Box

Done, thanks for the help, if something related to this arises, I will post again, but I will keep monitoring the thread to see if I can help with this problem.

Yes, I can see the same if I check "Show in-built rules", here's mine (with egui.exe filter): The rule under "Allow verification for egui" is the one that I've created, but it keeps asking for approving or denying rules for the modified egui.exe (since is trying to connect to the net).

Hello, thanks for the response. Yes, I've made a video to show the problem, and when I opened the program to capture the video and I've blocked the outbound connection, it showed the same egui alert, so, it's safe to asume that it will do this with other programs with no set firewall rules (in interactive mode, at least), please see the attached file, wich includes a MP4 video. Thanks for the response again. I've opened the rules section and there's no settings for egui.exe, by default there should be any? I think that I will block the connection until this problem is resolved, because the modified egui.exe only tries to connect to the net when another program (with no set rules) triggers the firewall dialog box, it may be a bug as you previously said. Video_ESET_Forums.zip

Hello, any update on this, @Marcos ?

Hello, many thanks for the response. After re-reading my previous post I noticed that I didn't give clear information about this problem, I will try to explain it with a diagram, sorry for the quality: If I launch a program that haven't firewall rules, you can see the normal dialog asking what to do (on interactive mode), and after denying outbound connection or try to set a behaviour for the rule, immediately after EIS says that egui.exe has been modified and is trying to connect to the net. I've checked the egui.exe found in C:\Program Files\ESET\ESET Security ,and the SHA1 checksum: 9C9B3B035C5A2E2BC956D28E0FFD4ED253FC887B gives 0 results in Virustotal: https://www.virustotal.com/gui/file/35a06001b74ce1068818dbc21e5f6f28ef38fc0d6e3079dc731a9805860c8fb1/detection also, the Details tab says that the file is signed by ESET, spol. s r.o. , but besides that, I don't have any other manner to know if this file has been signed by ESET.

I can't edit, but I forgot to mention that I was using almost all the free RAM avalaible on that momment, I don't know if that helps.

Hello, I've encountered the same problem. I'm using EIS 14.0.22.0 (updated using the interface), and I think that it's the same problem that kbleft describes, please see the attached file. By other hand, the file that the warning points out is algo egui.exe, and it can be found in this path: C:\Program Files\ESET\ESET Security wich is the installation path. By other hand, I'm using the interactive mode for the firewall, and it seems that this warning is triggered when a program (a trusted one, by the way) tries to connect to the internet, I've triggered the warning two times doing the same thing, so, I think that this has something to do with internal firewall rules.

Hello, many thanks for the information and the link, I found it useful for future reference. By other hand, I apologize for the double post. Regards and many thanks for your time.

Sorry,it wasn't my intention to post the same information twice, but I noticed a pattern in both IP's and I thought that it was a good idea to let the OP to know about this, sorry again for posting the same thing two times.

The same occours to me, but the IP this time is 93.184.220.29, Virustotal list both with the same description, word by word: AS 15133 ( MCI Communications Services, Inc. d/b/a Verizon Business ) for reference, I live in Spain, some minutes ago I opened a thread and posted a snapshot, but I didn't notice that a thread related to this was open, you can see the snapshot here: https://forum.eset.com/topic/25790-eis-ekrnexe-opens-a-lot-of-connections-to-9318422029-and-clog-the-internet-connection/

Hello. Today I started the computer normally and i've visited some webpages, and I noticed that the internet connection was slow, so I verified the connections that the system was making. On the list of active connections, ekrn.exe had A LOT of open connections to 93.184.220.29, so, I did disconnect the internet connection. Later, after some searchs, I discovered that the IP 93.184.220.29 is related to a legit certificate service, but I don't know why EIS open SO MANY connections to obtain updated certificates. This is a normal behaviour?.

Hello, another user with the same problem. I have the same behaviour with Firefox 57 (fresh install from a offline installer, wich can found in the Mozilla webpage). This is how ESS10 behaves with Firefox 57 (multiprocess): - After having Firefox 57 opened at a random interval of time AND also you open a new tab or window on the above , ESS10 forgets all the Firewall rules set to Firefox.exe and it will begin to ask about the connections done by the program until you close Firefox. - If you close and open Firefox again, the firewall rules set to Firefox come back and there's no problem until the next time it asks about permissons. - Firefox is the only program on which I have problems with the ESS10 Firewall, and this has started to happen after the Firefox 57 install. I suspect that this have something to do with Firefox 57 multiprocess tasks, on which the above can open at least 5 Firefox.exe executables at a time to distribute the work load, and then the ESS10 Firewall is having problems identifying wich process was been launched in the first place and then marking one of the FIrefox.exe subprocess as a new application with no rules set.