Pando

EDIT: I can confirm that EA 5.0.2214.4 picked up the Cleaner module 1114 (the released version, not pre-release) over the weekend and it does fix the problem. The registry keys now stay what they are supposed to be on Windows 10. Thank you ESET team for fixing this.

I'm using ESET Endpoint Antivirus version 5.0.2214.4, Cleaner module 1113. It is compatible with Windows 10 according your website: hxxp://support.eset.com/kb3747/ ​ ESET Endpoint Security / ESET Endpoint Antivirus 5.0.2126 and later 5.x builds Yes, you can upgrade to Windows 10 now The problem is still there in this build, and I have also tried Cleaner module 1114 (EDIT: it was a pre-release version 1114). Please issue a fix for this software, or update your website reflecting that it's NOT IN FACT COMPATIBLE. Thank you.

Needless to say that this problem with ESET will put a stop to our Windows 10 rollout in our company, and if it isn't fixed in a reasonable time will cause us to look for other AV vendors.

Just for giggles I tried to set permissions to those keys so System would not be able make changes to the key - no luck. Even with explicit write deny permissions for "System", ekrn.exe (which invokes the System) is still changing the key. Windows must have a global override. So for now I just modified the permissions so I can still change the keys quickly myself with an exported registry file. Since Windows reads these values only once upon login, I need to execute the reg file before I log off. It's a pain, but much faster than manually modifying the keys all the time. One of these days I'll set up a script or batch file that runs this automatically upon logoff. I also verified with a plain Windows 10 machine without ESET that both registry keys are set to %SystemRoot%\system32\windows.storage.dll Here is the reg file contents: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,69,00,\ 6e,00,64,00,6f,00,77,00,73,00,2e,00,73,00,74,00,6f,00,72,00,61,00,67,00,65,\ 00,2e,00,64,00,6c,00,6c,00,00,00 [HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,69,00,\ 6e,00,64,00,6f,00,77,00,73,00,2e,00,73,00,74,00,6f,00,72,00,61,00,67,00,65,\ 00,2e,00,64,00,6c,00,6c,00,00,00 ​

Here is a ProcMon log screenprint showing ekrn.exe changing the registry values. I hope this helps. I did a pre-release update and I'm currently using Cleaner module 1113 (20150929), ESET EA 5.0.2214.4, and the problem still exists.

Well, never mind about my previous post. Seems that I didn't wait long enough after each reboot. After the last reboot the values reverted back to shell32.dll. Argggg.....!

Here is what I found: The instructions in the preceding posts indicate that two registry keys need to be changed: HKEY_CLASSES_ROOT\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32\(Default)​ HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32\(Default)​ ​ I changed the values on both to: %SystemRoot%\system32\windows.storage.dll​ and rebooted. This fixed it temporarily, but upon the next reboot they were changed back again to the previous values (shell32.dll), and the desktop icon problem was BACK. So, I went back to the registry and changed them as follows: On this key: HKEY_CLASSES_ROOT\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32\(Default)​​ I changed the value to: %SystemRoot%\system32\windows.storage.dll​ and this key: HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32\(Default)​​ I changed it to: %SystemRoot%\SysWOW64\windows.storage.dll​ I've rebooted several times now and the problem is now gone. The registry values seem to stick. I hope this helps someone, as it was certainly frustrating, and I hope someone at ESET can supply a permanent fix. EDIT: NEVER MIND of the above, it still reverted back to shell32.dll after several reboots and waiting longer....