Shri Ganesh

Okay will do. Upgraded to 17.2.7.0 just now. Gamer mode was already disabled. Will reproduce the issue and generate complete dump of egui.exe, eguiproxy.exe and ekrn.exe via the Task manager and upload them.

Hi @Marcos No it's just a theory that seems to match the symptoms. There is no way to tell when this issue occurs. And the only way to resolve it, is by restarting the machine.

Hi @Marcos, I am back to the place where I've access to my PC. I've re-uploaded the previously collected logs https://filebin.net/ahjroaq8wh33gs8g/eis_logs.zip (OR) https://file.io/bBZPZKA05lUc PWD: Fg3cy4542tkTix

This is definitely a possibility. But after a system restart, it automatically reverts from Policy based mode to interactive. But I've verified the settings, the does show as interactive only.

Wow that's quite surprising! And exactly like you, I am also running one or two VMs (on VMWare Workstation) any most times. May be this has something to do with this issue?

Hi @Marcos Okay noted. It was a painful to create all the firewall rules from scratch. But I will try this and let you know. Is there any way to just export and import firewall rules only? Thanks, Shri

Okay, I think I've narrowed the issue down further or may be it's just a Windows 11 thing. It's not that the Firewall window isn't appearing. But rather the Firewall silently blocking connections EVEN when stating that it's unblocked. Screenshot attached. There is an explicit allow rule and it even states Unblocked. But I still see Blocked counter increasing (17x).

Hi @Marcos, I think I found something interesting. I think the allow application firewall screen pops up for certain types of apps (Windows App store Apps) and NOT for regular Windows apps installed/extracted.

Hi @Marcos, I am currently out of station and can't access my desktop. But I am facing the SAME EXACT issue with my laptop. My laptop is running Windows 11 x64 and running ESET Internet Security v17.2.7.0. Will it be helpful if I provide with reg key export of HKEY_CURRENT_USER\Software\ESET\ESET Security from my Windows 11 laptop? I do remember backing up and restoring config from older version of ESET. I do regularly backup even now so that I can restore and don't need to bother with all the custom firewall rules. If a reg key export of HKEY_CURRENT_USER\Software\ESET\ESET Security from my Windows 11 laptop will help, I will share it as well.

Is there anyway that I can reach support team?

Hi @Marcos Was there anything wrong identified on analysis of the dump files? Thanks, Shri

Noted. I've enabled LiveGrid reputation system (without enabling feedback system for submitting samples). But I will try enabling feedback system with manual submission of samples. Thanks, Shri

Noted. I had never enabled this feature due to privacy features. I think LiveGrid was called ThreatSense or something in early versions. I couldn't find which files will be uploaded to LiveGrid automatically. Is it possible to make use of LiveGrid without uploading my files? Thanks, Shri

Hi @Marcos I initially had it enabled when the feature was introduced (may be around v13.x) but it started signing un-trusted certificates. Specifically self-signed certificates were being signed by ESET CA certificate causing my browser to implicitly trust those certificates and this was causing me lot of headache and at that time as I couldn't find a way to exclude ESET from intercepting certain IPs. But once this issue is firewall issue is resolved, I will try enabling it again. Thanks, Shri

Hi @Marcos I don't believe it's due to disabled TLS/SSL filtering as the file was downloaded over http (not https). I was checking after the file was downloaded/written to the disk and was visible in Explorer. It took quite a while after the exe file appeared in the explorer. But I tried again with different browser Chrome (previously Vivaldi) and this time it was detected quickly. As for the TLS/SSL issues, the TLS filtering is signing all the certificates (including the ones un-trusted local certificates from my NAS/Router/smart devices etc). I am using AdGuard with Phishing and malware protection. I do agree that it won't scan anything at file level (while being transferred) but mostly at domain level. But due to the certificate signing problem, I had to disable TLS/SSL filtering. Thanks, Shri