PGP Disk and NOD32

[Zardoc 3]

Hi all,

 

Just updated Symantec Encryption Desktop 10.4.2.MP3 (PGP Disk) on three machines. After each install I get Issues with NOD32 Antivirus. If I uninstall and reinstall NOD 32, issues go away. I'm not sure if the problem is related to PGP PGPWLD pwflt.dll.

One machine out of three updated without the problem of module updates not working.

I cleared the update cache to no avail.

Marcos, got any ideas why this is happening with this update of PGP and did not with other updates ? SEE Images

Thanks.

[Marcos 3,121]

Please provide logs collected with ESET Log Collector. Just for a test, try disabling protected service and rebooting the machine and see if it makes a difference.

[Zardoc 3]

Here you go Marcos

eav_logs.zip

[Zardoc 3]

18 hours ago, Marcos said:

try disabling protected service and rebooting the machine and see if it makes a difference.

Nope.

[Zardoc 3]

Live grid also locked out. Here is another report.

I have to go back to regular service. This is my main machine.

eav_logs_Part2.zip

[Zardoc 3]

Marcos,

Any idea about the problem ?

Thanks.

[Marcos 3,121]

I see that PGPlsp.dll is registered as LSP in Winsock. Also you have Windows 10 installed where ekrn runs as a protected service by default.

We have recently found out that under unknown circumstances (probably after some Windows update), ESET gets removed from Winsock. Subsequently the system attempts to load a 3rd party dll into ekrn which obviously fails, causing Winsock initialization to fail as well.

What you can do is reinstall ESET so that it gets re-registered in Winsock.

[Zardoc 3]

On 8/16/2019 at 12:32 AM, Marcos said:

I see that PGPlsp.dll is registered as LSP in Winsock. Also you have Windows 10 installed where ekrn runs as a protected service by default.

We have recently found out that under unknown circumstances (probably after some Windows update), ESET gets removed from Winsock. Subsequently the system attempts to load a 3rd party dll into ekrn which obviously fails, causing Winsock initialization to fail as well.

What you can do is reinstall ESET so that it gets re-registered in Winsock.

Good call.

That's what I did initially.

Thanks.

[Marcos 3,121]

After installing ESET, please make sure that ekrn is registered under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\AppId_Catalog (should be in one of the subkeys). If I remember correctly, it was missing on your machine which is why erkn was unable to establish network communication.