"Buy License" Your Computer is not protected. Its must be a bug.

[Mr_Frog 14]

I think this is a very annoying problem. This always appears when turning on the computer and opening ESET Gui. I installed from version 16.0.24, not the upgrade version. I'm sure it must be a bug.

[itman 1,659]

11 hours ago, Mr_Frog said:

This always appears when turning on the computer and opening ESET Gui. I installed from version 16.0.24, not the upgrade version. I'm sure it must be a bug.

Appears your device can't connect to LiveGrid servers. Since someone else from Indonesia recently posted the same issue, there might be connectivity problems from there to Eset LiveGrid servers.

It also appears you haven't activated your Eset license. There might also be connectivity issues reaching Eset product activation servers.

[mma64 7]

sorry, @itman, if this user's license is activated which I think it is, then it is a bug or whatever ESET might call it. The very same thing happens on my computer each time I start it, ie. daily. And yes, my license is activated. This happens since EIS V16.0.24 and not the first V16.x version! I'm pretty sure about this.

But with a little twist: entering the EGUI this warning message disappears (after about 5 seconds) and the license seems to be activated...

And yet another twist: I'm having a HIPS rule that fires quite often and is defined with "notification popup?" = yes. Looking at these notifications appearing in bunches at time, one or more of them appear with the warning info in the 3rd screenshot above!!!

Ie. HIPS notification popups #1 - 3 without the warning, one with, another bunch without, one with etc (!!!) (*)

This is quite irritating and perhaps even dangerous: hasn't ESET decided to cease protection completely if license is expired or not activated quite some version prior to V16?!?

(*= I'm able to make a video of this, ESET!... And everybody can test it, for example with a firewall rule on any browser and then doing some web surfing (allowing ports 80 and 443, TCP and UDP)...)

HTH

[Marcos 5,070]

2 hours ago, mma64 said:

The very same thing happens on my computer each time I start it, ie. daily. And yes, my license is activated.

I confirm that you have purchased a license and it's still valid until Nov 2024. If you are able to reproduce the notification about LiveGrid inaccessibility, please carry on as follows:

1. Enable advanced logging under Help and support -> Technical support
2. Reboot the machine and reproduce the issue
3. Stop logging
4. Collect logs with ESET Log Collector and upload the generated archive here.

 

2 hours ago, mma64 said:

And yet another twist: I'm having a HIPS rule that fires quite often and is defined with "notification popup?" = yes. Looking at these notifications appearing in bunches at time, one or more of them appear with the warning info in the 3rd screenshot above!!!

We'll first check your product configuration when you provide ELC logs requested above and then decide about further steps if nothing obvious is found. In the mean time, you can prepare a video demonstrating the with HIPS or firewall.

Please create a new topic for each issue then so as not to mix various issues in someone else's topic.

[itman 1,659]

3 hours ago, mma64 said:

The very same thing happens on my computer each time I start it, ie. daily. And yes, my license is activated. This happens since EIS V16.0.24 and not the first V16.x version! I'm pretty sure about this.

But with a little twist: entering the EGUI this warning message disappears (after about 5 seconds) and the license seems to be activated...

When Eset starts "flaking off" like this, I always uninstall/reinstall Eset which in 99% of the cases, resolves the issue.

[Mr_Frog 14]

3 hours ago, Marcos said:

I confirm that you have purchased a license and it's still valid until Nov 2024.

So @Marcos do you think I have't purchase a license and ignoring what I post at the first LOL.  

Here is my license information and im gonna update this post:

[Mr_Frog 14]

14 hours ago, itman said:

It also appears you haven't activated your Eset license.

That is not true. I activated this device on 11/12/2022. usually an error like this appears when turning on the computer and opening the ESET gui. This error only appears for a few moments and about 2-5 seconds then disappears and ESET looks normal again, but on 01/05/2023 this error appeared for around 60 seconds. If you take a closer look at the screenshots I took, you'll notice there is an anomaly. The ESET Database Engine Notification has been successfully updated but its ridiculous to see the information underneath in red, "Buy License" your computer is not protected. Shouldn't you be unable to update the database engine if the product hasn't been activated, but I don't want to debate the activation issue because actually it has been activated since 11/12/2022.

I have been noticing this error since installing version 16.0.24. Usually this error only appears the first time you open the GUI after the computer is turned on and for a very brief period, but it will be seen more often if the firewall and HIPS settings are set to interactive mode. Pop ups will often look like the third screenshot at the start of my post.

Regarding not connecting to ESET LiveGrid, whether this has anything to do with the activation status, someone from ESET seems like have to confirm about this.

The device and OS where ESET is installed can also be said to be quite new.  Processor is Intel Core i5 11600K with 8GB RAM and SSD Drive.  The OS is Win 10 22H2 64bit and was just installed a few months ago together with ESET.  You can see the information here: 
https://mega.nz/file/30MhiBIS#XbtubH2wbB-bHD6QzyL_WsrnZyuFq8vsjETkDoOVprU

Bonus for you @Marcos: 
My Personal license: 3AR-PFS-VCK, 33D-H6D-TAD
For my work invironment: 3AR-TBB-5BH, 3AR-TBC-MKC, 3AS-UJS-KRF

LMAO!!!

 

 

Another bonus for video recording:
https://mega.nz/file/TkFAXCLB#vKcD7onQpYdd5SzEugBcsRJyrVlj-V_yHkjxqlGI1fw

 

6 hours ago, itman said:

When Eset starts "flaking off" like this, I always uninstall/reinstall Eset which in 99% of the cases, resolves the issue.

I thing for now this is not a good idea. I chose to let the ESET team to find whats wrong about this.  Im pretty sure there are many users affected, but their not give information here or not report to ESET and I believe this is clearly problem on the ESET side. 


Cheers!!!

Edited January 6, 2023 by Mr_Frog

[Marcos 5,070]

4 hours ago, Mr_Frog said:

So @Marcos do you think I have't purchase a license and ignoring what I post at the first LOL. 

Please check my reply above and notice that I was responding to mma64, not to you.

Please provide logs collected with ESET Log Collector from the machine where "Buy license" is displayed despite the product being already activated.

As for the LiveGrid notification, please follow the instructions in my previous post and generate advanced logs during a computer start when the notification pops up and then collect them with ELC.

[mma64 7]

@Mr_Frog: be patient, you're not the only one with this problem.

11 hours ago, Mr_Frog said:

I have been noticing this error since installing version 16.0.24. Usually this error only appears the first time you open the GUI after the computer is turned on and for a very brief period, but it will be seen more often if the firewall and HIPS settings are set to interactive mode. Pop ups will often look like the third screenshot at the start of my post.

@Marcos: I couldn't say it any better, that's it! Ie. whether its a notification popup or a new popup, be it HIPS or the firewall, from time to time there will be this nasty "buy a license..." warning in red (see 3rd screenshot from top)! Thus it seems I'm in the right thread / topic...

11 hours ago, Mr_Frog said:

Regarding not connecting to ESET LiveGrid, whether this has anything to do with the activation status, someone from ESET seems like have to confirm about this.

@Marcos(/ESET): indeed, only ESET can tell us whether ESET LiveGrid has anything to do with the license activation checking. I have LiveGrid disabled. But I doubt it very much that a disabled LiveGrid has anything to do with this! (Remember the "I have been noticing this behaviour since EIS V16.0.24"?!)

The good thing: I have the promised video showing once and for all that this bug (/whatever ESET may call it) exists really! Stay tuned, now I have to buy some bread first.

[mma64 7]

I'm sorry for the long delay, here is the promised video, you can download it here: hxxp://mprogger.selfhost.ch:8080/hab-dich-ESET.wmv

the video, ~15 minutes:
- ~01:00 (mm:ss) first "buy license" in HIPS notifications cascade. I was able to repeat this "PerfectDisk START / CLOSE -> HIPS notifications cascade with 'buy license' warning (on the 1st notification popup)" cycle on each continuous trial. Somewhat strange: I'm quite sure having seen "buy license" appearing not only on the very 1st notification popup, but in between too, before doing this test video. Now I'm unsure about it.
- ~02:18 the same thing starts in a few seconds, easily reproduced (always starting and closing PerfectDisk Pro, a disk fragmentation tool)
- 04:39 now it's time to CLOSE and START the ESET EIS GUI, to see what's happening...
- 05:37 crazy, already the first EIS GUI START showing "buy license" shortly!
- 06:33 what's going on here? The second time! (Please take the full run, at least 05:37 to 06:33+) In between (~06:00) all I do is waiting before the next EIS GUI START (!!!) and bamm, the next "buy license"!)
- now I'm trying to "mix" PerfectDisk START / CLOSE and EGUI START / CLOSE, ~08:38 the next EIS GUI "buy license"
- hm, somewhere between 12:00 and the end I'm more than sure I saw a starting HIPS notification cascade where the first had "buy license" and a EIS GUI START showed the same "buy license", but this seems uncaptured?!? The latter disappeared always very quickly, presumably too quickly to be captured behind the dark HIPS notification popup. This was the time to stop capturing because everything was captured.
 

Video downloadable until ~05.00, now it's 01.18 CET. Otherwise from ~15.00 - ~05.00 on this tuesday.

 

On 1/5/2023 at 9:31 PM, Marcos said:

We'll first check your product configuration when you provide ESET Log Collector logs requested above and then decide about further steps if nothing obvious is found.

I'll deliver these logs, but I guarantee you that you (ESET) will find nothing special, as it was the case last time with the HIPS Duplicates Popup Bug and these logs! There are some more boring HIPS and firewall rules - that's it...

(hm, link icon in forum editor not working, pasting URL lead to 'hxxp://...'. What's going on here???)

[Marcos 5,070]

mprogger.selfhost.ch doesn't open for me, please try to use a different file sharing service, such as OneDrive, Dropbox, etc.

Also please provide logs collected with ESET Log Collector.

[Marcos 5,070]

If the setup window is empty or if the "Buy now" button appears in desktop notifications, please carry on as follows:

1, Create a full dump of ekrn.exe by clicking Create in the advanced setup -> Tools -> Diagnostics

2, Collect logs with ESET Log Collector

3, Add the content of the "C:\ProgramData\ESET\ESET Security\License" folder to the archive.

4, Upload the generated archive here or to a file sharing service and drop me a private message with a download link.

[itman 1,659]

16 hours ago, mma64 said:

~01:00 (mm:ss) first "buy license" in HIPS notifications cascade. I was able to repeat this "PerfectDisk START / CLOSE -> HIPS notifications cascade with 'buy license' warning (on the 1st notification popup)" cycle on each continuous trial.

Hum.........

Have you tried to exclude PerfectDisk executable and/or other related processes from Eset HIPS Deep Behavior Inspection processing?

Considering that PerfectDisk is an advanced disk de-fragmentation utility, it is performing low level disk access activities that Eset HIPS DBI processing might find suspicious.

-EDIT-

I viewed the video.

You need to create an Eset HIPS rule to allow PerfectDisk software all file access. Before you proceed, be aware that allowing this access will allow the utility to do anything it wishes to files on your hard drive/s w/o any intervention from Eset.

Add an Eset HIPS rule as follows:

First screen;

Rule name - Allow PerfectDisk File Operations

Action - Allow

Operations affecting

Target files - enable the setting

Mouse click on the Next button

Next screen - Source applications

Add the following full path name or navigate to it by mouse clicking on ...

C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe

Mouse click on the OK button

Mouse click on the Next button

Next screen - File Operations

Enable All file operations setting

Mouse click on the Next button

Next screen - Target files

Change Specific files setting to All Files

Mouse click on the Finish button

Mouse click on OK button and any subsequent OK button that appears to save your HIPS changes.

Disclaimer: I take no personal responsibility in the above recommendation from PerfectDisk software performing malicious activities on your device.

Edited January 10, 2023 by itman

[mma64 7]

2 hours ago, itman said:

You need to create an Eset HIPS rule to allow PerfectDisk software all file access.

dear 'itman', thanks for looking at my video. This HIPS rule already exists ("allow direct access, [ALL activities]"), PerfectDisk is a commercial defrag tool by Raxco, thus there will happen no malware activity by it for sure. It's exactly this HIPS rule with its cascading HIPS notification popups that showed me something weird is happening in EIS V16.0.24! (The longer version: I made a "allow direct access, [ALL]" version of it because of another EIS HIPS bug introduced in EIS V16.0.24. And disabled a bunch of (very old) HIPS rules regarding PerfectDisk and "allow direct access, specific #1, #2, #3 etc". More about this one in another thread coming soon.)

In short: PerfectDisk is working well since many years and many, many ESET ESS / EIS versions! Now there's this weird "buy license" "nonsense" bug. And this for the first time mentioned new HIPS bug, similar in a way to the (very old) HIPS Duplicates Bug (which is fixed) but definitely not the same.

 

[mma64 7]

12 hours ago, Marcos said:

mprogger.selfhost.ch doesn't open for me, please try to use a different file sharing service

@Marcos/ ESET: this domain is working, I have tried it, directly from this topic. Apart from my successful trial my logs are showing me two more successful downloads (not from me) until now:

63.247.xxx.xxx  - - [10/Jan/2023:14:12:37 +0100] "GET /hab-dich-ESET.wmv HTTP/1.1" 200 16849217
162.226.xxx.xxx - - [10/Jan/2023:17:23:29 +0100] "GET /hab-dich-ESET.wmv HTTP/1.1" 200 16849217
 

17 hours ago, mma64 said:

Video downloadable until ~05.00, now it's 01.18 CET. Otherwise from ~15.00 - ~05.00 on this tuesday.

looking at the automatically created forum mails (your 1st post), "Tue, 10 Jan 2023 07:10:57 +0100" it's clear that you tried it after 05.00 CET. But I saw at around the same time, 05.00 CET today, that you were logged in. (PC shutdown was ~05.30 CET.)

Now it's 19.31 CET in Switzerland. Please try it again. Eventually I will not shutdown my PC on wednesday ~05.00 CET.

[Marcos 5,070]

I've watched the video, installed PerfectDisk, created a HIPS rule that notifies the user upon direct disk access and ran PerfectDisk. Several dozens of desktop notifications popped up, closed them all by clicking X but could not reproduce the issue. The "Buy license" button never appeared and the protection status remained green. Tested on Windows 10 22H2.

Please follow the instructions in my previous post.

[itman 1,659]

2 hours ago, mma64 said:

dear 'itman', thanks for looking at my video. This HIPS rule already exists ("allow direct access, [ALL activities]"),

If the rule already existed, you should not be receiving Eset HIPS alerts for C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe .

-EDIT- Another explanation is Eset HIPS is ignoring the rule for some unknown reason. I do know that Eset's built-in hidden rules will override user rules. This is what may be occurring here.

I also believe just allowing low level disk access is not enough permission to allow this software to run w/o conflict. This is why I stated in my posted HIPS rule to allow all file access.

Edited January 10, 2023 by itman

[mma64 7]

4 hours ago, itman said:

If the rule already existed, you should not be receiving Eset HIPS alerts

This HIPS rule is "allow direct access, [ALL activities], notify=yes, log=yes", ie. it's goal is to log exactly these activities and, since a few weeks, notify it to me at the same time. Ie. it's working perfectly as it should, except the "buy license" bug, mostly on the first notification of this event, followed by a whole bunch of similar notifications w/o "buy license".

4 hours ago, itman said:

I also believe just allowing low level disk access is not enough permission to allow this software to run w/o conflict.

In HIPS interactive mode every "suspect", "suspicious" activity, seen from the AV software side, will generate a popup where you can decide what to do with it. Thus all PerfectDisk activity is stored in HIPS rules since many years.

 

@Marcos/ESET too: Only because of this notify=yes I noticed the "buy license" bug (in notification popups, be it HIPS (100%) or firewall (not quite sure, but I assume it) at all. Which lead to my further investigations on this matter. (Ie. if you have no (HIPS) notifications cascade, you will never notice that there's this new bug.)

And I changed to notify=yes only because of the above mentioned new HIPS Duplicates Bug, similar to the very old and fixed one.

@Marcos/ESET too: Otherwise there's only "buy new license" once for about 5 seconds when opening the ESET GUI after PC start - a thing one can live with, I thought, until I had to detect the same red warning in notification popups!... Over and over again, fully reproducible (-> the video), I could have been doing the above mentioned flow forever, every time with the exact same result. This flow is the key to reproduce this bug. The 2nd key: start your PC from total shutdown, don't wait for HDD (/SSD) activity calming down totally, open ESET GUI - is "buy license" appearing shortly? Then you're on the right way. Close ESET GUI, wait ~4 minutes, doing nothing else. Reopen ESET GUI - "buy license" appearing shortly. Superb, you have a PC showing this bug! (This doesn't work always, but a lot of times (-> video, but not captured fast enough unfortunately)). Do the PerfectDisk OPEN/CLOSE thing with the ESET GUI closed, this "forces" the "buy license" in HIPS notification popups with more probability. (The 3rd key could be a HDD instead of a SSD: (my thought) "my PC start eats several minutes, that's the reason for the "buy license" when starting the EIS GUI?! This would certainly not happen with a speedy SSD."))

[mma64 7]

11 hours ago, Marcos said:

If the setup window is empty or if the "Buy now" button appears in desktop notifications

hm, I have no "empty setup window(s)" and with "buy now" do you mean "{button}buy license - Your computer is not protected"? (->video @00:54)?!

I'll do this stuff, but will it work? Ie. it's 100% impossible (for anyone) to catch the very moment "buy license" appears in the 1st HIPS notification of this bunch of a lot of others. And, as you (/ESET) have seen, it's mostly and eventually only in the very 1st one appearing. Would an 'ekrn.exe' memory dump not store the process state of the 2nd+ notification, the ones with "good license"?!...

[Mr_Frog 14]

I don't believe this is related to the PerfectDisk app. On my computer I don't have this app and the same problem occurs. Two days ago on sunday, I also found this problem on my laptop. I just installed the OS from this laptop and the applications I installed is only Counter Strike 1.6 and ESET, nothing else. I use the laptop only to play CS online. Yes, the Windows I installed is Windows 7. The reason I installed Windows 7 is because the device was old enough and I also didn't use it for anything other than CS online. The trigger for this "bug" to appear is when I plug in my flaskdisk and the ESET Scan pop up notification appears in the lower right corner and surprise!!! red "Buy License" Your computer is not protected is below the pop up notification. Its appear for very brief period and then ESET look normal again. I have now found this "silliness" on two of my devices. Its getting clearer and more convincing that this must have many users affected.

My laptop is HP Probook 440 G2. There have been no changes or additions to this device since I bought it in 2014 until now. The LiveGrid Feedback System and Reputation System were turned on and there is no connection problems since the first time I installed ESET.

Ones again, maybe one of us skipped this stuff: https://mega.nz/file/TkFAXCLB#vKcD7onQpYdd5SzEugBcsRJyrVlj-V_yHkjxqlGI1fw

 

Cheers!!! @mma64

[mma64 7]

1 hour ago, Mr_Frog said:

I don't believe this is related to the PerfectDisk app.

@Mr_FrogThis "buy license" bug has nothing to do with any program but ESET EIS. Be it a real bug (EIS effectively (")forgetting(") that there is a valid, activated license (for a short time) and then "rethinking" (/revalidating and correcting) its error), or be it an issue, ie. EIS "thinking" there is no license, but in reality the valid and activated license is always there and ON, as it should be. (Now developer speak) the latter could be as banal as taking the wrong variable in the notification popup source code, instead of for example the boolean 'isLicenseValid' some other boolean. (Boolean: can be true or false only.))

The more notification popups an EIS V16.0.24 user has, the higher the probability that he/she will notice this "buy license" red warning in some notifications displayed. Especially if the EIS GUI was not open at that time, ie. closed - this is the key factor, increasing the probability of the added red warning in notifications.

With my HIPS rule "allow direct access, all activities, log=yes and now even notify=yes" for PerfectDisk, this program is generating ~8000 (!) notifications in 2 to 3 hours, if I leave the program open. Which is not the case generally. Ie. PC start, PerfectDisk START, PerfectDisk CLOSE. Now the SMART values, temperature etc are "recorded". And before PC shutdown PerfectDisk START and checking the values.

Thus now we have 3 PCs showing this behaviour, 1x Win10, 2x Win7... Who's next? Anyone else?

[Marcos 5,070]

A related bug has already been fixed. The fix will be included in v16.1.5 beta which we'll make available for you next week after it has passed QA tests.