Jump to content

pcguy

Members
 View Profile  See their activity

  • Posts

    46

  • Joined

  • Last visited

  • Days Won

    1

 Content Type 

Posts posted by pcguy

    Why is ESET blockling grammarly.io

    in ESET NOD32 Antivirus

    Posted

    I use Grammarly a spell and grammar checker extension in all my web browsers. Today Oct 28th ESET Antivirus 16.2.15 with current updates is blocking grammarly.io

     

    Time;URL;Status;Detection;Application;User;IP address;Hash
    10/28/2023 9:59:01 PM;https://f-log-extension.grammarly.io;Blocked;PUA blacklist;C:\Program Files\BraveSoftware\Brave-Browser-Beta\Application\brave.exe;GREG_I5\gregg;52.204.27.140;C134E1FC60311B40CEF80FBC7AAF35EFFA82C0DB
     

    Website certificate revoked

    in General Discussion

    Posted

    40 minutes ago, itman said:

    All browsers by default should be blocking access to web site with a revoked cert using their default cert. security settings.However, browser default cert. security settings can be overridden as shown in this article: https://bytebitebit.com/turn-off-security-certificate/ .

    That is what should happen however I have tried 3 computers here two do not have Eset installed and which I know for certain are using the default settings and both MS Edge and Chrome go to https://transfert-transfer.bac-lac.gc.ca/  without any issue. All of these computers are Windows 10 boxes fully up to date. A friend in the USA has the same experience with Windows 10 MS Edge they also get the login page. 

    Website certificate revoked

    in General Discussion

    Posted

    8 minutes ago, itman said:

    Actually, Microsoft Defender has nothing to do with revoked certificate validations since it does not perform HTTPS scanning activities.

    It is the browser responsibility to block a web site connection with a revoked certificate where a security solution is installed that does not perform HTTPS scanning.

    Do you have AdGuard installed?

    I do not have AdGuard installed. The non Eset computer is simply a Windows10 Pro installed with only MS Defender plus MS Edge and Brave Browser. MS Edge loads the page fine on the non ESET computer. On the Eset computer MS Edge throws up the Cert Revoked message.

    Question on getting email with this title: Anti-Theft: Suspicious behavior detected on your device

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    I have someone else using Windows10 22H2 with a desktop and Internet Security  16.0.26.0 getting these emails as well. The emails occur when Eset updates itself and has to reboot or when Windows updates occur and the computer has to be rebooted.  I have checked and all of the user accounts on this computer have passwords that have to be entered on computer boot up EXCEPT the phantom account. 

    This has been happening on this computer for months now and I am at a lost on why ESET thinks someone has attempted to login to the phantom account.

     

     

    O&O Syspectr reporting 2 installs of NOD32 installed

    in ESET NOD32 Antivirus

    Posted · Edited by pcguy

    I discovered what the issue was. In fact the issue showed up on this computer as well. I noticed that when I did a WMI query on root/SecurityCenter2  for Classaname AntivirusProduct  I got the following result

    O&O Nod32 Issue WMI Query.jpg

    I had to issue the following commands

    sc config winmgmt start= disabled
    net stop winmgmt
    Winmgmt /salvagerepository %windir%\System32\wbem
    Winmgmt /resetrepository %windir%\System32\wbem
    sc config winmgmt start= auto

    Once that was done then O&O showed only one instance of Eset installed

    O&O Syspectr reporting 2 installs of NOD32 installed

    in ESET NOD32 Antivirus

    Posted

    9 hours ago, Marcos said:

    They can get information about the product name from HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductName and ProductVersion. I recall it's also possible to query WMI.

    Well I looked at that key on one of the problem machines and Product Name is "ESET NOD32 Antivirus" and ProductVersion is " 13.0.22.0". For some reason Syspectr reports two entries like  

    47ed86f4fff0f4641c9ee9768a6aaf67.png ESET Security is active and up-to-date

    O&O Syspectr reporting 2 installs of NOD32 installed

    in ESET NOD32 Antivirus

    Posted

    I have 3 computers at a location. All three are Windows10 1903 that are 4 months old. I use O&O Software Syspectr to monitor these computers. However Syspectr is reporting that there are 2 installations of "ESET Security is active and up-to-date ". If i remote into the computer and use the Windows uninstall of NOD32 Antivirus off this computer then one of these entries in Syspectr disappears.

    Syspectr support simply tells me " We take this to heart, but have to stress again that we only read the information from windows. " and " We use the Windows API only"  to determine what software is installed and that I should contact Eset. My question is why is Syspectr reporting 2 installations of Eset Antivirus on all three machines. They are all at 13.0.22.0.

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    I have no idea. All I can say is that since I removed the password on Thunderbird closed it down and restarted I know longer see the error showing up in the log files so far for 2 days. In the past it would show up as soon as I enabled the option or every couple of hours.

    Eset really needs to give more detail information in these sorts of errors so that we do not spend time going down rabbit holes. It gets tiring and frustrating.

     

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    In case someone at a later date stumbles upon this error message I figure I will post what the issue was. After a month and countless hours on my part and Eset support and sending numerous log files to Eset support the problem seems to fixed.  The issue was caused by Thunderbird email client which was using a Master password to protect the email passwords in the application. It had nothing to do with any of the web browser applications like Brave, Firefox, Chrome or MS Edge (all variants) that I had installed on this computer. I had to temporarily remove the password off Thunderbird and re enable the option in Eset to add cert to all known browsers.

    I just wished the heck NOD32 would of put out more meaningful error message when it encounters a problem like this. If it had simply indicated it was Thunderbird it would of saved a heck of lot of lost hours on my part and Eset support.

     

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    Is the "Personal firewall" of the "Personal firewall: An attempt to add the root certificate to all known browsers on your computer failed." referring to Windows Firewall? Because that is one Eset remote support tech told me and after 1.5 hrs session said they fixed it by disabling SSL/TLS monitoring, rebooting and re-enabling. This is something I had tried countless times over the past week along with uninstalling and wiping all traces of Eset off Windows10 and reinstalling the software. Since I had to leave for an appointment I did not check for an hour and so. When I did I discovered that the reason why the error was not showing up was because SSL/TLS monitoring was disabled. :wub:

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    12 hours ago, justme12 said:

    I know it is a real PIA but maybe try a Windows Reset or a clean install.  After my initial events, clearing the residual leftovers from

    various installs seems to have worked perfectly. Running Eset on 3 pcs now and no issues.

    Appreciate the feedback but resetting or doing a clean install of Windows 10 would require a week of work on my part reconfiguring all the additional software I use on a regular basis.

    Eset should provide clear indication what the exact installation for the cert failed because I cleansed Firefox from this computer and registry and even reinstalling it did not solve the issue. I have searched all the browsers installed on this machine and all of them have the same cert installed. 

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    18 hours ago, Marcos said:

    Please carry on as follows:
    - disable SSL filtering
    - reboot the machine
    - without launching any application, re-enable SSL filtering.

    Should the problem persist, start logging with Procmon and disable / re-enable SSL filtering, then stop logging and provide the generated log in a compressed form.

    I did that Thursday of last week and attached both files here in this thread.

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by pcguy

    On 5/10/2019 at 7:41 AM, justme12 said:

    I can't say for sure, but using Revo, after the FF uninstaller finished, Revo identified a vast amount of leftovers in numerous folders which I deleted. After that, all is well.

    I just realized that this thread was not in the Eset NOD32 Antivirus section which is the product I am having this issue with. All the browsers currently installed have the same cert installed. Even Firefox release version. Yet the logs continue to get the same old warning message. One option that works is to disable adding the cert to known browsers. That is the least dangerous of the options if NOD32 is installed. It would have been extremely useful if NOD32 could provide a clue on what particular browser install is failing. I am now wondering what else maybe is not functioning properly in NOD32. I Just happened to stumble across this issue last week.

    I even took the drastic measure of running CCLeaner to remove what it felt was errorenous registry entries, rebooted and without starting any web browsers I re-enabled TLS monitoring. Within seconds I got 2 of the same errors in the logfiles. 

     

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    Going to leave NOD32 installed on this system for now and will probably decide whether NOD32 remains installed. Will wait for official info from Eset on what the heck is going on with this Windows10 system whether it is Eset official position that one is restricted to release versions ONLY of a web browser when using NOD32 on a system. 

    I have installed Firefox release version and NOD32 still is complaining apparently every hour or so that the cert cannot be installed on some unknown browser somewhere on this computer.

    Attempt to add root cert. Failed

    in ESET Internet Security & ESET Smart Security Premium

    Posted

     
     
     
    15 minutes ago, itman said:

    You have already posted you are "always testing new browsers." Even if uninstalled, it is possible Eset is detecting their traces. Ditto for multiple versions of FireFox installed and then subsequently installed.

    Finally, I would not install any browser other than IE11, Edge(official release), Chrome, or Firefox when using Eset.

    Well then perhaps its best for Eset and I to part ways then. To hamstring a user in part due to non-descriptive error messages and to have no error handling routines to alert the end user of the issue but instead simply fill up the app log files with thousands of errors.  

×
×
  • Create New...