Robertos

If you set correct exclusion to backup process you could still see that real time protection is scanning backup files because other system processes could access those files, e.g. spotlight indexer. This could be turned off by correct performance expulsions on target or may be source folders. But if you will exclude so much it is dangerous, you can backup infections too. So if such huge exclusion is used it is important to scan source backup folder[s] by custom on-demand scan with In-Depth profile before backup. This on-demand scan on source data before doing backup is good to do regardless exclusions because od-scan, especially in in-depth profile, does more strong scanning that real time protection. RTP can not do it because strong scannig is time consuming and not too much real time.

Hi, you must write complete path to process binary. It is not sufficient to use application bundle only. Wildcards are not supported.
 
e.g. if I want to exclude Safari I should create process exclusion with process path:
/Applications/Safari.app/Contents/MacOS/Safari

 

Thanks for update, it's nice to hear that issue was transient and was fixed for you by upgrade of the product.

Losing FDA during restart of macOS is macOS bug. We did workaround in released latest 7.4 to do not trigger this macOS bug.

Losing FDA is macOS issue. We did workaround for it in ECS 7.4.1600.0 and EEA 7.4.1500.0 too. We did nothing for V6, because V6 was not affected by this issue during our compatibility testing with Sonoma. 

If you need EES v6 for some reason and could not upgrade to EEA, you should wait until Apple fix that issue in macOS.

Just for my information, what functionalities from EES V6 are you using that prevents you to upgrade to v7.4.1500.0 ?

LiveGuard is planned.

What do you think by ESSP? Do you think features like firewall? Firewall is planned. It should be released at the end of Q2/2024.
 
Other Pro features not included in AV version are not planned in next half-next year.

You could try temporarily uninstalling ESET CyberSecurity Pro v6 and installing the latest ESET CyberSecurity v7 with native M1/M2 support.

@Shepherd have you updated ESET Cyber Security v7 as the current version has most of the advanced preferences 
 

Hello @bart_c,
I understand that for the advanced users, it might be a step back in terms of the ability to configure / fine-tune the product, but for standard users or even advanced ones it brings features for which there was quite high demand, like the apple silicon native version to name just one of many.
On top of that one user mentioned that the new version improved significantly performance of the time machine backups, which is often reported by users as an issue...
As I mentioned the version with the Advanced preferences available is to be release quote soon, so hopefully it will fit your needs and preferences...
Peter

Hello @NeilB,
thank you for the feedback provided.
The initial release comes with a features, which are essential for our users and we are aware of the demand for the additional features.
When it comes to protection, key component is the Real-time file system protection so if a file is being executed, accessed or created it is scanned by the product to ensure the protection.
A release with the Advanced preferences included is planned in upcoming weeks, it will improve the user experience for advanced users...
Peter

Release Date: October 30, 2023
ESET CyberSecurity for macOS 7.4.1600.0 has been released and is available to download.
Changelog:
Version 7.4.1600.0
FIXED: The product sometimes loses Full Disk Access after OS restart
FIXED: PCU update during an OS restart no longer breaks the product
FIXED: Web access protection issues after upgrade from version 6
FIXED: Services are not connected sometimes after upgrade from an older product
Known issues
Previous versions v7.1 and 7.2 incorrectly migrates TSN RTP settings from V6. If you have upgraded from v6 to the previous v7.1 or 7.2, we highly recommend installing v7.4, opening the RTP TSN 'For all file operations' settings and turning off Advanced heuristic. This setting was incorrectly enabled during migration from v6. The Onboarding wizard is shown after silent installation.
Full disk access is lost after a macOS Sonoma restart. This is a macOS issue that Apple is aware of and will probably fix it in one of the upcoming minor macOS releases. A workaround was added to v7.4 which prevents FDA from getting lost on real hardware (it may still get lost in virtual environments). Upgrade to Latest Version
Upgrade my ESET CyberSecurity for macOS to the latest version
 
Support Resources
ESET provides support in the form of Online Help (user guides), fully localized application and Online Help, online Knowledgebase, and applicable to your region, chat, email or phone support.
Online Help (user guides) Visit www.eset.com/contact to email ESET technical support

Pico update is not planned for ESET Cyber Security for macOS. Machine learning is planned.

Lost full disk access is macOS Sonoma issue. Apple knows it.
 
Anyway, we did workaround to fix it in ECS 7.4.1600.0 and it should work at least on real HW. After fix we were not able replicate this problem on real HW, but still was able to replicate it in virtual machines running Sonoma. But not all VM vendors were affected so you should test it to see if fix is working for you.

Business customers: EEA 7.4.1500.0 has the same FDA fix.

Release Date: October 30, 2023
ESET Endpoint Antivirus for macOS 7.4.1500.0 has been released. The current version is available only for managed environments from the ESET repository. ESET Endpoint Security will be released later.
Changelog:
Version 7.4.1500.0
Fixed: The product sometimes loses FDA after OS restart
Fixed: PCU update during an OS restart no longer breaks the product
Fixed: Web access protection issues after upgrade from version
Known issues
Previous versions v7.1 and 7.2 incorrectly migrates TSN RTP settings from V6. If you have upgraded from v6 to the previous v7.1 or 7.2, we highly recommend installing v7.4, opening the RTP TSN 'For all file operations' settings and turning off Advanced heuristic. This setting was incorrectly enabled during migration from v6. The Onboarding wizard is shown after silent installation. 
For a workaround, follow the instructions available at the ESET KB:
https://support.eset.com/en/kb8506-onboarding-wizard-displayed-during-a-remote-installation-of-eset-endpoint-antivirus-for-macos
https://support.eset.com/en/kb6927-known-issues-for-latest-versions-eset-business-products
Full disk access is lost after a macOS Sonoma restart. This is a macOS issue that Apple is aware of and will probably fix it in one of the upcoming minor macOS releases. A workaround was added to v7.4 which prevents FDA from getting lost on real hardware (it may still get lost in virtual environments). Support Resources
ESET provides support in the form of Online Help (user guides), fully localized application and Online Help, online Knowledgebase, and applicable to your region, chat, email or phone support.
Online Help (user guides) Visit www.eset.com/contact to email ESET technical support

Pico update is not planned for ESET Cyber Security for macOS. Machine learning is planned.

I can see from private message you send me that you quarantine is full of detected trojan infections. You should delete it to clean quarantine but you said you can not do it because there are files that are not infection and you want to restore it? You cannot restore that files because product GUI is not working and not show quarantine content. Do I understand it correctly?
 
I've send you how you can list commands for command line manipulation of quarantine. You are able to do everything with quarantine from command line what you need, like in GUI. In case of GUI is not working it is only one way how to restore file from quarantine.
 
This command prints you help for command line utility quar
"/Applications/ESET Cyber Security.app/Contents/MacOS/quar" --help
 
You should list help to read quar command. The you should list content of your quarantine. Then you should identify files you want to restore if you are sure that restored files are false positive, you should setup exclusion for this file to not detect it by real-time file protection again. then you could restore it  then you should delete rest infected files from quarantine it is better to setup exclusion before you restore detected file otherwise protection will detect it and put into quarantine again  
BTW: how do you know that detected files are false positive?
 
I advise you to run custom scan with 'In-Depth Scan' profile active on you whole disk. It seems that you iMac need it. It could take a time until it will finish because you have a lot of applications on your disk.
 
 

Did in-depth scan found any infections? 
 
I've tested your 1byte PDF file you send me. In-depth scan did not detect it as infection now. I added file to quarantine manually, GUI shows quarantine correctly, I could restore it from quarantine to disk too. Why do you think that this file is the problem?
 
 

We could not release hotfix of 7.4 using Program Component Update aka PCU channel in the application because there are still a lot of customers with old version of 'Mac/Linux support module', so if we release it right now than they will face the same PCU problem again.

Already released 7.4 has the same problem with PCU like 7.3 has, but 7.4 has fixed bug with non-working network which was triggered by failed automatic PCU update of 7.3. 
 
Manual update of 7.3 by released 7.4 is without any problems, this works correctly.
 

V6 is in limited support and as such is not developed any more:
https://support-eol.eset.com/en/policy_business/product_tables.html
V7 with added features will be available in the future.

There are currently no plans to release EEA v6 compatible with macOS Sonoma. However, you can contact your local ESET distributor or reseller and they'll try to come up with a solution for you.

It is problem in macOS Sonoma affecting micro-service architecture used in ECS and EEA version 7. The issue is still present in Sonoma BETA 14.1. OS is removing FDA for product application bundle during restart of macOS. 
 
Although we've reported it to Apple, we are trying to find a workaround fix of this. Hot-fix will be released immediately if we discover how to correctly exit product in problematic macOS shutdown. 

Problem is in automatic mode of the product update in released versions 7.3 and 7.4 too. 
 
We apologize for the inconvenience caused.
 
Fix of product update will be in upcoming hot-fix. We must also fix it on released affected versions before we will be able to release mentioned hot fix via product updates channel.
 
It is crucial to customers to have updated product modules to avoid this problem again, especially 'Mac/Linux support module' must be of version 1048 or higher.
 
If customer have this problem again because of late module updates, manual installation of hot fix will solve this issue.

Try to use version 7.4.1200.0. Excluded IP list should work there but before setup exclusions test if you connectivity problem was fixed in version 7.4.1200.0. If not, please open support ticket we will need more detailed information about problem for replication or fixing.

It is problem in macOS Sonoma affecting micro-service architecture used in ECS and EEA version 7. The issue is still present in Sonoma BETA 14.1. OS is removing FDA for product application bundle during restart of macOS. 
 
Although we've reported it to Apple, we are trying to find a workaround fix of this. Hot-fix will be released immediately if we discover how to correctly exit product in problematic macOS shutdown. 

It is problem in macOS Sonoma affecting micro-service architecture used in ECS and EEA version 7. The issue is still present in Sonoma BETA 14.1. OS is removing FDA for product application bundle during restart of macOS. 
 
Although we've reported it to Apple, we are trying to find a workaround fix of this. Hot-fix will be released immediately if we discover how to correctly exit product in problematic macOS shutdown.