Jump to content

cvvorous

Members
 View Profile  See their activity

  • Posts

    54

  • Joined

  • Last visited

 Content Type 

Posts posted by cvvorous

    Icon spinning forever

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    9 hours ago, Marcos said:

    Please provide a dump of egui_proxy.exe and ekrn.exe when the icon is constantly spinning. If you hover the mouse cursor over the icon, does it say that update or scan is in progress? Does the icon keep spinning for hours?

    OK, next time it does it, I'll also grab a dump of ekrn.exe. This link has an archive with two dumps of eguiproxy from two sessions with the icon spinning, if that's helpful on its own: https://drive.proton.me/urls/9R2X65Q1EG#sYgQHNEBmGd2

    And yeah, I tried hovering the cursor over the icon and it doesn't show any active operations, just says the product name and version. It will spin until I reboot the system.

    Icon spinning forever

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    Hi,

    I saw several other threads about this issue occurring with v 16, but figured I'd make my own. Same issue as the others, on every cold boot, after the product starts and performs its start-up scan and stuff, the icon spins forever. I reinstalled 17.1.9.0, tried enabling pre-release updates, etc. Spinning usually stops at reboot (but not always). I took the liberty of generating two dumps of the proxy gui from different windows sessions and zipped them up if you're still interested in those.

    If anybody happened to figure out what causes this and can give me an idea what setting to change, please let me know!

    Thx

    Is ESET able to detect HTML5 malware?

    in General Discussion

    Posted

    the blog both articles refer to is really light on details beyond inferring that bad actors are using html5 redirects on mobile devices with specific criteria; my guess is that eset would protect the user from the domain a browser is redirected to. imo, the html5 "malware" referenced doesn't seem like "malware" so much as using html5 features to do sketchy stuff.

    Banking and Payment Protection Issue

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    23 hours ago, mar122999 said:

    Also, why the limited support on extensions for password managers in Banking Protection? Ones I've had problems with are:

    Sticky Password
    Dashlane

    not sure whether dashlane is a typically supported pw manager (gave up on it a while ago) but it seemed like eset needs to release updated banking protection modules to keep up with supported pw mgrs; this is part of why i've given up on banking protection altogether.

    Changed LiveGrid Behavior Under Ver. 11.1.42

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by cvvorous

    my client fires the same 6 requests over and over, with different values based on date/time. afaict, this telemetry hasn't changed since 2013 or so (if you search for chsquery you'll find weirdos posting stuff about ESET participating in NSA/CIA SIGINT ops, lol)

      

    POST https://ts.eset.com:443/query/chsquery.php HTTP/1.1
Host: ts.eset.com:443
Content-Type: multipart/form-data; boundary=------------------------3kMBisMe5ab5274
Content-Length: 3021
Connection: Keep-Alive

--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="chc_pversion"
Content-Transfer-Encoding: 8bit

6
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="chc_sversion"
Content-Transfer-Encoding: 8bit

88
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="chc_gmdatetime"
Content-Transfer-Encoding: 8bit

2018-03-23 16:11:56
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="chc_datetime"
Content-Transfer-Encoding: 8bit

2018-03-23 10:11:56
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="datatype"
Content-Transfer-Encoding: 8bit

�f
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="key"
Content-Transfer-Encoding: 8bit

<redact>
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="priority"
Content-Transfer-Encoding: 8bit

�
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="hitcount"
Content-Transfer-Encoding: 8bit

�
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="firsthitdate"
Content-Transfer-Encoding: 8bit

�gT�[U�L^^ ZV[BS�G_
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="lasthitdate"
Content-Transfer-Encoding: 8bit

�gT�[U�L^^ ZV[BS�G_
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="firsthitdatedelta"
Content-Transfer-Encoding: 8bit

�fQ�O
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="attributes"
Content-Transfer-Encoding: 8bit

<redacted encoded data>
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="sessionid"
Content-Transfer-Encoding: 8bit

�gS�C]�U^
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: application/octet-stream

<redact encoded data>
--------------------------3kMBisMe5ab5274
Content-Disposition: form-data; name="chc_valid"
Content-Transfer-Encoding: 8bit

1
--------------------------3kMBisMe5ab5274--

     

    Lots of untrusted certificates the past week

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by cvvorous

    16 hours ago, demonlight said:

    I just started getting notifications from ESET Internet Security about a week ago regarding untrusted certifcates in Google Chrome.   Its happening on many of the pages I frequent, Slickdeals and Facebook to name a few.  Has something changed in a latest update?

    do you happen to do any host file or DNS-level ad/tracker-blocking?

    Whitelisting 1Password (again) for BPP

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    It looks like the current stable version of 1password's extension for Firefox (4.7.0.90) isn't functioning with BPP again. I've tried with both stable and pre-release updates enabled in EIS.

    I'd really like to use BPP, but this stuff occurring on a regular basis forces me to leave it off. I understand the concern about vetting and curating a list of approved extensions, but this is disappointing.

    Thanks

     

    Detection Engine: 16987P (20180301)
    Rapid Response module: 11690 (20180301)
    Update module: 1013 (20171116)
    Antivirus and antispyware scanner module: 1535 (20180202)
    Advanced heuristics module: 1184.1 (20171212)
    Archive support module: 1272 (20180122)
    Cleaner module: 1154 (20180222)
    Anti-Stealth support module: 1126 (20180219)
    Firewall module: 1373.1 (20180103)
    ESET SysInspector module: 1270 (20170808)
    Translation support module: 1666 (20180220)
    HIPS support module: 1312 (20180215)
    Internet protection module: 1328 (20180226)
    Web content filter module: 1058 (20170406)
    Advanced antispam module: 6972P (20180301)
    Database module: 1096 (20180202)
    Configuration module (33): 1525.11 (20171227)
    LiveGrid communication module: 1043 (20180205)
    Specialized cleaner module: 1012 (20160405)
    Banking & payment protection module: 1125 (20180228)
    Rootkit detection and cleaning module: 1019 (20170825)
    Network protection module: 1617P (20180228)
    Router vulnerability scanner module: 1045 (20180131)
    Script scanner module: 1033 (20180228)
    Connected Home Network module: 1019.1 (20180220)
    Cryptographic protocol support module: 1025 (20171106)

    ESET detected that malware

    in General Discussion

    Posted

    FWIW, It wasn't an "unknown" threat - it's a PUA that's existed for a long time (July) and was stupidly bundled by the developer of that payware aircraft installer to try and catch a software pirate. That particular build of the PUA was first submitted to VT back in November, and the tool itself (Chrome password dump) has been around longer.

×
×
  • Create New...