EGUI Opens on Start

[Carl S 1]

I had the problem with version 9 where the EGUI would not start when rebooted. I could not get to any of the settings because the EGUI would not open at all.  I had to log on and log off repeatedly before it would open.  I repaired, I uninstalled, I reinstalled.  Nothing helped. I called support, and they had me uninstall and upgrade to 10. It went away with an upgrade to version 10, then came back, now that problem seems to have gone away with 10.0.390.

But now the EGUI opens on login in 10.0.390.  I have to manually close it every time.  I'm not talking about the splash screen, but the full EGUI.  This is new, and I cannot find a setting to turn it off. This is less of a real problem than just an annoyance.

Using 10.0.390 under Windows 10.

[Marcos 4,914]

Please provide me with ELC logs via a pm (for instructions, see the link in my signature). It's necessary to check if egui.exe is no longer registered for automatic start in the run key.

[Carl S 1]

In the meantime, I did another repair install, and this time the EGUI did not start at all.  No access to the EGUI via system tray and will not start from the Start menu either.

Logged into admin account to run the log software (it wasn't clear if I just had to run as admin or be logged in as admin).  Still no EGUI.  Logged out of admin, back into regular account, and now I see the EGUI comes up and stays up.  Sending logs via pm.

[Carl S 1]

Sent logs in pm yesterday.  In the meantime, I see this message (attached), and the odd thing is I've been at 10.0.390.0 for some time.  I'm not sure if it is related.

 

[Marcos 4,914]

The logs that you have provided me with yesterday show that you had v10.0.386 installed, not 10.0.390.

According to the logs, you have EMET, Sophos Removal Tool and WinAntiRansom installed. Try uninstalling them and see if the issue goes away. Otherwise we'll need a Process Monitor boot log for further analysis.

[Carl S 1]

OK, removed all three, EMET, Sophos Removal Tool (which was installed under a different account and I couldn't find it at first), and WinAntiransom.  Still, EGUI opens and stays open on login/reboot.  Sending Procmon boot log via pm (Edit: well, I was going to, but it was 2.0Gb zipped--probably should not have told it to include profiling events).

Edited March 8, 2017 by Carl S

[Carl S 1]

Hmm. Didn't seem to make it smaller by turning off profiling events....and to top it off, this time EGUI started minimized.  Anyway, sending the Process Monitor boot log.  Good thing was that the 2.0Gb size was uncompressed--oops.

[itman 1,627]

14 minutes ago, Carl S said:

this time EGUI started minimized.  

Try a cold boot and see if the Eset GUI stays minimized. On Win 10, a restart is not a full boot.

[Carl S 1]

13 hours ago, itman said:

Try a cold boot and see if the Eset GUI stays minimized. On Win 10, a restart is not a full boot.

Tried this.  Same thing.  GUI is up and stays up after cold boot.

[itman 1,627]

19 hours ago, Carl S said:

OK, removed all three, EMET, Sophos Removal Tool (which was installed under a different account and I couldn't find it at first), and WinAntiransom.  

Did you reinstall Eset ver. 10 after removing these?

[Carl S 1]

1 hour ago, itman said:

Did you reinstall Eset ver. 10 after removing these?

No, I didn't.  I will do so and report back.

[Carl S 1]

Yes, I reinstalled version 10, it grabbed 10.0.390.0 during install, and after installing and rebooting, the ESET GUI stays open on logging in.

[itman 1,627]

Check your Win 10 Start menu and ensure only one ref. to Eset GUI exists as shown in the below screenshot:

 

[Carl S 1]

Nope, but that got me thinking! 

If you'll look at my original post, one of the problems I had previously was that the ESET icon was not starting at all and not appearing in the system tray.  

I have a vague recollection that one of the things attempted to get it to go was adding it manually to one of the autostart places on the computer.  That didn't work, though.  

Now, I'm thinking I never removed that and the startup is because I moved on to another strategy to get it to work.Eventually, moving to 10 seemed to get it to work.  Now, I think I'm just seeing the results of my attempts to get version 9 to start at all.  Sure enough I do Run|shell:startup and I see a shortcut to EGUI.exe dated 9/1/2016 from the height of my ESS 9 problems.  Yep, that seems to be it.  It was something leftover from earlier troubleshooting on version 9.

[itman 1,627]

1 hour ago, Carl S said:

Nope, but that got me thinking! 

If you'll look at my original post, one of the problems I had previously was that the ESET icon was not starting at all and not appearing in the system tray.  

I have a vague recollection that one of the things attempted to get it to go was adding it manually to one of the autostart places on the computer.  That didn't work, though.  

Now, I'm thinking I never removed that and the startup is because I moved on to another strategy to get it to work.Eventually, moving to 10 seemed to get it to work.  Now, I think I'm just seeing the results of my attempts to get version 9 to start at all.  Sure enough I do Run|shell:startup and I see a shortcut to EGUI.exe dated 9/1/2016 from the height of my ESS 9 problems.  Yep, that seems to be it.  It was something leftover from earlier troubleshooting on version 9.

Figured it was a startup issue. Glad you got it straightened out.

[Marcos 4,914]

Did removing the shortcut from the Start menu resolve the issue?

I saw in your log that it started egui.exe without the /hide switch:

22:29:28,1030875    00:02:26.0186259    0.0000000    Explorer.EXE    1888    Process Create    C:\Program Files\ESET\ESET Smart Security\egui.exe    SUCCESS    PID: 7308, Command line: "C:\Program Files\ESET\ESET Smart Security\egui.exe"     22:29:28,1030875   

As of v10, egui.exe is started by ekrn.exe so it should no longer be started from the registry.

[Carl S 1]

Yes, if you read my post to itman, you'll see that as part of the debugging of version 9, which was having problems starting the EGUI both from the start menu as well as displaying ESS in the system tray, I had added EGUI to the start menu.  After upgrading to version 10, this addition remained.  I had added by putting  shortcut to EGUI.exe in the folder C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup While that didn't work for version 9--about 2/3 of the time I could not get to the GUI--once I had upgraded to 10, I was now getting the UI to pop up every time.  I had forgotten that this was something we'd tried under version 9.  When I removed it from that startup directory yesterday, the problem was resolved.