Chas4

Have sent Marcos the logs macOS got for the ESET crashes.

Nod32?

False as they could rule out if it is ESET or not. As I mentioned it is just on Windows it is crashing, macOS it is not and both have ESET, want to know if it is an ESET protection that is triggering the crash for the NASA (yes the same nasa.gov US government agency) program.

Well the crash is only on Windows not on macOS with ESET, and that is why I am asking which logs to try to check. Wanting to see if the logs show a block or it blocking something else at the time of the crash.

A nuke option is not the first step when troubleshooting, that is why I am asking about checking logs

Same app on macOS does not crash, is there a HIPS or other log that would show if ESET blocked the program from running?

Seeing it load a bit then it crashes, is this a compatibility issue? (talking about the desktop program)

What is the version of your ESET software? How did you try to remove ESET did you use the uninstaller?

Might be a scheduled scan

Marcos I know older version of ESET on macOS had a bug where the proxy might break blocking all network connections, so it could be an outdated ESET version, or maybe it is some 3rd party firewall

There looks to be a bug in the current stable as mine was set to ? which took 2 clicks to turn it off (should note I was seeing the promo on Nod32)

Apple has changed the APIs a few times since ESET first started to talk about it. ESET also had just redone ESET Cyber Security to use more native code with v7 of ESET Cyber Security. SSL is a dead and insecure encryption protocol and was replaced with TLS a while back, and also most browsers now block anything below TLS 1.2.

SSL is dead and insecure, TLS replaced it years ago, macOS is different from Windows on how it handles TLS connections, it was mentioned in another forum about what ESET on macOS does not have TLS scanning yet.

As a work around remove it via ESET Home then ESET will prompt to to activate and you can activate it again

I got it in a phishing email pretending to be from Norton, sent the file and email to ESET 4 months ago It has not been seen by them, but it is a phishing attack via .pdf, as I mentioned I don't know if the attackers put any exploit in there, I also reported it to others besides ESET From: updation program desk-48449 <rodolfofarkasdq2@gmail.com> Date: Tuesday, July 18, 2023 at 12:23 PM To: targetemail <targetemail> Subject: Invoice reference - 05266487/ pdf billing "Greetings targetemail Your request has been approved by Norton, We have forwarded to you an upgraded edition of your invoice, which has now been included in the PDF document. The E-Bill contains an accompanying PDF REPORT. Your payment for renewal has been forwarded to the billing department for additional verification. Obtain immediate assistance from our customer service desk by calling +1(912) 275-5927. Norton HELPDESK at +1(912) 275-5927.

Hash 51a098794de82b7f75ec06aba1ae237be9eae79b6d3e2f112e0017d3bd3d8cd6 Was submitted to ESET months ago https://www.virustotal.com/gui/file/51a098794de82b7f75ec06aba1ae237be9eae79b6d3e2f112e0017d3bd3d8cd6/detection The phishing is via the .PDF file which might have other code in it

Apple released macOS 14.2 yesterday (a bunch of security fixes), not sure if this was fixed in that

Microsoft Defender's Memory Integrity checks for compatibility with drivers before being allowed to be enabled, developer would need to update the driver/s https://support.microsoft.com/en-us/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78

At least up to macOS 11 macOS only has an inbound firewall, not sure about newer macOS versions

Just confirmed a reinstall gives me that option

A fix looks to be coming in a future version.

@Marcos Could this be similar to the Nod32 recent version 17 update where the license info did not get set right?

Yeah they are working on an issue some are having with ESET Home after upgrading from v 16 to v17

I already grabbed logs with the issue and those are included with the ones I sent

Sent the logs in a PM