Interactive Firewall Pop-up Gone Before I Can Click On It

[peteyt 393]

6 hours ago, 819b6ca said:

Well, have downloaded the "tool," saved instructions as .pdf, and am ready to reboot.

One thing to note: when I started having this particular issue, some two weeks ago, I had not undertaken any type of un/installation of eset.  Overall I'm not aware of anything I did that precipitated the current issue.

Curious....

Just make sure you do it in safe mode 

[819b6ca 0]

3 hours ago, peteyt said:

Just make sure you do it in safe mode 

Done; still having the issue.

Thanks.

[itman 1,659]

I just tried to duplicate this rapidly closing firewall alert behavior in Interactive mode on Win 10 x(64) 1903. No such behavior on my EIS installation. My current alert timeout period is set to 120 (secs.).

Now, I do have a number of user created firewall rules in addition to Eset's default ones. I also don't believe this would have any bearing on how long firewall alerts would display in Interactive mode.

[peteyt 393]

22 hours ago, 819b6ca said:

Done; still having the issue.

Thanks.

One idea is maybe using a screen recording program and sharing a video of it occurring on here

[819b6ca 0]

1 hour ago, peteyt said:

One idea is maybe using a screen recording program and sharing a video of it occurring on here

Well, good idea.  So here it is.

(Note: I originally started posting this same information about 20 minutes ago.  When I went to "Submit Reply," I suddenly couldn't connect to this forum as the ESET Firewall had blocked Firefox traffic...when it had allowed it 20 minutes earlier.  Strange.)

 Anyway, I've uploaded a .zip file as .mp4 files are not allowed.  I'll give a quick set-up of what I'm doing.

There are three windows in the video.  You'll see that I first enable the ESET Firewall.  I then go over to a program (EULAlyzer) and drag the " + " sign to the ESET EULA.  I click "Analyze" in EULAlyzer and then "Submit Online."  EULAlyzer's attempt to get online is stopped by ESET (this is good), and you can see two ESET prompts quickly appear and then disappear, being on-screen for less than 3 seconds.

Note that on-screen prompts for local traffic stay up substantially longer, at least long enough for me to understand what's going on and then respond.  Not so with internet traffic (except occasionally for DNS requests, unlike what happened in the video).

Firewall1.zip

Edited August 25, 2019 by 819b6ca

[itman 1,659]

I will say I did notice some unusual behavior with FireFox when testing with the Eset firewall in Interactive mode. I was receiving an alert for every outbound TCP connection being made. In most firewalls once you allow the app to connect, all further outbound activity is allowed.

[itman 1,659]

1 hour ago, 819b6ca said:

 Anyway, I've uploaded a .zip file as .mp4 files are not allowed. 

No one can view forum attachments other than Eset moderators. I suggest you upload it to a file sharing web site so the rest of us can view it.

[819b6ca 0]

30 minutes ago, itman said:

No one can view forum attachments other than Eset moderators. I suggest you upload it to a file sharing web site so the rest of us can view it.

Ahhh...well then.

I posted this particular video, adding one more which is a close-up view of the ESET firewall window, on my Mega account.  The link is https://mega.nz/#F!ro0WhKQT!ULwsLpOr1H4gp3WgJRgdZQ.

[itman 1,659]

11 minutes ago, 819b6ca said:

I posted this particular video, adding one more which is a close-up view of the ESET firewall window, on my Mega account.  The link is https://mega.nz/#F!ro0WhKQT!ULwsLpOr1H4gp3WgJRgdZQ.

This type of behavior would lead me to believe that there is an existing Eset non-default firewall rule in place that is allowing all outbound network traffic. The rule additionally has the alert option enabled for it.

[819b6ca 0]

8 minutes ago, itman said:

This type of behavior would lead me to believe that there is an existing Eset non-default firewall rule in place that is allowing all outbound network traffic. The rule additionally has the alert option enabled for it.

Ok...so I would look in the Advanced Setup | Advanced |Rules | Edit, where I have, on numerous occasions, deleted all existing rules and started over.  Should I be looking elsewhere?

[819b6ca 0]

Having once again deleted all the rules, I am presented with multiple "access requested" pop-ups, most of which disappear long before I can click on a button.  Like I said previously, the requests for local access stay on-screen longer than requests for internet access, as do DNS requests.

Oh, and Firewall is in "Interactive" mode.

Tx

Edited August 25, 2019 by 819b6ca

[itman 1,659]

Another possibility is the Windows Firewall was not properly disabled when Eset was installed. If it is active in addition to the Eset firewall, anything can happen.

Since you are running Win 7, open Control panel -> System and Security -> Windows Firewall. What should be displayed is similar to the below screen shot. That is, Eset is managing the Window Firewall:

[819b6ca 0]

3 hours ago, itman said:

Another possibility is the Windows Firewall was not properly disabled when Eset was installed. If it is active in addition to the Eset firewall, anything can happen.

Since you are running Win 7, open Control panel -> System and Security -> Windows Firewall. What should be displayed is similar to the below screen shot. That is, Eset is managing the Window Firewall:

Uninstalled eset (using separate program and in Safe Mode); rebooted; ensured Windows Firewall was operational and fully standardized and then disabled it...rebooted; reinstalled eset allowing for a full scan (2.5 hours); rebooted; still having issue.

[itman 1,659]

18 minutes ago, 819b6ca said:

ensured Windows Firewall was operational and fully standardized and then disabled it.

No.

You should never disable the Win firewall by manual means; disabling its service, etc.. Eset at install time will configure it property to disable the necessary parts of it. Note that the Eset firewall will use the core components of the Win firewall. Hence, the "managed" reference.

[819b6ca 0]

33 minutes ago, itman said:

No.

You should never disable the Win firewall by manual means; disabling its service, etc.. Eset at install time will configure it property to disable the necessary parts of it. Note that the Eset firewall will use the core components of the Win firewall. Hence, the "managed" reference.

So what do you suggest?  Windows Firewall states that "(t)hese settings are being managed by vendor application ESET Internet Security."

Edited August 25, 2019 by 819b6ca

[itman 1,659]

1 hour ago, 819b6ca said:

Windows Firewall states that "(t)hese settings are being managed by vendor application ESET Internet Security."

Good. Just make sure you haven't disabled the Win firewall service.

At this point, I am clueless as to what is causing your Eset alert issue. Only thing I can think of is deleting all created user rules leaving only the Eset default ones; i.e. set the firewall settings to default settings by doing a Revert to default settings. Then switch the Eset firewall to Learning mode for a while to create rules for system processes and your apps. This can be sped up my performing a cold boot. Then opening up all your Internet use apps. Also force a Win Update check. Finally, switch back to Interactive mode and see if the issue has been resolved.

Note: there is always a risk when when employing either firewall or HIPS learning mode. If there is some resident malware, it's actions will be auto allowed.

Personally, I would just set the Eset firewall to its default Automatic mode which will allow all outbound traffic and be done with it. You can always create manual rules for select processes you feel outbound traffic should be monitored.

[819b6ca 0]

2 minutes ago, itman said:

Good. Just make sure you haven't disabled the Win firewall service.

At this point, I am clueless as to what is causing your Eset alert issue. Only thing I can think of is deleting all created user rules leaving only the Eset default ones; i.e. set the firewall settings to default settings by doing a Revert to default settings. Then switch the Eset firewall to Learning mode for a while to create rules for system processes and your apps. This can be sped up my performing a cold boot. Then opening up all your Internet use apps. Also force a Win Update check. Finally, switch back to Interactive mode and see if the issue has been resolved.

Note: there is always a risk when when employing either firewall or HIPS learning mode. If there is some resident malware, it's actions will be auto allowed.

Personally, I would just set the Eset firewall to its default Automatic mode which will allow all outbound traffic and be done with it. You can always create manual rules for select processes you feel outbound traffic should be monitored.

Thanks for your patient assistance.  I hope to have a good conversation tomorrow with eset Tech Support.

[itman 1,659]

One additional comment I forgot to make.

Eset firewall rules are executed in top to bottom rule precedence; this was not always the case in earlier Eset versions. New rules are always added at the bottom of the existing rule set. As such, it is entirely possible a rule with higher precedence could be overriding or negating the activities of a lower precedence rule. In other words, firewall rules created in Interactive mode must be constantly reviewed in regards to the above actions. Another reason to keep the firewall in its default Automatic mode.

[819b6ca 0]

I think my issue may lie with the Windows Firewall.  In running the "Windows Firewall Troubleshooter," it indicates that "Remote Assistance is enabled but blocked by Windows Firewall."  Actually, RA is NOT enabled, but it IS blocked by the Windows Firewall.  That's the only issue the troubleshooter revealed.

So confusing....

[819b6ca 0]

I tell Windows Firewall to block both inbound and outbound connection attempts, and to alert me when it does block a program.  Tried three different programs to connect, all blocked, and not a peep from the Firewall.

[itman 1,659]

12 hours ago, 819b6ca said:

I tell Windows Firewall to block both inbound and outbound connection attempts, and to alert me when it does block a program.  Tried three different programs to connect, all blocked, and not a peep from the Firewall.

When Eset is installed, it overrides all Win inbound and outbound firewall processing. The only exception is Win inbound rules as long as that option remains enabled in the Eset firewall settings. As such, you will not receive any alerts from the Win firewall for outbound traffic regardless of the outbound monitoring setting. Pertaining to existing Win inbound firewall rules, only the existing allow rules are used. Any blocked inbound traffic will be handled by the Eset firewall and reflected by Eset alert.

Edited August 26, 2019 by itman

[peteyt 393]

15 hours ago, 819b6ca said:

Thanks for your patient assistance.  I hope to have a good conversation tomorrow with eset Tech Support.

This will probably be the best way as support on here is limited

[819b6ca 0]

At this point, not having yet had a conversation with eset Tech Support, I have uninstalled Internet Security.  I have installed a separate firewall, which appears to be working very well, and intend to install eset antivirus, and then ask eset about how my existing license will apply differently, if at all, using only the antivirus solution.

This really sucks, though.  I have loved eset and am just disappointed by this situation.  Of course, I have no way to know what programs/processes are to blame for this change.  Perhaps Tech Support has some insights -- or maybe it's a not-widely-known issue -- as to a remedy.

Thanks again to everyone for your assistance.

[itman 1,659]

You can downgrade to NOD32 w/o issue.

Again, I could not duplicate this issue using EIS on Win 10. As such, I can only assume it has something to do with your Win 7 installation.

[itman 1,659]

One thing that is unclear from the above postings. Did you set the setting shown in the below screen shot to 120?

Edited August 26, 2019 by itman