Cannot access update server / HIPS inactive

[Warren B 0]

Hi folks;

About a week ago, my ESET antivirus suddenly decided that it couldn't access the update server. last update was on 10/12/16.

I have checked firewalls and adware / malware programs, and the program has access through these. I have not installed any new software for some months. I have never experienced this issue previously. I have also run a full antivirus scan, with no issues being reported.

In addition, I have begun getting the message that HIPS is inactive, and the "user rules fle contains invalid data" with the additional note that HIPS cannot access the driver.

I am running Windows 7 Ultimate (yeah, I know...) 16G Ram, 64 bit system, i7 CPU with all the latest updates installed. ESET version 9.0.408.0 installed.

My ESET licence is valid until the 09/10/17.

Any help would be greatly appreciated.

 - Warren B.

[itman 1,659]

Try to repair Eset using Control Panel -> Programs -> Programs and Features-> Uninstall a program option.

If this doesn't fix the issue, I would then completely uninstall Eset, reboot, and then reinstall ver. 9. Make sure you export your existing settings prior to uninstall. Then import the saved settings file after you reinstalled Eset.

 

[Warren B 0]

Gudday itman;

That appears to have solved the update issue, although the program seems to have wound itself back to the previous version in doing so. The HIPS issue remains, with the program telling me that it cannot access the driver still. Thanks very much for the information and advice, I'll see how the HIPS issue goes and let you know. I owe you a beer...

 - W.

[itman 1,659]

15 hours ago, Warren B said:

That appears to have solved the update issue, although the program seems to have wound itself back to the previous version in doing so.

I forgot to mention that a repair will revert Eset back to the release it was installed with. I assume you have upgraded to the latest release via the Product Update option.

15 hours ago, Warren B said:

The HIPS issue remains, with the program telling me that it cannot access the driver still.

There is no Eset HIPS system driver per se. It is a driver stub .dll extension located in the Eset module folder that is loaded in the kernel root table area using ehdrv.sys; also known as the Eset helper driver. If something was amiss with this driver, you would be receiving more than just HIPS warnings.

Since your original warning from Eset was about invalid user rules, I would start removing those one by one until you find the rule Eset is complaining about. As an alternative to rule deletion, you can edit each user rule in the HIPS. Do a token change such as deleting and then replacing the same character in a path name or the like. Then immediately save and exit via OK from the HIPS. If there is a syntax problem with that just changed rule, the HIPS will alert you to that fact when you try to save the modified rule. 

Edited December 19, 2016 by itman