Jump to content

Issue from yesterday with ESET NOD32 5-6-EndPoint


modessrl

Recommended Posts

Hello everyone, in out network we have 14 clients with Outlook 2003 SP3 and Kerio Connect for interact with our Kerio Mail server version 8, after yesterday update all our client are unable to comunicate with outlook aymore, only solution I had was uninstall all NOD32 from our clients. Is there any compatibility issue ?? Please help me to solve this problem thank you

 

Link to comment
Share on other sites

  • Administrators

We didn't release a newer module except some that HIPS and Internet protection module that had been downloaded by millions of users before with no issues reported. Try disabling protocol filtering and see if it makes a difference. If it doesn't, try disabling other protection modules, one at a time, to narrow it down.

Link to comment
Share on other sites

Well I not know what you did but from yesterday all clients not work and as I disabled filter protocol now they go back to work again so it must be something inside your update. By disabling it then what happen ?

Link to comment
Share on other sites

  • Administrators

What version of the Internet protection module is installed on these clients? Is it 1091 or 1067? Disabling protocol filtering is not recommended as the Web scanner is the first layer of defense when it comes to Internet threats.

Link to comment
Share on other sites

On all client it's 1091, btw on 32 bit windows XP I menage to set on the Protocol Filter, system integration and silter control by application and I had to set Application set as web browser and mail client option. While on machine with 64 bit W7 I had to disable all the filter option for make it work as before.

Link to comment
Share on other sites

We have a similar issue for IMAP protocol with Thunderbird. Many user(XP or W7, 32 or 64bits, 2 differents mails server)  claim, that after a sending mail a copy cannot be copied to a Sent folder

ESET Endpoint Antivirus 5.2.2214.5

Edited by almor
Link to comment
Share on other sites

Not know if options is the same but as I ask same stuff to Kerio support they told me to just disable the POP3 IMAP filter protocol of Eset, what bother me actually is the disable HTTP filter that's not really something that make me happy as a workaround :/ And offcurse I hope you have an antivirus on your mail server at least.

Edited by modessrl
Link to comment
Share on other sites

I'll try.

The problem - it's not a permanent issue. User can send 9 mails w/o a problem, but tenth will be blocked.

It can be an email with an attachement or w/o. Not depend of a mails content

Now i had to disable a IMAP scaning for everyone.

Link to comment
Share on other sites

Yesterday Thunderbird lost the ability to receive gmail. It will send, but report an error saving to the Sent folder.

I am running ESET Nod32 Antivirus 5.0.95.0

This must be related to a ESET update, because Thunderbird has been working for me for years.

This is critical! I need a fix!

Link to comment
Share on other sites

tlapse you should try to disable the protocol filter, btw I've seen another things about this protocol filter with last update , with that one enabled the computer on a network will take little longer to log on the domain.

Link to comment
Share on other sites

  • 1 month later...

After a New year, I've reactivated an IMAP scanning.

But from today, this issue reappeared: after a message is sent, Thunderbird cann't copy a message to a Sent folder.

As i say before, in 3 locations we have 3 mails servers and about 300 users with a ESET Endpoint Antivirus 5.0.2214.5

I've got about 20 similar complains today from all locations.

I've deactivated an IMAP scanning and all things goes well, but it very dangerous for us.

Link to comment
Share on other sites

  • Administrators

But from today, this issue reappeared: after a message is sent, Thunderbird cann't copy a message to a Sent folder.

As i say before, in 3 locations we have 3 mails servers and about 300 users with a ESET Endpoint Antivirus 5.0.2214.5

I've got about 20 similar complains today from all locations.

I've deactivated an IMAP scanning and all things goes well, but it very dangerous for us.

 

Does the issue occur only with your IMAP servers or you're able to reproduce it with gmail as well? What IMAP servers do you use? What version of the Internet protection module do you have installed at the moment?

Link to comment
Share on other sites

We don't use Gmail. As i say, a mails are not always blocked, so to configure and use Gmail to reproduce this issue maybe not successful

Our IMAP servers are Zarafa

Internet Protection is version 1097

Yesterday, i've update all PCs(about 50) on one location to the last ESET version: 5.0.2225.1 and reactivated IMAP scanning. Till now didn't get any complaint.

Link to comment
Share on other sites

We get this issue with a new version too.

I've activated IMAP scanning to my colleagues around me.

Two of them got error +- at the same time.

Could you, please, resend me a procedure to activate a logging

Link to comment
Share on other sites

  • Administrators

The version of Internet protection module available on Endpoint release update servers is 1096 which shouldn't be affected by IMAP issues whatsoever (at least we haven't received any reports or complaints since the module release in July 2013.

Make sure that pre-release updates are disabled or v1097 of the module would be downloaded.

I'll pm you with instructions how to activate logging that might help us figure out what's wrong.

Link to comment
Share on other sites

>>Make sure that pre-release updates are disabled or v1097 of the module would be downloaded.

 

It's on Regular update. But we have 1097 from 16/12/2013

Is it possible to downgrade?

Link to comment
Share on other sites

  • Administrators

>>Make sure that pre-release updates are disabled or v1097 of the module would be downloaded.

 

It's on Regular update. But we have 1097 from 16/12/2013

Is it possible to downgrade?

 

Endpoint should download v1096 provided that regular updates are selected. Try switching to pre-release updates, run update (you can terminate it after it's started) and then switch back to regular updates and run update. 

Link to comment
Share on other sites

Marcos, i didn't get a PM. Please, resend it.

 

Looking a log on RA I've noticed, that Internet Protection was updated from  1096 to 1097 22/01/2014. No one changed a update config on the server from regular to pre-relise or other

A users, that was out of office already have version 1096 and virus signature DB 9318 dated from 21/01/2014

A first record i can see in the log from 22/01/2014 is Internet Protection version 1097 and DB 9321

Link to comment
Share on other sites

  • 1 month later...

Hello Marcos

 

sorry, but i'm back.

Didn't you experience a problems with an empty emails? I'll explain: an user move or delete an email from a folder via IMAP in Thunderbird, but after message is moved an empty(no body nor header) mails appeared, only in a local interface, not on a server.

I've got some cases when we first experienced this issue with IMAP scanning, but i didn't relayed it to EAV, but after i've re-enabled IMAP scanning with a new Internet module protection, i was noticed by some users of this issue.

I've tried to disable again IMAP scanning and no more problems, so i think it have a same source.

Is a log enabling can give more information about this issue?

 

here is a screenshot:

https://dl.dropboxusercontent.com/u/31181920/agr.JPG

Edited by almor
Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...