Web Access Protection prevents access to files from intranet (v6)

[jimwillsher 65]

Hello

 

Fully-patched Windows 7, Windows 8 and Vista machines,with Eset Endpoint 6.1.2. All users are using IE11. Also reproducible on a Server 2012 R2 machine.

 

When users browse our intranet site (hxxp://companyweb, which is a standard SharePoint Foundation 2010 site on an SBS2011 box) then can click a Excel (.xlsx) file to download it.This launches Excel 2010.

 

With "Enable HTTP protocol checking" enabled in Endpoint, the file never opens. Excel sits there saying "downloading....." for about 2 minutes, then gives up.

 

If we disable "HTTP Protocol Checking" in Endpoint, the file opens instantly.

 

I can record screen video if required.

 

I have tried adding exclusions via URL Address management, and I then gets lots of ESET popups saying the site was excluded, but still the file will not open. Only by disabling HTTP protocol checking can we open the file. This happens with all Excel files.

 

Any thoughts?

 

 

Many thanks

 

 

Jim

Edited February 9, 2015 by jimwillsher

[jimwillsher 65]

UPDATE: Filtering by name or URL does not seem to work. Despite getting the notifications saying "website excluded from checking", it doesn't work, the site is still checked. What DOES work is excluding the fileserver IP address altogether on the Protocol Filtering page.

[Marcos 5,070]

I'd suggest enabling "Record information necessary for ESET support to diagnose protocol filtering issues" box, reproducing the issue and providing the pcapng logs created to Customer care for analysis.

[Proactive Services 11]

Jim, I'm diagnosing an incompatibility between the most recent Program Components Upgrade with Eset and Privoxy, a web filtering proxy. The fault was so subtle I only realised it when my desktop updated the PCU today, and started getting the same symptoms - data being truncated at the same point +- a few bytes. Disabling the HTTP protocol checking also works-around this problem. I'm still collecting data to report it to Eset.

 

Do you know if your fault also showed up with the most current PCU? It may be helpful for Eset to look at both problems at the same time.

[jimwillsher 65]

Hi

 

No, we disabled HTTP protocol filtering for the IP of our SharePoint server and we've never looked back. We control that server so we know it'll not contain any malicious files so we're happy to exclude that IP address.

 

Sorry, I know that doesn't help you.....