KenH

Issue solved. In Safe Mode - no Networking as local administrator account. Run Eset Uninstaller as admin Restart to Normal mode Elevated Powershell run sfc /scannow (some files reported as fixed) Run DISM /online /cleanup-image /restorehealth. Install and run CCleaner - clean up old applications and registry. Uninstall Ccleaner and restart. Run ESET Installer as administrator Installation successfull - no reported errors. Thinking that Sophos had left registry orphans. For the ARP Poisoning/duplicate IPs - I've run the IP scanner and I don't have any duplicate IPs showing. I flushed the DNS cache on the DNS server and it's still showing the router (Sophos UTM) as the IP source and IP target for these attacks. I've added the IDS exception rule now for this router's IP as displayed in KB 7054 we'll see if this works.

Same errors after running the ESET Uninstall tool in safe mode. Used the uninstaller on 3 other Desktops this morning after this one and had zero issues. 1) Reran the installer in safe mode & rebooted 2) Ran DISM /online /cleanup-image /restore health & rebooted. 3) Created new installer file and ran as administrator while logged in as administrator. 4) Same errors. 5) Used new installer on another computer - zero problems. At a loss here. This is a fairly new PC and has the same configuration as the one I installed right after it.

This is the file generated by the first issue. ees_logs.zip

Log file from computer throwing the ARP Poisoning and Duplicate IP alert - no such message after the reboot. File too large 299 MB

To clarify, that's for the 2nd issue (I probably should have started 2 topics) - correct - the ARP Poisoning issue and not the first issue listed? Thanks Marcos.

I've installed 2 servers & 45 computers over the past week - have to manually uninstall Sophos AV first - and this is the first one that threw this message this morning (picture attached). I tried uninstalling, running the ESET cleaner, running the ESET AV uninstaller (nothing found) and then reinstall. (All as the administrator account). I've attached the log file collected on this computer. This is the first computer to have a problem with installation. Several installs done yesterday are throwing the ARP Poisoning/Duplicate IP alert and then blocking their network connection. All of these point to the router. I've added a policy to exclude the router's address for IDS Exclusions but they are still getting this. Any tips on fixing these would be appreciated. ees_logs.zip