCRIPTION THREAT NAME RULE NAME RULE ID OCCURRED 2017 Nov 13 10:33:39 EVENT Detected ARP cache poisoning attack SOURCE ADDRESS 10.19.67.96 SOURCE PORT 0 TARGET ADDRESS 10.19.67.75 TARGET PORT 0 PROTOCOL ARP INBOUND Yes PROCESS NAME ACCOUNT COUNT 3

ESET Remote Administrator (Server), Version 6.5 (6.5.522.0)ESET Remote Administrator (Web Console), Version 6.5 (6.5.388.0) ESET ENDPOINT SECURITY 6.6.2052 There is a count of 77 but when I drill down there are only 73. See Attached. By kickoff I mean the scan is triggered to run.

I am running ESET REMOTE ADMINISTRATOR and have 77 clients connected to it. 70 on IP Range 10.19.67.0-10.19.67.254 (wired network), the other clients are on a wireless router. IP range 172.25.151.6 - 172.25.151.254. Only 4 of the wireless clients are showing up in ESET Remote Administrator Console. In the console the count of clients is 77 PCs. I do not know why 3 of them are not showing up. They are getting updated with the latest Defs but the 3 not listed in admin do not kickoff when the others listed do. Therefore I created a full scan in the Scheduler on each machine to initiate the scan every night. I don't understand why 3 of the 7 don't show up in ESET RA. Any help would be appreciated. Hope you guys have some ideas on what I need to do. Thanks in advance!

Thanks tmiuster2k.

Initiated an IP scan on my LAN and it was detected by ESET Endpoint Security: Detected ARP cache poisoning attack while scanning for IP's on my LAN.

I couldn't find it in Add/Remove programs but did find it in the Start Up Tasks and disabled it. It's from Lavasoft supposedly.

Thanks Marcos, I don't know how it got on the end users PC but I'll get rid of it for sure.

I upgraded a Windows 10 PC with ESET Endpoint Security from 6.6.2046.0 to 6.6.2052.0 . When I rebooted I received the error in the print screen below. Is this an ESET problem or something unrelated? Thanks, Scott

Hi Marcos, did I get to you all the information you needed to assist me? Thanks

The PC is virtually non-responsive now and I can't even move the update over from the USB drive. I can't do a remote update because we are not on a true domain. Is there a place in the Remote Administrator to dissociate the seat from the client?

Thanks Marcos, the PC is very slow and about to fail. I hope it will take the update before it fails completely.

I have a windows 7 PC that is using one of my License Seats and the computer is close to failing. I tried the deactivate products action but got the following error: Product deactivation doneshop2-pc- License - failed to deactivate: Internal server error I need to free up this seat for the new PC that will be replacing the malfunctioning PC.

Quick question: Is it an urgent task to update from ESET Endpoint Security 6.6.2046.0 to 6.6.2052.0? I have to go to every client whenever an update comes out and I have close to 80 computers that will need updating. I wish I could push out the updates but our Domain is managed off site. I have several computers still running 6.5.2107.1. Can I wait on updating those or will there be a security risk? Thanks in advance!

Quick question: Is it an urgent task to update from ESET Endpoint Security 6.6.2046.0 to 6.6.2052.0? I have to go to every client whenever an update comes out and I have close to 80 computers that will need updating. I wish I could push out the updates but our Domain is managed off site. I have several computers still running 6.5.2107.1. Can I wait on updating those or will there be a security risk? Thanks in advance!

Thanks to all you guys for your help. I found a fix for not being able to connect to the Server. I created an installer using the HTTP Proxy option. Now I can install the clients on all my machines on the separate network segment!

I need information on if I can install a second Remote Administrator and still be able to use the remainder of my ESET Endpoint Security licenses with the second server. I need to do this because the PCs I want to install Endpoint Security on are on different IP segments. One starts with 10. and the other 172. One LAN is 10.19.67.0 - 10.19.67.254 The other is: 172.25.151.0 - 172.25.151.254 I hope this makes sense. Thanks, Scott

Hey Vinny, Thanks again for the help. I have compiled the latest version of Endpoint Security but when I look in the ESET Remote Administrator all the new version installs are showing up under lost and found. Any ideas? Thanks in advance!

Thanks Cousin Vinny. Is ESET Endpoint Security 6.5.2107.1 the latest version?

Thanks for the quick reply. I am running WIndows 10 64-bit. This is the first time I've installed ESET on our systems and I checked and we are on the latest version of both the client and server. I will keep you posted on the troubleshooting items you have listed above. Hopefully this will fix the issues. I'm still baffled by the printing issue.

Chrome Issues: Can't get to some sites since installing ESET Endpoint Security 6.5.2107.1 Here is one error I get: There was a problem accessing the site. Try to browse to the site again. If the problem persists, contact the administrator of this site and provide the reference number to identify the problem. Reference number: 388f3829-7452-4010-bb89-c30c15a258fc ------------------------------------------------------------------------ On another computer I cannot go to any website at all. Here is the msg. I get: This site can’t be reachedThe webpage at hxxp://www.lowetoyota.com/used-inventory/index.htmmight be temporarily down or it may have moved permanently to a newweb address.ERR_NAME_RESOLUTION_FAILED On this same computer I can't even print anymore! ------------------------------------------------------------------------ When trying to access the Remote Admin console I get this msg. in Chrome: Your connection is not private Attackers might be trying to steal your information from 10.19.67.85 (for example, passwords, messages, or credit cards). Learn more NET::ERR_CERT_AUTHORITY_INVALID Note: I use my computer to log into the server, which is on the same machine. I've got to have these issues resolved! I am not installing your product on any other computers until I can get these issues resolved. Best Regards, Scott Stewart