Jump to content

Enrico

Members
 View Profile  See their activity

  • Posts

    73

  • Joined

  • Last visited

 Content Type 

Posts posted by Enrico

    "Pause Antivirus and antispyware protection" info

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    Smart optimization is enabled on both W7 and W10 machines, no threatsense options have been modified and folders containing relative executables and files are set in "performance exclusions".

    perfexcl.png.1940e95b1e07ff3447661b0124f7675f.png

    But this does not explain why with protection paused I have to add an exeption in real-time scanning and why under W10 1909 (Ryzen 7 3800X, 32GB, NVMe) real-time scanning cause program startup to become three times slower than on W7 (i7-6700, 16GB, RAID 0 7.2k RPM).

    "Pause Antivirus and antispyware protection" info

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by Enrico

    It's a program related issue, not system startup (boot time).

    The process added to exclusions in "real-time file system protection" is "C:\Program Files\Tebis_AG\Tebis V4.0 R8\program\tebis.exe".

    eseteb.thumb.png.3e17b7cafb82b8299a4ebbc6dde44adb.png

    Usually when I encounter slow program loading first I scan for malware then pause protection to exclude Eset detection engine from the possible causes, but even if the popup says that real-time protection will be deactivated this time I needed to add the executable to exclusions in order to totally exclude Eset process scanning. 

    The strange thing is that this behaviour doesn't happen under Win7: with/without process exclusion or pausing protection tebis.exe startup times are almost the same.

    "Pause Antivirus and antispyware protection" info

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    I've installed the latest version of my professional SW in both W7 and W10, but under W10 I've had long startup times (old version 6.5sec, new version 17sec) while under W7 they were almost the same (old 8sec, new 7.5sec), then under W10 I've paused protection to exclude Eset from the possible causes of the long startup, but startup times remained unchanged, clean-reinstalled the SW and nothing changed, so I've added a new process exclusion entry in real-time file sys protection and bam... New version started in 4.5sec!
    Is it possible that under W10 the "pause protection" doesn't disable some modules?

    Best regards.

    It's Back - Ecmds Code Integrity Error

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by Enrico

    Here they come.

    Win 10 Audit Failure events started after 12.2.30 was installed, they're still happening with the latest version. Note: during boot and shutdown the access point is kept offline.

    Also the "stealing focus" problem was back with 12.2.30 (had no time to check if persist in 13.0, eventually I will open a new topic).

    sec_log.zip Bootlog-2.zip Bootlog-1.zip Bootlog.zip eis_logs.zip

    Strange Google DNS queries

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    That rules were set with the only purpose of identify the "offender", they were not present before finding "4.4.8.8" in tcplogview, now I'm back to the previous configuration "block untrusted IP ranges"->"ESET default rules"->"custom rules".
    Anyway, custom rules with the wrong priority still were uncapable of explaining the presence of 8.8.8.8 and 4.4.8.8 in the logs.
    In the last 24 hours the logs had no presence of strange DNS queries, so probably I will never be able to identify what happened last month... (yesterday)
    ...Until this morning! I left the pc unattended for some time, Interactive firewall was asking what to do with some windows processes, meanwhile Google DNS queries has been logged. My suspect is that when the endpoint could not be reached in the expected ammount of time then win services override user dns settings.

    Strange Google DNS queries

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by Enrico

    This is what I've did:

    1: Created an "allow" "all" rules for ekrn and egui with the only purpose of log network traffic and override another rule that was blocking Azure cdn traffic.

    2° Created an "ask" rule for svchost

    svchost_ask.png.b8dc8a71244f330351b1eba612f3b695.png

    3° Everytime ESET detect a new svchost\DNS connection I add the IP to the custom "allow" rule, but only if remote/local are trusted destinations.

    dns_rules.thumb.png.7813b436088ff74fa353cd5c1ef00345.png

     

    As you can see custom rules have higher priority than predefined "allow" rules, this way ESET can use all whitelisted IP's when needed and ask for other DNS connections when they're not present in the "allow" custom rule, except for the ones made to Google servers which are always blocked (I don't trust that corp. and won't use their sw).

    I had to do that way because of data gathering code (GA) hidden here and there in some common freeware applications, drivers and purchased sw.

    Probably ESET was only detecting attempts made by other sw, but better if I review/reorder all my custom settings.

    Best regards.

     

    Strange Google DNS queries

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by Enrico

    I can confirm that Windows security is managed by ESET (all green). The "DNS client events - Operational" windows log need to be enabled in order to register DNS queries and responses. I forgot to specify that on my pc's only the monitor is put into sleep mode, all the other devices must remain active because of my professional CAD-CAM sw needs (HASP).

    The lookup of "4.4.8.8" points to nothing, if it's not hard coded in the OS or in EIS, what else could be?

    The other sw running from startup is nvcontainer (quadro -nvtelemetry), Logitech GS, 3DConnexion broker, MSI Afterburner.

    Strange Google DNS queries

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by Enrico

    I have two workstations protected by EIS, one with W7 and the other with W10, in the last month I've noticed strange DNS queries in the network logs, here an example:

          <COLUMN NAME="Time">04/09/2019 11:55:10</COLUMN>
          <COLUMN NAME="Event">Communication denied by rule</COLUMN>
          <COLUMN NAME="Action">Blocked</COLUMN>
          <COLUMN NAME="Source">192.168.1.193:57600</COLUMN>
          <COLUMN NAME="Target">8.8.8.8:53</COLUMN>
          <COLUMN NAME="Protocol">UDP</COLUMN>
          <COLUMN NAME="Rule/worm name">Google dns</COLUMN>
          <COLUMN NAME="Application">C:\Program Files\ESET\ESET Security\ekrn.exe</COLUMN>
          <COLUMN NAME="User">NT AUTHORITY\SYSTEM</COLUMN>
        </RECORD>
        <RECORD>
          <COLUMN NAME="Time">04/09/2019 11:55:16</COLUMN>
          <COLUMN NAME="Event">Communication denied by rule</COLUMN>
          <COLUMN NAME="Action">Blocked</COLUMN>
          <COLUMN NAME="Source">192.168.1.193:57601</COLUMN>
          <COLUMN NAME="Target">4.4.8.8:53</COLUMN>
          <COLUMN NAME="Protocol">UDP</COLUMN>
          <COLUMN NAME="Rule/worm name">Google dns</COLUMN>
          <COLUMN NAME="Application">C:\Program Files\ESET\ESET Security\ekrn.exe</COLUMN>
          <COLUMN NAME="User">NT AUTHORITY\SYSTEM</COLUMN>

    These queries are not made by the OS services (SSL/TLS filtered), if you look at time of detection in DNS log they aren't present:

    eset-google2.thumb.png.45fc6c3274a55771f408c7c474e5ef0a.png

    I'm not using Google DNS, nor DoH in FIrefox, TCPv4 is set to use Quad9.

    This happens every time pc's are in sleep mode, could it be some kind of undetected/unquarantined infection, like Nymaim? https://www.welivesecurity.com/2013/10/23/nymaim-browsing-for-trouble/

     

    Best regards.

     

×
×
  • Create New...