Jump to content
FadeMind

Do You want install Creative Audio Device Driver? DISABLE HIPS in ESET before.

Recommended Posts

Hi guys. I did not found similar topic, if exists - please link to them. Thanks.

ISSUE

ESET blocking installing external device driver setup Creative Sound Blaster in Windows 10 and system forcing using legacy generic driver here.

This issue meaning that application Sound Blaster for management audio devices did not find device (missing properitary driver from Creative Labs).

Bug error showing: `Operation Requires Interactive Windows Station (Code 28) Error`

And thats it.

WORKAROUND

Remove from system ESET product completly. Reboot.

Install Creative driver software and reboot for properly setup.

Driver will be installed fine. 

Install ESET product again. 

My setup:
ESET IS lastest.

Windows 10 build 20H1 10.0.19041.329

 

 

 

Share this post


Link to post
Share on other sites

Did you get any alert from ESET during installation of the driver? Would it be possible to try it with HIPS and real-time protection disabled, one at a time? Note that in order to disable HIPS, a computer restart will be needed.

Share this post


Link to post
Share on other sites
Posted (edited)

I did not have any prompt from ESET. Just find out that Creative app did not found device cause in use was generic Microsoft driver against installer driver. I disabled realtime protection - did not resolve issue. I did not touch anything else in ESET. Just found tip about uninstalling ESET app, and works. 

I installed just app + driver > https://support.creative.com/downloads/download.aspx?nDownloadId=100181

And thats it. Installer of this app after finish installing REQUIRED reboot PC, so disabling temporary HIPS/realtime in ESET did not work - after reboot setup trying install device and startup proper services in background BUT ESET blocking loading new  drivers (available now for device, but cannot to be in use against blocking). 

 

Edited by FadeMind

Share this post


Link to post
Share on other sites

So after disabling HIPS you rebooted the machine and then tried to install the driver and reproduce the issue?

Share this post


Link to post
Share on other sites
Posted (edited)

I did not TOUCH HIPS - only disabling realtime but it is useless, afer reboot all is ON and does nothing for end. Device cannot to be installed properly when ESET is in system. 

Edited by FadeMind

Share this post


Link to post
Share on other sites

Unfortunately we don't have a Creative device to reproduce it on our end. First of all it's necessary to narrow it down and confirm or deny if HIPS is somehow involved in the issue, then we can troubleshoot it further.

Share this post


Link to post
Share on other sites
1 minute ago, Marcos said:

HIPS is somehow involved in the issue, then we can troubleshoot it further.

Well, I can do this. 

Share this post


Link to post
Share on other sites
11 minutes ago, Marcos said:

HIPS is somehow involved in the issue, then we can troubleshoot it further.

Well, I can do this. 

 

@Marcos aaand HIPS mess up here. 

After disabling HIPS. Reboot. Disabling Realtime. Device driver is manually via Device Manager installed properly (after SEARCH proper driver for device task) and works well. 

Share this post


Link to post
Share on other sites

Ok, please try to reproduce it now with HIPS enabled and Self-defense disabled. Again, reboot the machine after changing HIPS and SD settings.

Share this post


Link to post
Share on other sites
3 minutes ago, Marcos said:

Ok, please try to reproduce it now with HIPS enabled and Self-defense disabled.

I done this before creating this thread and did not work. Selfdefense disabling is not enough. 

Share this post


Link to post
Share on other sites

Ok, then there are several more HIPS-based protection features that might affect the issue:
Deep Behavioral Inspection
Ransomware Shield
Advanced Memory Scanner
Exploit Blocker
Protected service

Are you able to reproduce the issue with HIPS enabled and all the above features disabled? Again, reboot the machine after disabling the above features.

Share this post


Link to post
Share on other sites
Posted (edited)
7 hours ago, Marcos said:

Are you able to reproduce the issue with HIPS enabled and all the above features disabled? Again, reboot the machine after disabling the above features.

Sorry for delayed reply (I went sleep night after my last post). 

OK, ONLY disabling HIPS globally (main trigger) and reboot works - allow installing driver. Any other scenario with disabling sub triggers you mention did not work and blocking driver install. 

NOTE: Scanner real time protection did not affect installation. It was active during install (HIPS disabled) and went fine. 

Edited by FadeMind

Share this post


Link to post
Share on other sites

With HIPS enabled, enable logging of all blocked operations in the advanced HIPS setup and reproduce the issue. Next disable logging, collect logs with ESET Log Collector and upload the generated archive here.

Share this post


Link to post
Share on other sites

It's really strange. All records with operations blocked by HIPS are related to Self-defense, however, you confirmed that disabling Self-defense and rebooting the machine didn't make any difference.

Try the following:
- clear the HIPS log
- disable all HIPS-based features including self-defense but keep HIPS enabled
- enable logging of blocked operations in the HIPS setup
- reboot the machine
- reproduce the issue
- check the HIPS log

Is the log really empty when the issue occurs?

Share this post


Link to post
Share on other sites

Only HIPS disabling globally does the job.

In system logs I have:

1. DELETE currently installed driver:

Device USB\VID_041E&PID_324D&MI_00\6&5D2ED46&0&0000 was deleted.
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}

2. Reboot after DELETING, HIPS enabled, trying install driver via Device Manager Update Driver Wizard and collect logs from ESET:

Device USB\VID_041E&PID_324D&MI_00\6&5d2ed46&0&0000 requires further installation.

3. Driver for device is recognized, download via WU and trying install with results:

Device USB\VID_041E&PID_324D&MI_00\6&5d2ed46&0&0000 was configured.

Driver Name: null
Class Guid: {00000000-0000-0000-0000-000000000000}
Driver Date: 
Driver Version: 
Driver Provider: 
Driver Section: 
Driver Rank: 0x0
Matching Device Id: 
Outranked Drivers: 
Device Updated: false
Parent Device: USB\VID_041E&PID_324D\00129690

Screenshot from wizard error (LANGUAGE = POLISH/POLSKI);

2yPvBnR.png

Scenario: ESET HIPS is disabled, reboot done (device is installed properly):

Usługa zarządzania sterownikami zakończyła proces dodawania usługi 
KsUSBa64 dla wystąpienia urządzenia o identyfikatorze 
USB\VID_041E&PID_324D&MI_00\6&5D2ED46&0&0000 z następującym stanem: 0.

6P5j8er.png

@Marcos

Share this post


Link to post
Share on other sites
57 minutes ago, Marcos said:

Is the log really empty when the issue occurs?

Yes.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...