Jump to content
GoAway

ESET keeps stealing focus from Firefox

Recommended Posts

Ever since about a month the ESET console keeps stealing the focus from Firefox. That is, the console is never visible, but my keyboard hits never reach the window I am looking at. I figured out it was ESET through a simple CLI tool called focus.exe and verified by Microsoft's procexp64.exe:

4960:C:\Program Files\Mozilla Firefox\firefox.exe | Tue Apr 09 16:28:53 2019
4308:C:\Program Files\ESET\ESET Security\egui.exe | Tue Apr 09 16:29:16 2019

Apparently this happens whenever a URL is loaded that contains certain content that ESET feels it must analyze. Especially annoying when the tab is supposed to load in the background.

To reproduce load https://what-if.xkcd.com/155/ and load the " well-equipped fire department" link near the bottom in a new tab.

Any clues how to stop this behaviour?

Share this post


Link to post
Share on other sites
38 minutes ago, GoAway said:

There is something "flakey" about that web page. When I browse to it in IE11, I observe a bunch of small popups upon web page display appearing and disappearing in rapid fashion from the lower left hand side of the web page. Never seen that before. 

Share this post


Link to post
Share on other sites

I have this issue with chrome as well. I had a twitch stream open when this happened. But it happens pretty often and is getting pretty annoying.

 

12988:C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | Tue Apr 09 18:13:49 2019
23568:C:\Program Files\ESET\ESET Security\egui.exe | Tue Apr 09 18:14:19 2019

Share this post


Link to post
Share on other sites

If possible, please create a demonstration video for clarification.

Share this post


Link to post
Share on other sites

Not possible for me, but I can try to describe it better:

 

Chrome is the main focused window. What's being done on chrome varies.

I hear a spinup noise from the case briefly and then Chrome loses focus as if another window has focus. I ignored it for quite awhile but decided to finally look into it and ran the focus.exe from hxxp://www.happydroid.com/focus and had it open on the second monitor, eventually the situation happened again and when I checked to see what was getting focus it was egui.exe except there was no popup visible anywhere and the main window was also not displayed anywhere.

Share this post


Link to post
Share on other sites
Posted (edited)

Hello.

I am having the same situation with ESET Internet Security taking over (stealing) focus. In my case this is not restricted to one program. This can happen to me when I am typing here in this forum, it can happen in Opera Browser, in the Brave Browser, in UltraEdit, in Directory Opus, in etc. etc. etc. In fact it's even happened when I was just now trying to open Windows 10 Classic menu, to launch a program. 

I've written a small macro in MJTNet's MacroScheduler to record the theft and have included it here as an attachment. I've also recorded the macro being run, showing ESET Internet Security is the program taking focus. That recording demonstrates the problem in UltraEdit.

If there's anything I can do more to help get this issue resolved, please don't hesitate to ask. As I've typed this message, ESET IS took over focus thrice. It doesn't seem to happen at any given interval, and like I mentioned, it can happen anywhere, at any time.

Thank you for your time.

d

 

 

Macroscheduler Macro to show ESET-IS taking over focus.txt

 

ESET IS Taking Over Focus.rar

Edited by deloppoled

Share this post


Link to post
Share on other sites

Since my last post, I noticed that this is more calculable and repeatable than I'd first thought.

The attached video may be a little more clear about what's going on. This is a longer video, about five minutes and ten seconds.

It shows me running the macro, manually giving notepad focus, and then it shows Notepad losing focus to ESET-IS & getting focus back, repeatedly every 18-20 seconds or so for the remainder of the recorded screen video.

So, first I run the macro. Next I click on Notepad to give it focus. Finally I let the macro run itself for a little more than five minutes.

The updating window on the taskbar is a program called Clipmate. It is merely is displaying the contents of the Windows Clipboard that is being updated once per second by the macro. The contents of the text file, also in the RAR archive, is a mirror to what you're seeing on the clipboard. The macro code is shown on the screen to the right of Notepad so you can kind of see what it's meant to do.

Thank you.

d

 

ESET-SS Stealing Focus Five Minute Example Using MacroScheduler and Notepad.rar

Share this post


Link to post
Share on other sites
On 4/9/2019 at 6:35 PM, Marcos said:

If possible, please create a demonstration video for clarification.

Hi Marcos. I've attached a couple of demonstration videos that show the problem. The second one may be more self-explanatory than the first, so you may just want to skip the first one.

Share this post


Link to post
Share on other sites

UPDATE:

Here's an update about the issue that I just noticed. Perhaps it may help to zero in on the problem.

If ESET-IS is left open on the system taskbar, no matter where it resides in the Z-order, this problem does not occur. Only when ESET-IS is 'closed' or minimized to the system tray (i.e. ESET-IS is running in the background, parked in the system tray) does the hijacking focus problem occur.
 

Share this post


Link to post
Share on other sites
Posted (edited)

Any permanent fix to this?

All my Windows 10 machines (with ESET installed) have been doing this for weeks. Only today, did I found out what's causing it. I used Window Focus Logger (hxxp://www.adminscope.com/downloads/window-focus-logger-gui/) to finally weed out "egui" as the process stealing my keyboard/mouse focus.

The workaround, which is to keep the ESET console app open as a window and not minimized in the system tray, seems to do the trick. But I think it's only fair to ask for a more proper fix for this.

I'm running ESET Internet Security 12.1.34.0

 

Edited by oj88
Typo

Share this post


Link to post
Share on other sites

Thank you for reporting the issue and the video you've provided. We have eventually pinpointed the issue and a fix will be included in the next version of v12 products.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...