Downgrade to 7 possible? Interactive Firewall in 8 Broken

[ApophisXP 0]

Hi there, wondering if anyone can help on this.

 

Been using ESS for a while now and stuck with it for the interactive firewall mainly.

 

With the current update however, I get no notification of a new program trying to gain access. If I kill Eset via Task Manager and reinitiate it I get the pop ups for Outbound traffic.

 

On selecting remember and allow. Nothing happens. Even if I select a temporary rule it wont do.

 

Clicking show advanced options does nothing either.

 

If I kill every Outbound notification window manually via Task Manager and reinitiate again, when selecting to disable the firewall for X amount of minutes or even until next restart I get the outbound window popup again with no way to progress.

 

I cant even get into the advanced settings to change interactive mode to automatic as everytime I click on the button, nothing happens.

 

 

Update 27/11/2014

 

We'll need to get the following stuff for analysis:
1. ESI log.
2. Full memory dump from the situation when the issue occurs.
3. The registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BUildLabEx.

 

 

 

Excuse me for the silly question. But where I can find esi loq and how I can take a memory dump? As soon as I get home I will post them.

 

How do I create a SysInspector log and submit it to ESET?

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN2219&actp=search&viewlocale=en_US&searchid=1417013927329

 

You only need to look at the screenshots about how to create the esi log but you don't need to download it as you can use the version of ESET SysInspector that is included in the product.

 

How do I generate a memory dump manually?

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN380&actp=search&viewlocale=en_US&searchid=1417013878790

 

HTH, SweX

 

 

Those who are experiencing the issue and are willing to test a new HIPS module to find out if the fix we've made solves the issue (an ESET binary was excluded from self-defense), drop me a pm for further instructions.

Edited November 27, 2014 by ApophisXP

[Marcos 5,452]

Please provide information about your operating system and installed ESET modules (from the About window). The issue described used to occur with older builds of v7 and was fixed in later releases as well as in v8. Do you use multiple accounts on the computer and switch between users? Do you connect to the computer remotely as well?

[ApophisXP 0]

Please provide information about your operating system and installed ESET modules (from the About window). The issue described used to occur with older builds of v7 and was fixed in later releases as well as in v8. Do you use multiple accounts on the computer and switch between users? Do you connect to the computer remotely as well?

 

Windows 8.1 x64 - Single Login / Account and regarding remote access not on this pc no.

 

hxxp://i.imgur.com/ghk9qVu.jpg

[kanedagr 1]

I have a particular problem. I choose interactive mode for the firewall. I update smart security from version 7 to version 8.0.301.0. For sometime it worked great. But today all of a sudden when it displays the pop up windows "outbound traffic" or "incoming traffic" and i check "remember the rule" and pressing "Allow" it says " Failed to Change Settings". Windows pops up a window and i press "Yes" (so it  can run with administrator privileges). I uninstalled it, run ccleaner, reboot the PC, installed it again. Everything worked fine like 5 rules only. After that, it keeps not letting me create rules.

 

 

Edit: I removed version 8 and i installed the latest of the 7th version and it works like it should be. Anyway, when i later 8th version will emerge, i will try again.

2nd Edit: The same today with 7th version!

Edited November 25, 2014 by kanedagr

[JoeEimer 0]

Same problem's here. Windows 8.1 x64 - Single Login  and not remote, too. 

Have to use Razer Synapse, as I in another thread read this could be the problem. 

Have it with Version 7 also. 

[kanedagr 1]

At last, i found out what the problem is! It doesn't matter what version of smart security you have. The problem resides at some module. When you first install the latest version of smart security (8.0.304.0) the virus signatures is 10493. When updating to virus signature 10779 then the problem starts. After the update is installed you cannot create rules. So what i did, was to not allow smart security to update anything. Now i have the following installed:

Virus Siganture Database: 10493

Rapid Response module: 4818

Update module: 1052

Antivirus and antispyware scanner module: 1438

Advanced heuristics module: 1153

Archive support module: 1209

Cleaner module: 1100

Anti-Stealth support module: 1060

Personal Firewall module: 1228B

Antispam module: 1027

ESET SysInspector module: 1243

Real-time file system protection module: 1009

Translation support module: 1264

HIPS support module: 1148

Internet protection module: 1145B

Web content filter module: 1036

Advanced antispam module: 1870

Database module: 1060

 

And everything works fine (until now, hehe!!) Anyway, the solution is to unistall smart security, reboot, install the latest version and don't let it update. Until someone reply here and says that they fixed it in a later update. I repeat the 10779 update and its modules are causing the problem i am stating above. Hope this helps!

[ApophisXP 0]

At last, i found out what the problem is! It doesn't matter what version of smart security you have. The problem resides at some module. When you first install the latest version of smart security (8.0.304.0) the virus signatures is 10493. When updating to virus signature 10779 then the problem starts. After the update is installed you cannot create rules. So what i did, was to not allow smart security to update anything. Now i have the following installed:

Virus Siganture Database: 10493

Rapid Response module: 4818

Update module: 1052

Antivirus and antispyware scanner module: 1438

Advanced heuristics module: 1153

Archive support module: 1209

Cleaner module: 1100

Anti-Stealth support module: 1060

Personal Firewall module: 1228B

Antispam module: 1027

ESET SysInspector module: 1243

Real-time file system protection module: 1009

Translation support module: 1264

HIPS support module: 1148

Internet protection module: 1145B

Web content filter module: 1036

Advanced antispam module: 1870

Database module: 1060

 

And everything works fine (until now, hehe!!) Anyway, the solution is to unistall smart security, reboot, install the latest version and don't let it update. Until someone reply here and says that they fixed it in a later update. I repeat the 10779 update and its modules are causing the problem i am stating above. Hope this helps!

 

Wonder whos going to accept fault lol

 

ESET will blame Razer for not updating or something like that while its actually something on ESET's side.

 

Thank you for going through that and hopefully they will do something now.

[SweX 871]

The problem is most likely not in the VSD itself, but in one of the modules that has been updated which will be download together with the VSDs in both v7 and v8 (if you let them update after install).

 

For instance you have: Personal Firewall module: 1228B

And the latest one (pre-release) is   : Personal firewall module: 1251 (20141120)

Edited November 26, 2014 by SweX

[kanedagr 1]

When updating to 10779 virus signatures the Personal Firewall Module was 1250. I haven't tried 1251 but i am bored to do that again. I am going to wait for sometime.

[SweX 871]

Yeah sorry I am on pre-release (forgot to mention that) so I guess 1251 is not available on the standard update servers yet. But it is impossible to say if a fix for this is in that module or not, it might even be caused by something else.

 

I'm sure Marcos will chime in soon again.....

Edited November 26, 2014 by SweX

[kanedagr 1]

Ι don't know if it's a pre-release. The latest virus update signatures are 10782. I wish Marcos will chime in soon to enlight us!

 

The latest updates are 10783.

Edited November 26, 2014 by kanedagr

[kanedagr 1]

For someone who has the same problem mentioned above and wants to turn off automatic updates. Go to Tools-> Scheduler and uncheck the "regular automatic update" and "Automatic update afte dial-up connection". I believe the first one only does the trick, unless you have dial-up connection!

[DuncanIdahoTPF 0]

I keep getting an error "failed to change settings" when selecting remember action and hitting Allow in interactive mode. I assuming this is the same problem in this thread because my problem seems very similar and the thread was created exactly when I started having the problem. Eset SS 8 was working fine for months and no changes to my computer before the error started.

 

I have Windows 7 x64.

 

Virus signature database: 10782 (20141126)

Rapid Response module: 5116 (20141126)

Update module: 1052 (20140801)

Antivirus and antispyware scanner module: 1444 (20141124)

Advanced heuristics module: 1153 (20140915)

Archive support module: 1214 (20141022)

Cleaner module: 1102 (20141112)

Anti-Stealth support module: 1066 (20141121)

Personal firewall module: 1250 (20141114)

Antispam module: 1029 (20141103)

ESET SysInspector module: 1245 (20141028)

Real-time file system protection module: 1009 (20130301)

Translation support module: 1273 (20141008)

HIPS support module: 1153 (20141120)

Internet protection module: 1162B (20141107)

Web content filter module: 1036 (20140625)

Advanced antispam module: 1956 (20141125)

Database module: 1060 (20140714)

[kanedagr 1]

I 10783 the personal firewall module is still 1250 and it still generates the same problem. Rollback to previous virus signatures is not happening because of the problem with the administrator rights. So, once again, uninstall and install again without updates.

[kanedagr 1]

I am starting to think that it's not the Personal firewall module that has the problem but a different module. It cannot creater rules because of the inability to save the configuration file.

 

[Marcos 5,452]

We'll need to get the following stuff for analysis:
1. ESI log.
2. Full memory dump from the situation when the issue occurs.
3. The registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BUildLabEx.

[160 0]

This is this problem with HIPS. Confirm "ESET GUI freezes when changing settings- promt admin rights" after update HIPS module 1153 on 3 PCs W8.1  x64 all update with enable option "promt full admin rights also for limited user"

[Marcos 5,452]

We assume it's cause by Anti-Stealth module not loaded. Please post the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BUildLabEx at least.

[kanedagr 1]

Excuse me for the silly question. But where I can find esi loq and how I can take a memory dump? As soon as I get home I will post them.

[Marcos 5,452]

Excuse me for the silly question. But where I can find esi loq and how I can take a memory dump? As soon as I get home I will post them.

 

1, SysInspector log can be generated directly from within product's gui (Tools section).

2, To generate a complete memory dump, please follow the instructions at hxxp://msdn.microsoft.com/en-us/library/windows/hardware/ff545499(v=vs.85).aspx.

[SweX 871]

Excuse me for the silly question. But where I can find esi loq and how I can take a memory dump? As soon as I get home I will post them.

 

How do I create a SysInspector log and submit it to ESET?

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN2219&actp=search&viewlocale=en_US&searchid=1417013927329

 

You only need to look at the screenshots about how to create the esi log but you don't need to download it as you can use the version of ESET SysInspector that is included in the product.

 

How do I generate a memory dump manually?

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN380&actp=search&viewlocale=en_US&searchid=1417013878790

 

HTH, SweX

Edited November 26, 2014 by SweX

[OhayoNB 0]

hello,

i have the same problem in the outbound traffic when trying to create rule, the ESET Gui Freeze and dont let me do nothing, just stuck.

how i can fix the problem ?

 

thanks

[Marcos 5,452]

hello,

i have the same problem in the outbound traffic when trying to create rule, the ESET Gui Freeze and dont let me do nothing, just stuck.

how i can fix the problem ?

 

thanks

 

Please post the value of the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BUildLabEx as requested in this thread earlier. Are you able to change other settings?

[kanedagr 1]

 

Excuse me for the silly question. But where I can find esi loq and how I can take a memory dump? As soon as I get home I will post them.

 

How do I create a SysInspector log and submit it to ESET?

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN2219&actp=search&viewlocale=en_US&searchid=1417013927329

 

You only need to look at the screenshots about how to create the esi log but you don't need to download it as you can use the version of ESET SysInspector that is included in the product.

 

How do I generate a memory dump manually?

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN380&actp=search&viewlocale=en_US&searchid=1417013878790

 

HTH, SweX

 

 

 

 

Excuse me for the silly question. But where I can find esi loq and how I can take a memory dump? As soon as I get home I will post them.

 

1, SysInspector log can be generated directly from within product's gui (Tools section).

2, To generate a complete memory dump, please follow the instructions at hxxp://msdn.microsoft.com/en-us/library/windows/hardware/ff545499(v=vs.85).aspx.

 

Thank you very much both of you for these usefull instructions. I created an ESI log, but the memory dump doesn't give me the option to create a complete memory dumb. Only small memory dumb and kernel memory dumb are available. I have attached the ESI.log.

The registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BUildLabEx is "7601.18526.amd64fre.win7sp1_gdr.140706-1506".

SysInspector-KANEDA-PC-141126-2300.zip

Edited November 26, 2014 by kanedagr

[Marcos 5,452]

Those who are experiencing the issue and are willing to test a new HIPS module to find out if the fix we've made solves the issue (an ESET binary was excluded from self-defense), drop me a pm for further instructions.