Firewall issue on Windows 11 and EIS 15.0.18.0

[blacker61 0]

Hello.

After upgrading OS on one of my PCs to Windows 11 (with all the latest updates), i started experiencing the same issue described in the Topic by "Guest Drew" (everything was working fine in Windows 10 before the upgrade):

I've set the ESET Firewall in Interactive Mode (i prefer more control on network accesses) and, after a while after each reboot, Firewall stops displaying prompts and after that traffic is blocked for applications not already registered in the Firewall.

Using the Learning Mode "new" applications can set their own Firewall rule and i can see the notification on screen, but it's not what i need.

I've already tried to uninstall EIS both with standard "Add/Remove Programs" and using the ESET Removal Tool, with no luck.

Following instructions given by Marcos to "Guest Drew" in the topic above, i've:

1. launched an exe file that was not defined in Firewall (set to Interactive Mode), waiting for its response saying "blocked traffic to remote server"
2. created the dump file in EIS, from Advanced Setup -> Tools -> Diagnostics -> Create diagnostic dump ("Mini" dump type)
3. Collected the logs using the ESET Log Collector

Since the created zip file is too big to be attached here (>100 MB), how can i send it to you for analysis?

Please let me know, also if you need further info.

Many thanks in advance for your support.

 

 

[Marcos 5,074]

Please carry on as follows:
- enable advanced logging under Help and support -> Technical support
- launch an application that should trigger an interactive firewall dialog (provide the app name)
- disable logging
- create an ekrn dump by clicking Create under Tools -> Diagnostics in the advanced setup
- collect logs with ELC
- upload the generated archive to a safe location (e.g. OneDrive, Dropbox, etc.) and drop me a personal message with a download link.

[Drew 2 3]

blacker61,

Were you able to resolve this issue?

Drew

[blacker61 0]

Hi Marcos.

Today the issue with firewall seems not happening anymore (firewall prompts are now displaying).

I noticed that 3 modules have been updated in EIS in the last day ("Rapid Response module", "Detection Engine" and "Databases for advanced antispam module"): could it be related to this "self-resolution"?

I will contact you again if this happens again.

Thanks anyway for your support

[Marcos 5,074]

In case somebody is able to reproduce the issue, please carry on as follows:

1, Enable advanced network protection logging under Tools -> Diagnostics in the advanced setup when interactive firewall dialogs appear.
2, When interactive fw dialogs don't appear and the communication is blocked, stop logging.
3, Create an ekrn dump via Tools -> Diagnostics -> Create in the advanced setup.
4, Disable logging.
5. Collect logs with ESET Log Collector, upload the generated archive to a safe location and drop me a personal message with a download link.

[vortensis 0]

Got the same issue and its basically crippled my system, I have just undertaken my annual primary system's full system reload (From Windows 11, to Windows 10 21H2), and now after installing EIS (on 15.0.18.0) no firewall prompts are displayed on interactive mode and no internet access at all with it on automatic...

I've had to remove EIS entirely to post this, so I have two possible conclusions;

1) EIS 15.0.18.0 and Win 10 21H2 have some sort of compatability issue.
2) Eset dropped the ball on this release causing this issue.

I'm leaning towards 1) on the following basis;

System 2: Win 11, 21H2 - EIS 15.0.18.0 is working fine.
System 3: Win 10, 21H1 - EIS 15.0.18.0 is also working fine.

I'm going to give it a few days while I run a trial for another solution on the effected box and hope a fix is released...

[Marcos 5,074]

1 hour ago, vortensis said:

Got the same issue and its basically crippled my system, I have just undertaken my annual primary system's full system reload (From Windows 11, to Windows 10 21H2), and now after installing EIS (on 15.0.18.0) no firewall prompts are displayed on interactive mode and no internet access at all with it on automatic...

Please follow the instructions in my post above and help us pinpoint the issue.

[Drew 2 3]

6 hours ago, vortensis said:

Got the same issue and its basically crippled my system, I have just undertaken my annual primary system's full system reload (From Windows 11, to Windows 10 21H2), and now after installing EIS (on 15.0.18.0) no firewall prompts are displayed on interactive mode and no internet access at all with it on automatic...

I've had to remove EIS entirely to post this, so I have two possible conclusions;

1) EIS 15.0.18.0 and Win 10 21H2 have some sort of compatability issue.
2) Eset dropped the ball on this release causing this issue.

I'm leaning towards 1) on the following basis;

System 2: Win 11, 21H2 - EIS 15.0.18.0 is working fine.
System 3: Win 10, 21H1 - EIS 15.0.18.0 is also working fine.

I'm going to give it a few days while I run a trial for another solution on the effected box and hope a fix is released...

@vortensis I'll be interested to hear what you find.  I have another post going about this too.  But I'm Running Windows 10 21H1 with the firewall issue. 

[vortensis 0]

Thanks for the prompt reply, I reinstalled EIS today to run through the test requests, but I can't as its working as expected now (Firewall prompts on Interactive mode as expected and still running EIS 15.0.18.0), below will be what I have done differently on this occasion.

On 11/30/2021 at 9:19 AM, Marcos said:

Please follow the instructions in my post above and help us pinpoint the issue.

The only difference on this re-install was permanently deleting the "ESET" folders at the following locations;

C:\ProgramData\
C:\Users\vortensis\AppData\Local
C:\Users\vortensis\AppData\Roaming

I also cleared "C:\Windows\Temp" but suspect that was unrelated, rebooted then ran the EIS Live Installer I used previously.

I did not clear any registry entries.

Perhaps a corrupt file in one of these locations caused the issue? But at this point I can no longer re-produce the problem.
Perhaps someone else experiencing this problem can give these steps a go and confirm, after getting the logs for your investigation of course...