[CVE-2020-0601: Windows CryptoAPI Spoofing Vulnerability]

2 hours ago, Rami said:

Ah didn't pay attention , it should indeed block the exploits as far as I know , but it's better to keep the systems up to date , but I kind of think that Microsoft need to do better in terms of Windows security.

NSA is always in their pocket finding vulnerabilities , reporting some , and keeping some, just like the EternalBlue , just like any individual or a team that aren't script kiddies can do also the same and keep their 0-day exploit in their pockets to use whenever they want , without causing so much noise , wondering how safe is this.

We are just surprised once we see the vulnerability on the internet , but we never know for how long they have used it and how long it took them to find it and fix it , but it was there all the time , only known to those who look for them and keep them in their pockets for their own usage like the NSA do , if the NSA do such things that exploits you instead of protecting you from it because they are a 'Security Agency' which should be working on the Security of the Nation to protect it's people from the dangers outside but yet they were doing the opposite thing so if an Agency that is responsible for Security is exploiting the systems that everyone in the world use and keeping the exploits as weapons to be used once needed , then what would you expect from a group of hackers or individual that do this for money or for some kind of a mission complete we can do this or espionage or whatever the mission is.

We should reach to a conclusions that our systems aren't safe , and they have much vulnerabilities that we don't know about , and 1 update in a month is very slow updating , exactly like Microsoft do , even though if there was something critical they will release a hotfix , but yet still they do monthly updates to their systems , something like this headline : A bug that causes context menus to be displayed under the taskbar is still around in Windows 10 - This was a bug since Windows XP. - It doesn't matter if the bug is not important or considered to be LOW in the status and not critical , it's in the system since Windows XP , so I think also there could be few like it yet remaning in Windows 10

And yet we still rely on our AV products to protect us from these kind of threats and our firewalls , but yet how much protection could they give us if the system itself is vulnerable? and if we got infected because the malware was written new and used some kind of vulnerability or an exploit that would elevate the permission of the malware or used a signed process that will elevate it's permissions and then bypassed the UAC or/and the AV , then we are compromised and then we start to blame our AV companies that we use , for what we pay money? and that is the straight blame.

You go ahead and set the UAC to the maximum because that what Microsoft wants , a Yes or No question for the normal user to decide if this is malicious or not , just imagine a normal user with no experience with computers that is using his PC for office work or university and then he have a Yes or No question about something he never saw in his life , and doesn't know the differences between a good EXE and bad one , so the protection of your system is at the stake of your Yes or No , for example this kind of Bot will bypass the UAC

 

Using Windows 10 UAC bypass

When executed, TrickBot will check if the operating system is Windows 7 or Windows 10.

If it is Windows 7, TrickBot will utilize the CMSTPLUA UAC bypass and if Windows 10, will now use the Fodhelper UAC Bypass.

 

The endless ransomware's wave is an example of how our systems are vulnerable.

More variants , more generation of malware variants , less detections , different ways of infecting or exploiting and yet even the AI won't catch it, because the AI has never seen anything before like it , and yet comes the other modules that will give you protection from that kind of threat where it's not seen , like a sandbox or whatever it is but still the important thing , the base system is not secure as it should be.

Like Windows Defender before the Anti-Tamper and I don't know how good the Anti-Tamper is , but Defender was a joke , you could disable it with a registry key, if a normal user can do that , then why the malware won't be able to do it ? and it took Microsoft a long time to fix that.

So who cares about our Security more than our-selves? , Microsoft yea.

The thing is every OS has bugs and exploits. I remember an apple fanboy telling me there where no security issues with Apple and I pointed out they'd just released an update to fix some and his reply was yeah but that means there's none now. If there hasn't been an issue found it's not that there's none there they just haven't been discovered yet. I mean how long did things like spectre and heartbleed go undetected.

The update thing is interesting because when it comes to updates they have slowed down. Microsoft was doing 2 big updates a year with obviously security ones throughout. Now they seem to be doing 1 big one and then one that is like a service pack which fixes bugs and stability issues. People complained the updates where too many and often buggy. I wouldn't mind seeing more updates but instead of big ones smaller ones throughout so new features get included throughout the year but with the testing period and to avoid bugs it might be tricky.

Also this is why I never recommened using an unsupported OS. Windows 10 has the best security over previous versions and with many other versions unsupported including windows 7 now, using them puts users at risk as some bugs and vulnerabilities won't be fixed. An AV for example can be useless if your using an old unpatched OS

[Install Can't Get Past Setup's User Registration on Deepin 15.4 (Debian)]

On 1/19/2020 at 9:11 PM, salmmus said:

I can choose the trial option and enter email and other registration information once it is installed, but it fails to register. A trial does not get activated and I do not receive an email. I have no firewall. Also, where is the Linux section? Thanks.

Hi the linux home section is at https://forum.eset.com/forum/27-eset-nod32-antivirus-for-linux-desktop/

[CVE-2020-0601: Windows CryptoAPI Spoofing Vulnerability]

2 hours ago, Rami said:

It's different as ITMAN said , EternalBlue had the American Gov's malware creators do that exploit and then it was leaked by them or by mistake , I don't remember

This is a different thing , whatever still both of them were reported by the NSA , so don't be surprised if the NSA still have many like these in their pocket without telling Microsoft about them , as they did with the EternalBlue.

As the user has stated it's not how they work but if eset will block an attempt to use the exploit

[Worst Application Ever]

28 minutes ago, Shameel Faraz said:

There are many possilbe reason since i do use internet through AnyConnect VPN provided by our University campus. But I didn't have any problem since I am on this configuration. The only changes I had made was installed new updates for Windows. I did a reset on my Laptop and the issue was gone. But it came back again. It was only out of desperation I uninstalled Eset Internet Secruity and things were back to normal. It is natural to have my doubts on this software.

If you have paid for a subscription I'd recommend reinstalling and if the issue recurs collecting logs. It could be that the VPN and eset aren't working together properly but can be setup. Also identifying what is causing the issue can stop future users from experiencing it to

[Eset Uninstalled by itself]

51 minutes ago, local said:

When was the last time when it has been determine that "is an on going issue with existing Eset protection methods" ???

Typically the user will take all blame from not doing this or that, most recently for " clicking suspicious links "

The whole internet experience is based on "clicking links" ; to determine that is "suspicious" is ESET's job.

If only it were that simple. I've seen some Youtuber tests where they basically disable things like web protection and then try to show they got infected - well yes if you disable key features there is a chance.

The problem is that nothing is ever 100 percent. Here in the UK the NHS was a big victim of  the WannaCry ransomware which used the ExternalBlue Exploit. They obviously have security programs (not eset, but won't name it just in case), but still got infected. I'm not sure how, but did hear someone may have opened an attachment. Problem also was a lot of their computers where using XP and out of date patches. 

What the problem above proves is that security is everyone's job and until people understand that things like this will keep happening. Sadly, at least for the average user, people tend to want to be able to just instal a security program and let it do everything for them. If they for example regularly go on a dodgy site and get infected - they will blame the AV but won't actually look at what they are doing and if there is any correlation. I've met a lot of people in the past who wouldn't instal any windows updates, and these also tend to be the same people who would then complain if they got hit by something they themselves failed to patch when a patch was readily available for them.

It's one of the reasons I'm half and half with two step authentication - it's great and can be a lifesaver but it's not a golden bullet - people want solution that will protect them but they don't do anything to protect themselves. Remember the weakest link in security is generally always the human.

[Both Windows Firewall and ESET Security are both turned off.]

1 hour ago, MoRbIdBoY said:

Hello. I have a quite heavily loaded system I used for audio production (lots of drivers, lots of data). Being able to "get to work" on the PC (without ESET) takes about 30 seconds after the desktop initially loads. With ESET it's taking about 10 minutes. Even though it's booting from EVO-850 SSD.

I'm using ESET 13.0.24.0 which I beleive is the latest and Windows version 10 Pro, 10.0.17763.

I HAVE TWO PROBLEMS

1. Message shortly before the system actually lets me do some work. Message: "Both Windows and ESET Firewall are both turned off". The "Network Protection" section appears in red the entire 10 minutes I'm unable to work on the Desktop. It then appears to go green about 1 minutes after receiving the firewall turned off message, and the ESET firewall functions throughout this period.

2. Even though I have both the "System startup file check" options turned off, ESET still appears to be doing a huge scan of my registry and then my entire file system, in refference to any executable files it finds in the registry. I have A LOT of executable files on my file system, I have A LOT of applications installed on it. It also does this when I resume from sleep. So besides taking an absolute age to boot, it takes an absolute age to resume from sleep.

What is wrong with your Antivuris and Firewall solution? This started happening when ESET Smart Security went past version 9 and started with this "modern interface" - which is complete garbage by the way. ESET 9 firewall was much better (and MORE IMPORTANTLY CLEARER) at showing you what was going on with you firewall and EDITING changes.

Have we come to a point where ESET has so much bloat, it is taking most of my VALUABLE system resouces? I don't upgrade my PC so that ESET's software can suddenly start using it all up. I expect your software to GET FASTER and USE LESS RESOURCES, not the other way around.

I've tried uninstalling and re-installing ESET's software. I've tried using the ESET removal tool (in safe mode). I've tried installing the software and then waiting for it to finish it's entire scan of my PC before doing anything else. I've tried starting from fresh with ESET and not importing my existing settings. Same problems.

So - Both Windows and ESET Firewall are both turned off - and - NOT respecting my option NOT to perform a startup scan and doing an entire scan of my registry and all associated executable files. Thereby reporting a false warning that both firewalls are turned off (because it's taking so long to boot to desktop) AND taking an age before I can start working or launch firefox. Sometimes taking 10 to 15 minutes to load to desktop.

IS IT TIME I DUMP ESET - WHICH I'VE BEEN USING FOR 10 YEARS AND LOOK FOR AN ALTERNATIVE?
 

Not sure what could be causing this but I'd recommend collecting logs and creating a support ticket. If something is causing it to slow your computer they may be able to identify and fix it

[is Teamviewer Secure? on my server.]

10 hours ago, aowuodih12 said:

Just as an FYI for anyone who comes across this and is looking for it, they changed the name to ConnectWise

Sorry but connectwise and teamviewer are completely separate programs.

@Marcosnot sure it this is possible spam. Apologises if I'm wrong just a new account with this as their first post and seemingly mentioning a program not to do with this topic

[Product update during ongoing subscription]

3 hours ago, brian_smith said:

Hello!
I’m going to buy ESET Internet Security for 2 devices , but I'm thinking of a laptop for my child. Can I buy additional seat for this license later? If so, how much will it cost? Full price or discounted?
If I find Internet Security lacking of password manager feature, could I upgrade to Smart Security Premium?
 

Best regards,

Brian

You can add extra licenses but no idea if you'll get any discounts and you can upgrade. I presume if you want the higher version you wouldn't have to pay full price for it.

[Ekrn.exe spikes when launching any browser]

15 hours ago, Marcos said:

I don't recall analyzing your previous logs so I can't tell what the problem was caused by at that time.

 

15 hours ago, Alex21 said:

Ok but I wanna know. When I collected the logs for my previous ekrn issue it got fixed. I wanna know why?

I'm maybe reading this wrong but do you mean you gave the logs to someone e.g. eset or you just collected the logs and collecting the logs on its own without giving it to someone fixed the issue.

If it was the second option the only thing I can think of is it was already known or recently reported and was fixed and updated at a similar time to the logs being collected

[Win 7 to 10, whole slew of potential threats]

20 hours ago, Cougar said:

I've upgraded from win 7 pro 64 to win 10 just recently. I've always had eSet(12.2.30) for some years now. I usually seek help on youtube whenever I change OS's to learn it and also to get a gauge on it's quirks and popularity. I almost installed it years back, but got turned off when a Beta Win 10 release update hung my system. Good thing I did a recent Win 7 mirror. I turned all updates off and decided to put 10 off until the end. Now, after install I can't believe the number of the authors who all have similar complaints, one claiming to have worked for MS. There seems to be consensus that MS is in cahoots with sellers who are trying to obtain buying habits of the computer users or web buyers to aid their own interests, or for MS to learn what future computer products they will be interested in buying. Just having to set up my basic operating system and not having yet gone deep into the suggestions of the authors who want their viewers to try this or that and to prove them right about Win 10. However, I have discovered so far that a few habits of Win10 were exactly what they said would happen, mostly the problem of it's resetting the default settings I made which is annoying.

My question is why is ESet so quiet while all this is happening? Not a peep, just the occasional notification of another sale offer from them. But as a loyal Eseter, I have come to trust them, and know that behind the scenes, they are fending off the scores of conspirators who are at attack at the gates. But, still...... quiet......

I noted Win 10 Youtubers seem to have more than one virus checker in their start group. Some may have 2 active, each behaving with each other they will assure you. One I noted on his screen behind him that he has an eSet in mem, BUT he recommends that we should also have Malwarebytes, and have it check the system often. He took a few minutes to describe Spybot, which was interesting since I used an antiquated version it almost 20 years back. All this insecurity of others has me sit up and pay attention. I ask myself, isn't eSet checking the firewall for nasty intruders?

Just wondering if I'm getting concerned for nothing and what your own thoughts are.

Thanks for your help.

 

 

 

 

 

. 

          

Are you asking about why is eset not doing anything about microsoft and its spying?

I did mention in the past if it was possible to have a feature that could control and block Microsofts telemetry. Interestingly the people behind spybot has a program that can block different programs and companies telemetry including Microsoft. Eset did say this might be hard as it might cause legal issues although I'm unsure how spybot gets around this.

Also there is the problem that you could block the wrong thing and prevent stuff that should be on from working 

[Chrome 79 always starts a core dump and crashes]

5 hours ago, Rami said:

There should be a version coming for Linux endpoints but not for home usage , version 7

I don't know about Home editions and how much time it will take for a home edition to come or if it's planned

and about the v4 is legacy indeed because ESET already dropped V4 for Windows since a long time.

But as a scanner it does it's job , but with AppArmor denying it to enter different places , I don't know how much effective is v4 with AppArmor denying everything for it.

The link above for the 2020 version is for the home edition which would indicate a new version has came out recently.

I don't use or have any experience in linux I just find it odd if it is legacy and no longer supported why is it being sold as a new 2020 version with nothing stating it is legacy.  Maybe this is me missing something but I just find it odd

[Newbie Question]

1 minute ago, jockfirth said:

Do I really turn off bits of the software to access the internet/Wi-Fi? Seems counter intuative to turn off the software I bought to protect me when online?

No normally eset shouldn't be disabled but by disabling it you can hopefully see if it fixes the problem. If you right click on the eset icon in the taskbar there will be an option to disable the firewall. Try disabling this and then accessing the internet to see if it fixes the issue. That way we then know it is the firewall module that is causing the issue 

[Chrome 79 always starts a core dump and crashes]

On 1/8/2020 at 9:28 AM, Rami said:

ESET for Linux Desktop is legacy product , it's barely updated , only the modules.

but I have no problem with my Chromium and ESET, I wonder why.

https://www.eset.com/uk/home/antivirus-for-linux/

This link says 2020 version which seems to suggest it's still being updated as its being sold and advertised as new in a way which if it is legacy is odd

[Chrome 79 always starts a core dump and crashes]

4 hours ago, Vrana said:

So Opera upgraded its rendering engine as well.

Other unaffected browser is Pale Moon.

It's really necessary for ESET to see to it!

From what I've seen eset knows the issue and is fixing it but not for this version. Don't quote me on this as I'm unsure the details but someone did say this is a legacy product so is no longer suported

[Newbie Question]

Also if you go into eset network settings theres home and public network. I presume when going to work and uni the best option would be to change it to public 

[Undetectable Virus]

1 hour ago, tjg79 said:

A new, minor update, Geforce driver was just installed. The old driver could have been the culprit.

 

I remember having a problem with a game, fallout 3 I believe. Couldn't play it but I'm sure I  could play other games. I know it wasn't designed originally for windows 10. Patches and stuff did nothing and updates for geforce didn't help.

I managed to fix by completely uninstalling my graphics card drivers and reinstalling and this seemed to work. Not sure what was causing it but if the update doesn't work try this or maybe even when installing choosing a fresh install although not sure if that option worked for me

[Files encrypted by ransomware]

12 hours ago, local said:

Point is ESET is the last one to protect you against ransomware in spite of having a dedicated anti-ransomware module , HIPS, machine learning and all kind of fluffy stuff.

For Win 10, Defender offers comparable better protection for free.

I can't comment on that myself as I've never been infected

[Files encrypted by ransomware]

14 hours ago, itman said:

Not surprised. Appears to be classic PowerShell .Net based malware: https://www.vmray.com/analyses/b6e9eb3a56f4/report/overview.html

Only 3 at VT currently detect it. Would think by now most would have HIPS rules to monitor PowerShell execution. Or, have PowerShell set to Constrained Language mode by various means available. I do both.

-EDIT- For reference, here are Eset's recommended HIPS anti-ransomware rules: https://support.eset.com/en/configure-hips-rules-for-eset-business-products-to-protect-against-ransomware  . Note that there a a few "typos" in the article. Use process names shown in the HIPS rule examples versus those shown in the article text. Finally for Win script users that use scripts to spawn any of the child processes shown, rule adjustments would have to be made.

I've never understood hips recommended rules. My hips is either set to automatic or smart (can't remember right now as I'm on my mobile) as I'm not experienced enough to use. However if there are recommended rules why aren't they built in by default or if there could be some issues as an option. It just seems odd to have something recommended which makes it sound important yet if it's that important you'd expect it to be built In.

Maybe due to the fact I don't use hips so have no experience in it I'm missing something

[Chrome 79 always starts a core dump and crashes]

3 hours ago, Marcos said:

In https://forum.eset.com/topic/21939-eset-nod32-google-chrome-79-crashes/ we stated that Endpoint v7 will address the issue. As for the home version of ESET NOD32 for Linux Desktop, there are currently no plans for a newer version.  If there's some news on this, we'll let you know.

What causes the issue? I'm a fan of eset and don't use the linux version just wondering why if there is a bug it wouldn't be fixed in all versions

[9anime blocked bcz of HTML/scrlnjet.B trojan]

2 hours ago, local said:

"a reason" could be a FP

and 70 other antiviruses said  the other way;

As itman has linked above Marcos has stated the reason as it is trying to load a script from a malicious site. If someone who works for Eset is saying it is suspicious then to me it is suspicious and I wouldn't recommend using it. The fact it is trying to load this script is bad enough.

[9anime blocked bcz of HTML/scrlnjet.B trojan]

1 hour ago, local said:

On "Virus Total" , 9anime.to   has 2(two) hits from 72 engines.  The 2 engine detecting the site as "malicious" are Quttera and CRDF  (practically unknown players)

I would say that is safe to access 9anime.to in proportion of 99.9%

A mod had said it is trying to load a script from a malicious site. Users can choose to allow this site but it's at their own risk. If its blocking it there generally is a reason and I'd be concerned

[Undetectable Virus]

4 hours ago, Marcos said:

I respectfully disagree. MBAM typically ranks lower than ESET in tests and from my personal experience if it detects something that ESET doesn't it's something that is not subject to detection, e.g. benign registry values, folders left after malware infection or PUA, etc.

 

3 hours ago, itman said:

The only AV lab I could find that tests MBAM is AV-Test: https://www.av-test.org/en/antivirus/home-windows/

It didn't score well either in protection or performance categories. I certainly would not use it as my real-time AV protection.

 

I think the problem is, although I could be wrong with this, there used to be antivirus and anti malware software with antivirus programs back in the day mainly focused on viruses. Malwarebytes did at some point appear to find stuff others didn't although that could just be people thinking it did. These days antiviruses do generally protect against all types of malware. I've also heard from a lot of past users who found malwarebytes has became not as good in the last few years. I did until last year use both eset and malwarebytes as I had a lifetime license (never had any issues but I know it's not recommended - stopped using it when I was trying to troubleshoot something).

As mentioned as well by Marcos each AV has their own criteria for things such as PUAs

As for the original poster had removing Firefox fixed the issue? I'm reluctant to say that it doesn't sound like a virus if you are trying multiple programs and nothing is being detected. Either that or it is a brand new virus that is very hard to detect but I do think there is something else that is causing the issue - so far the issue seems to be just causing random annoyance rather than doing anything that would appear to be malicious 

[9anime blocked bcz of HTML/scrlnjet.B trojan]

1 hour ago, Mekail wardak said:

i don't know much about all the viruses and malwares and stuff, so i would really like to ask if i should do it or not?

No. If a site is hosting malware then it is a dangerous site and really should be avoided. As Itman had said allowing the site access can and probably will put you at risk. 

[Undetectable Virus]

Sounds odd but are any of your keys stuck as I remember weird stuff happening once because a key on my keyboard was stuck down, probably not this but just wondering. It sounds odd because if it was a virus I'd expect it to do lasting damage e.g. changing settings, removing things etc.

As itman suggested maybe run the pc in safe mode for a while to see if it happens there. You mentioned you couldn't get into it. Did you follow the guide at https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode

If you have came from a previous version of windows you might find it odd as safe mode is accessed slightly differently 

[Spotify started opening on startup ?]

11 hours ago, Tio said:

Just out of curiosity has this ever happened to any others ? 

Not with spotify but I remember when windows installed candy crush without user consent. You should be easily able to uninstall spotify or if you wish to keep it disable it from startup