Eset 10 network protection problems

[Thors69 0]

My Network adapter hast no Epfw NDIS LightWeight Filter in his List!

Is this normal?

[Marcos 5,070]

1 hour ago, Thors69 said:

My Network adapter hast no Epfw NDIS LightWeight Filter in his List!

Is this normal?

If you have Windows 8.1+ and ESS/EIS v10 installed, it's ok.

[itman 1,659]

Question, folks.

Are some/all running the latest Win 10 Creators Update? It changed, I believe, the way the Win firewall is handling things especially in regards to system processes and services.

[Thors69 0]

I have the update and this problem

[SlashRose 25]

For me it had with the 1607 also already this error, just like now with the creators, so I come to the conclusion that it is a Eset Bug and I would bet on! The deletion of the rules brought only a temporary improvement, since today the mistakes are back!

(German: Bei mir hatte es mit der 1607 auch schon diesen Fehler, genauso wie jetzt mit dem Creators, so das ich zu dem Schluß komme das es ein Eset Bug ist und darauf würde ich Wetten! Das Löschen der Regeln brachte nur kurzfristig Besserung, seit heute sind die Fehler wieder da!)

[amiralabazyaft1395gmail.co 0]

On 4/8/2017 at 7:11 PM, Hikester said:

I had the problem with Win10 1607 and now Win10 1703 - I can fix it now most of the time by disabling all 3 Problems (Firewall,IDS,Botnet) -> close the GUI -> open it again and enabling all 3 again without the need for reboot

 

[cookieboy 5]

I am using Windows 10 64 bit version 1703, with the latest ESET 10 version

So are we getting closer to sorting this problem out permanently, instead of all the workarounds? Are the software team aware of this?  I'm sure there are numerous users out there, that are oblivious whether they have a problem, as no alarm is flagged on the ESET taskbar icon!! 

It's obviously the firewall rules that are the issue, so why is it taking so long to fix this?

I have deleted all rules, but can't add any new ones without the problem returning. I have tried Interactive mode but get so many annoying 'Outbound network traffic' alert pop ups I have gone back to automatic without any rules.

Come on ESET sort it out for good, before you lose lots of customers

[Marcos 5,070]

18 hours ago, SlashRose said:

For me it had with the 1607 also already this error, just like now with the creators, so I come to the conclusion that it is a Eset Bug and I would bet on! The deletion of the rules brought only a temporary improvement, since today the mistakes are back!

Do you mean that the issue occurred also with automatic firewall mode and no custom rules created? The fact that deleting rules helped the others could be just a coincidence.

Those who are having this issue with red protection status due to problems with the firewall, please generate an ekrn dump via the advanced setup -> Tools -> Diagnostics -> Generate dump file when the issue is manifesting. When done, compress the dump in the Diagnostics folder, upload it to a safe location and pm me the download link.

Also enable advanced firewall logging in the advanced setup -> Tools -> Diagnostics and reboot the computer. If the issue occurs, provide me with the firewall etl logs found in the Diagnostics folder.

[Marcos 5,070]

On 8. 4. 2017 at 5:22 PM, ottchris said:

That's interesting. Had tried toggling disable/enable before unsuccessfully but without closing the GUI in between. Will try that next time as obviously preferable to my workaround of restarting windows.

An additional observation. Just checked windows event logs and the non-functional status appears to correlate with this:

This application took longer than usual to start up, resulting in a performance degradation in the system startup process: 
     File Name        :    ekrn.exe
     Friendly Name        :    ESET Service
     Version        :    10.0.386.0 
     Total Time        :    871ms
     Degradation Time    :    538ms
     Incident Time (UTC)    :    08/04/2017 14:21:09

When I implement my workaround no such message is logged during the post-disable (Firewall, IDS, Botnet) windows boot.

I wonder if the others have the same event logged in the Windows event log. If you are able to reproduce it, please generate also a Procmon boot log as per the instructions in the appropriate KB linked in my signature.

[SlashRose 25]

I am now waiting for 1 week after that my support request from the German support times is answered, why is this each time so that one waits for weeks for a support request from the German support?

(German:Ich warte jetzt seit 1 Woche darauf das meine Support Anfrage vom Deutschen Support mal Beantwortet wird, warum ist das jedesmal so, dass man Wochen wartet auf eine Support Anfrage vom Deutschen Support?) 

[cookieboy 5]

This discussion seems to have gone quiet. Has the problem with the faulty Network/Firewall module been fixed?

Edited May 9, 2017 by cookieboy

[SlashRose 25]

Yes, the problem has been fixed!

[cookieboy 5]

1 minute ago, SlashRose said:

Yes, the problem has been fixed!

So will the module be updated through normal updates. I have the firewall set to Automatic mode?

[SlashRose 25]

Yes, now peer update is automatic!

[ottchris 2]

15 hours ago, SlashRose said:

Yes, the problem has been fixed!

Not here it hasn't. I have not contributed to this thread for a while because I have been trying to zero in on the cause while still trying to do normal work. This morning all was fine after the first windows boot. Yesterday, it took 2 additional windows restarts after the first boot for ESET to start with all Network protection modules fully functional. On 8th May just one windows restart was needed. On 7th May 2 restarts plus another 3 restarts with the workaround (the 3 modules modules disabled prior to windows restart and then re-enabled post restart) before I was able to get the 3 modules functional. I have run ESET log collector (1 days worth) on most days. The evidence so far is that it seems to depend on resource availability and perhaps sequence of events during start up which can differ from one restart to the next, and maybe even hardware configuration (4+ year old laptop but with an SSD hard drive and core i5 processor).

[SlashRose 25]

I can only tell you that the problem on all my 5 PCs is fixed, you have perhaps some tuning tools on it, which you have many times what s.System bent?

[ottchris 2]

31 minutes ago, SlashRose said:

I can only tell you that the problem on all my 5 PCs is fixed, you have perhaps some tuning tools on it, which you have many times what s.System bent?

I wouldn't dispute that *your* 5 PCs no longer exhibit the problem. I'm happy to be corrected but I don't believe we know the root cause, i.e. the process which leads to the three network protection modules starting up non-functional and until we do it can't be said the problem has been fixed. That was the point I was making in my reply. Over the last month or so I have made significant reductions in the number of applications and any associated services that start up automatically so I'm almost at a 'skeleton startup' configuration. In my case, the current situation is an aggravation but it is liveable with. The investigation is ongoing.

[SlashRose 25]

Maybe Marcos could say something!

[Arash 4]

8 hours ago, SlashRose said:

I can only tell you that the problem on all my 5 PCs is fixed, you have perhaps some tuning tools on it, which you have many times what s.System bent?

 

Wow, that's weird. I have 4 PCs with the exact same problem without any luck!!!

[Arash 4]

Has anyone solved this issue?

[SlashRose 25]

For me, the problem has been solved since switching to testupdates, just wait for it, which you can finally switch back to the regular updates!

[Marcos 5,070]

Also check if the Windows Firewall service is running, .e.g. by running "sc query mpssvc" as an administrator.

[Arash 4]

7 hours ago, SlashRose said:

For me, the problem has been solved since switching to testupdates, just wait for it, which you can finally switch back to the regular updates!

 

I've switched to testupdates (about 90MB new update files are downloaded) but sadly the problem still remains.

[SlashRose 25]

A rebootart you made afterwards yes? Have you ever checked whether the firewall is running, as Marcos wrote?

Edited May 25, 2017 by SlashRose

[Arash 4]

reboot yeap

firewall settings:

Edited May 26, 2017 by Arash