Box
-
Posts
15 -
Joined
-
Last visited
Posts posted by Box
-
-
-
Hello.
I tried to renew my ESET Internet Security license, and when I go to the online store, first it shows the correct renew data, but then the webpage does a fast animation and changes the license to... Eset Internet Security Premium, check the attached snapshosts.If I where to accept this unsolicited upgrade, the next year I would have to renew again for the premium version, and it seems that I can't change the version to renew?.
By other hand, I did try to log on MyEset, but I was stuck on the callback code loop, described on this post, and many others:
with all of this said, I would need help, I don't want to upgrade to premium, I only want to renew for EIS.
-
10 minutes ago, itman said:
Next time the alert appears, click on the "Approve" tab.
4 minutes ago, itman said:Since the default rule exists, delete any like custom rule you created.
Done, thanks for the help, if something related to this arises, I will post again, but I will keep monitoring the thread to see if I can help with this problem.
-
15 minutes ago, Marcos said:
It's still there among the built-in rules and even Kbleft has those rules enabled:
Yes, I can see the same if I check "Show in-built rules", here's mine (with egui.exe filter):
The rule under "Allow verification for egui" is the one that I've created, but it keeps asking for approving or denying rules for the modified egui.exe (since is trying to connect to the net). -
1 hour ago, Marcos said:
We'd need step-by-step instructions how to reproduce the issue. Are you able to reproduce it at any time?
Hello, thanks for the response.
Yes, I've made a video to show the problem, and when I opened the program to capture the video and I've blocked the outbound connection, it showed the same egui alert, so, it's safe to asume that it will do this with other programs with no set firewall rules (in interactive mode, at least), please see the attached file, wich includes a MP4 video.
21 minutes ago, itman said:Check you existing Eset firewall rule set and verify that a rule exists for C:\Program Files\ESET\ESET Security\equi.exe. If one exists, verify it is set to allow inbound and outbound traffic. Otherwise, manually create a new rule for it. Move this equi.exe rule to the bottom of existing default firewall rules. You can use the default existing ekrn.exe rule as a guide for equi.exe rule creation.
I believe this should stop the equi.exe alert after a new app rule is created firewall Interactive mode.
Thanks for the response again.
I've opened the rules section and there's no settings for egui.exe, by default there should be any? I think that I will block the connection until this problem is resolved, because the modified egui.exe only tries to connect to the net when another program (with no set rules) triggers the firewall dialog box, it may be a bug as you previously said. -
Hello, any update on this, @Marcos ?
-
1 hour ago, itman said:
This would be normal behavior in firewall Interactive mode if an existing app hash value changed and a previous firewall rule existed for it. However, equi.exe is Eset signed so there might be a bug there.
You're going to keep getting the alert until you respond to keep existing firewall rules which I would select, or to create a new firewall rule for the app.
You can also manually verify that equi.exe in C:\Program Files\ESET\ESET Security is also Eset signed indicating it is legit.
Hello, many thanks for the response.
After re-reading my previous post I noticed that I didn't give clear information about this problem, I will try to explain it with a diagram, sorry for the quality:
If I launch a program that haven't firewall rules, you can see the normal dialog asking what to do (on interactive mode), and after denying outbound connection or try to set a behaviour for the rule, immediately after EIS says that egui.exe has been modified and is trying to connect to the net.
I've checked the egui.exe found in C:\Program Files\ESET\ESET Security ,and the SHA1 checksum:
9C9B3B035C5A2E2BC956D28E0FFD4ED253FC887B
gives 0 results in Virustotal:
also, the Details tab says that the file is signed by ESET, spol. s r.o. , but besides that, I don't have any other manner to know if this file has been signed by ESET.
-
I can't edit, but I forgot to mention that I was using almost all the free RAM avalaible on that momment, I don't know if that helps.
-
Hello, I've encountered the same problem.
I'm using EIS 14.0.22.0 (updated using the interface), and I think that it's the same problem that kbleft describes, please see the attached file. By other hand, the file that the warning points out is algo egui.exe, and it can be found in this path:
C:\Program Files\ESET\ESET Security
wich is the installation path. By other hand, I'm using the interactive mode for the firewall, and it seems that this warning is triggered when a program (a trusted one, by the way) tries to connect to the internet, I've triggered the warning two times doing the same thing, so, I think that this has something to do with internal firewall rules.
-
6 minutes ago, Marcos said:
According to https://support.eset.com/en/kb332-ports-and-addresses-required-to-use-your-eset-product-with-a-third-party-firewall, ESET connects to the IP address to check for certificate revocations.
Probably you've recently established several SSL connections and the product connected to the server to check the revocation status of SSL certificates.
Hello, many thanks for the information and the link, I found it useful for future reference. By other hand, I apologize for the double post.
Regards and many thanks for your time.
-
1 minute ago, Marcos said:
Please don't post multiple times the same. This topic is about a different IP address. We will provide a reply in your own topic.
Sorry,it wasn't my intention to post the same information twice, but I noticed a pattern in both IP's and I thought that it was a good idea to let the OP to know about this, sorry again for posting the same thing two times.
-
The same occours to me, but the IP this time is 93.184.220.29, Virustotal list both with the same description, word by word:
AS 15133 ( MCI Communications Services, Inc. d/b/a Verizon Business )for reference, I live in Spain, some minutes ago I opened a thread and posted a snapshot, but I didn't notice that a thread related to this was open, you can see the snapshot here:
https://forum.eset.com/topic/25790-eis-ekrnexe-opens-a-lot-of-connections-to-9318422029-and-clog-the-internet-connection/ -
Hello.
Today I started the computer normally and i've visited some webpages, and I noticed that the internet connection was slow, so I verified the connections that the system was making.
On the list of active connections, ekrn.exe had A LOT of open connections to 93.184.220.29, so, I did disconnect the internet connection. Later, after some searchs, I discovered that the IP 93.184.220.29 is related to a legit certificate service, but I don't know why EIS open SO MANY connections to obtain updated certificates.
This is a normal behaviour?.
-
Hello, another user with the same problem.
I have the same behaviour with Firefox 57 (fresh install from a offline installer, wich can found in the Mozilla webpage). This is how ESS10 behaves with Firefox 57 (multiprocess):
- After having Firefox 57 opened at a random interval of time AND also you open a new tab or window on the above , ESS10 forgets all the Firewall rules set to Firefox.exe and it will begin to ask about the connections done by the program until you close Firefox.
- If you close and open Firefox again, the firewall rules set to Firefox come back and there's no problem until the next time it asks about permissons.
- Firefox is the only program on which I have problems with the ESS10 Firewall, and this has started to happen after the Firefox 57 install.
I suspect that this have something to do with Firefox 57 multiprocess tasks, on which the above can open at least 5 Firefox.exe executables at a time to distribute the work load, and then the ESS10 Firewall is having problems identifying wich process was been launched in the first place and then marking one of the FIrefox.exe subprocess as a new application with no rules set.
Help! The ESET store forces me to upgrade EIS to EIS Premium, and my license is from one day to expire
in ESET Internet Security & ESET Smart Security Premium
Posted · Edited by Box
Typos
Good sugerence, I will try to contact them and explain the situation.
Many thanks for your response and time!.