Jump to content
GoAway

ESET keeps stealing focus from Firefox

Recommended Posts

Ever since about a month the ESET console keeps stealing the focus from Firefox. That is, the console is never visible, but my keyboard hits never reach the window I am looking at. I figured out it was ESET through a simple CLI tool called focus.exe and verified by Microsoft's procexp64.exe:

4960:C:\Program Files\Mozilla Firefox\firefox.exe | Tue Apr 09 16:28:53 2019
4308:C:\Program Files\ESET\ESET Security\egui.exe | Tue Apr 09 16:29:16 2019

Apparently this happens whenever a URL is loaded that contains certain content that ESET feels it must analyze. Especially annoying when the tab is supposed to load in the background.

To reproduce load https://what-if.xkcd.com/155/ and load the " well-equipped fire department" link near the bottom in a new tab.

Any clues how to stop this behaviour?

Share this post


Link to post
Share on other sites
38 minutes ago, GoAway said:

There is something "flakey" about that web page. When I browse to it in IE11, I observe a bunch of small popups upon web page display appearing and disappearing in rapid fashion from the lower left hand side of the web page. Never seen that before. 

Share this post


Link to post
Share on other sites

I have this issue with chrome as well. I had a twitch stream open when this happened. But it happens pretty often and is getting pretty annoying.

 

12988:C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | Tue Apr 09 18:13:49 2019
23568:C:\Program Files\ESET\ESET Security\egui.exe | Tue Apr 09 18:14:19 2019

Share this post


Link to post
Share on other sites

If possible, please create a demonstration video for clarification.

Share this post


Link to post
Share on other sites

Not possible for me, but I can try to describe it better:

 

Chrome is the main focused window. What's being done on chrome varies.

I hear a spinup noise from the case briefly and then Chrome loses focus as if another window has focus. I ignored it for quite awhile but decided to finally look into it and ran the focus.exe from hxxp://www.happydroid.com/focus and had it open on the second monitor, eventually the situation happened again and when I checked to see what was getting focus it was egui.exe except there was no popup visible anywhere and the main window was also not displayed anywhere.

Share this post


Link to post
Share on other sites
Posted (edited)

Hello.

I am having the same situation with ESET Internet Security taking over (stealing) focus. In my case this is not restricted to one program. This can happen to me when I am typing here in this forum, it can happen in Opera Browser, in the Brave Browser, in UltraEdit, in Directory Opus, in etc. etc. etc. In fact it's even happened when I was just now trying to open Windows 10 Classic menu, to launch a program. 

I've written a small macro in MJTNet's MacroScheduler to record the theft and have included it here as an attachment. I've also recorded the macro being run, showing ESET Internet Security is the program taking focus. That recording demonstrates the problem in UltraEdit.

If there's anything I can do more to help get this issue resolved, please don't hesitate to ask. As I've typed this message, ESET IS took over focus thrice. It doesn't seem to happen at any given interval, and like I mentioned, it can happen anywhere, at any time.

Thank you for your time.

d

 

 

Macroscheduler Macro to show ESET-IS taking over focus.txt

 

ESET IS Taking Over Focus.rar

Edited by deloppoled

Share this post


Link to post
Share on other sites

Since my last post, I noticed that this is more calculable and repeatable than I'd first thought.

The attached video may be a little more clear about what's going on. This is a longer video, about five minutes and ten seconds.

It shows me running the macro, manually giving notepad focus, and then it shows Notepad losing focus to ESET-IS & getting focus back, repeatedly every 18-20 seconds or so for the remainder of the recorded screen video.

So, first I run the macro. Next I click on Notepad to give it focus. Finally I let the macro run itself for a little more than five minutes.

The updating window on the taskbar is a program called Clipmate. It is merely is displaying the contents of the Windows Clipboard that is being updated once per second by the macro. The contents of the text file, also in the RAR archive, is a mirror to what you're seeing on the clipboard. The macro code is shown on the screen to the right of Notepad so you can kind of see what it's meant to do.

Thank you.

d

 

ESET-SS Stealing Focus Five Minute Example Using MacroScheduler and Notepad.rar

Share this post


Link to post
Share on other sites
On 4/9/2019 at 6:35 PM, Marcos said:

If possible, please create a demonstration video for clarification.

Hi Marcos. I've attached a couple of demonstration videos that show the problem. The second one may be more self-explanatory than the first, so you may just want to skip the first one.

Share this post


Link to post
Share on other sites

UPDATE:

Here's an update about the issue that I just noticed. Perhaps it may help to zero in on the problem.

If ESET-IS is left open on the system taskbar, no matter where it resides in the Z-order, this problem does not occur. Only when ESET-IS is 'closed' or minimized to the system tray (i.e. ESET-IS is running in the background, parked in the system tray) does the hijacking focus problem occur.
 

Share this post


Link to post
Share on other sites
Posted (edited)

Any permanent fix to this?

All my Windows 10 machines (with ESET installed) have been doing this for weeks. Only today, did I found out what's causing it. I used Window Focus Logger (hxxp://www.adminscope.com/downloads/window-focus-logger-gui/) to finally weed out "egui" as the process stealing my keyboard/mouse focus.

The workaround, which is to keep the ESET console app open as a window and not minimized in the system tray, seems to do the trick. But I think it's only fair to ask for a more proper fix for this.

I'm running ESET Internet Security 12.1.34.0

 

Edited by oj88
Typo

Share this post


Link to post
Share on other sites

Thank you for reporting the issue and the video you've provided. We have eventually pinpointed the issue and a fix will be included in the next version of v12 products.

Share this post


Link to post
Share on other sites
On 4/24/2019 at 3:25 AM, Marcos said:

Thank you for reporting the issue and the video you've provided. We have eventually pinpointed the issue and a fix will be included in the next version of v12 products.

Hello.

Would you happen to have an ETA on when the update / fix you mentioned may be issued?

Thank you.

ESET IS v12.1.34.jpg

Share this post


Link to post
Share on other sites

It will be fixed in v12.2. I reckon the beta version has it already fixed.

Share this post


Link to post
Share on other sites

I am having the same issue. I identified Eset as the culprit by downloading a free app called Window Focus Logger from hxxp://www.adminscope.com/downloads/window-focus-logger/ and the very next time that my Chrome browser lost focus (while I was typing into a forum on Spiceworks) I saw that the process name was "egui".

I have attached a screenshot highlighting the last 2 times that "egui" took focus away from the window I was using.

I am using Eset NOD32 Antivirus version 12.1.34.0 .

SNAG- 5-28-2019 8.13.57 PM.png

Share this post


Link to post
Share on other sites
1 hour ago, kittenofd00m said:

I am having the same issue.

I can only repeat what I have already stated: The issue has been already fixed in v12.2 beta.

Share this post


Link to post
Share on other sites
Posted (edited)
On 5/28/2019 at 8:35 PM, Marcos said:

I can only repeat what I have already stated: The issue has been already fixed in v12.2 beta.

Hello.

Is it possible for home users to walk back ESET IS about four months, to the most recent version prior to v12.1.34.0?

If that is possible, can you please provide a download link?

Thank you. Have a nice weekend.

Edited by deloppoled

Share this post


Link to post
Share on other sites
34 minutes ago, deloppoled said:

Hello.

Is it possible for home users to walk back ESET IS about four months, to the most recent version prior to v12.1.34.0?

If that is possible, can you please provide a download link?

Thank you. Have a nice weekend.

See if this is what you want https://support.eset.com/kb2885/

Of course, the latest version has the latest protection...but the call is yours alone.

Regards,

Tom

Share this post


Link to post
Share on other sites

I am currently experiencing this exact same issue on my Win7 laptop, running Eset Internet Security v12.1.34.0. It has been happening for a while but I didn't dig hard enough initially to find what was causing it until today. Thanks to WindowsFocusLogger, I found the source, Egui.

I don't particularly wish to roll back to an earlier version of Eset, I'd really appreciate it if the issue would be addressed in an update, as it seems there are likely to be many of your customers affected, but they probably don't have the technical knowledge to find out what or why.

If it was "fixed in v12.2 beta", then it has been broken since, and needs fixing again.

I can supply a screenshot from WindowsFocusLogger if you need it, but it looks little different to that of kittenofd00m, except I use Firefox or Opera, never Chrome.

Thanks, Kitka

Share this post


Link to post
Share on other sites

We are very close to releasing v12.2 for general public. It is likely that users with the pre-release update channel will receive an update to the new version within this week if everything goes well.

Share this post


Link to post
Share on other sites

Same issue for me, except I wasn't browsing at the time.
I did, however, have Chrome running in the background.

The way I determined that NOD32 was the culprit was just by pressing Alt+Space when the focus was stolen and choosing "Maximize" - the NOD32 window was then shown and maximized on the screen.

Hoping this will indeed be fixed in the coming update. 😃

Share this post


Link to post
Share on other sites

If you want, you can switch to pre-release update channel in the advanced setup -> Update and you should receive an automatic update to v12.2 within a few hours.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...