ESET Insiders cutting_edgetech 25 Posted December 11, 2015 ESET Insiders Share Posted December 11, 2015 (edited) I tried downloading speccy from the pirfiform site using this url hxxp://www.piriform.com/speccy/download/standard, and it fails to download. Eset Smart Security warns me it contains potentially unsafe application which in this case is Google Toolbar. I chose to allow the download each of the 2 times it warned me, and the download failed anyway. I tried 3 times, and each time it failed. I then disabled Eset Smart Security protection from the taskbar icon, and the download completed immediately. I'm using Eset Smart Security 8.0.319.0. I'm not interested in upgrading to version 9 yet since a few bugs in it affect me. I just thought I would report it since it also slows down downloads. I'm on Windows 7X64 Ultimate with all the latest security patches. regards, cutting_edgetech Edited December 11, 2015 by cutting_edgetech Link to comment Share on other sites More sharing options...
ESET Insiders stackz 112 Posted December 11, 2015 ESET Insiders Share Posted December 11, 2015 The same thing happens with 9.0.349, you click ignore and the download fails. Link to comment Share on other sites More sharing options...
ESET Insiders cutting_edgetech 25 Posted December 11, 2015 Author ESET Insiders Share Posted December 11, 2015 Thank you for your feedback stackz! The more people that report problems the better chance Eset will realize there is actually a bug in their software. I believe a lot of bugs go unreported, and if they only see a few users reporting a problem they may think there's something else wrong with that user's machine. Link to comment Share on other sites More sharing options...
ESET Insiders stackz 112 Posted December 11, 2015 ESET Insiders Share Posted December 11, 2015 (edited) Edit: The post I responded to has been deleted. Edited December 11, 2015 by stackz Link to comment Share on other sites More sharing options...
Most Valued Members shocked 60 Posted December 11, 2015 Most Valued Members Share Posted December 11, 2015 sorry my bad, i didn't carefully read the previous posts. Link to comment Share on other sites More sharing options...
itman 1,659 Posted December 11, 2015 Share Posted December 11, 2015 I tried downloading speccy from the pirfiform site using this url hxxp://www.piriform.com/speccy/download/standard, and it fails to download. Eset Smart Security warns me it contains potentially unsafe application which in this case is Google Toolbar. I chose to allow the download each of the 2 times it warned me, and the download failed anyway. I tried 3 times, and each time it failed. I then disabled Eset Smart Security protection from the taskbar icon, and the download completed immediately. I'm using Eset Smart Security 8.0.319.0. I'm not interested in upgrading to version 9 yet since a few bugs in it affect me. I just thought I would report it since it also slows down downloads. I'm on Windows 7X64 Ultimate with all the latest security patches. regards, cutting_edgetech Did you try to disable PUA detection and then attempt to download again? Then enable PUA detection after the download completes. Sometimes this doesn't work however if Eset's web filter is blocking the IP address. Another way to get around this is to download a zip file if they offer one. Eset won't detect the PUA until the file is unzipped and the installer executed. Link to comment Share on other sites More sharing options...
Most Valued Members SCR 195 Posted December 11, 2015 Most Valued Members Share Posted December 11, 2015 (edited) Post deleted by User Edited December 11, 2015 by SCR Link to comment Share on other sites More sharing options...
Administrators Marcos 5,070 Posted December 11, 2015 Administrators Share Posted December 11, 2015 Could you confirm or deny that temporarily disabling real-time protection before you start the download helps? Was a Firefox temporary file (*.part) detected prior to detection by web access protection? Link to comment Share on other sites More sharing options...
ESET Insiders stackz 112 Posted December 12, 2015 ESET Insiders Share Posted December 12, 2015 (edited) Could you confirm or deny that temporarily disabling real-time protection before you start the download helps? Disabling real-time protection prior to the download results in a successful download. Was a Firefox temporary file (*.part) detected prior to detection by web access protection? Yes Edited December 12, 2015 by stackz Link to comment Share on other sites More sharing options...
ESET Insiders cutting_edgetech 25 Posted December 12, 2015 Author ESET Insiders Share Posted December 12, 2015 I tried downloading speccy from the pirfiform site using this url hxxp://www.piriform.com/speccy/download/standard, and it fails to download. Eset Smart Security warns me it contains potentially unsafe application which in this case is Google Toolbar. I chose to allow the download each of the 2 times it warned me, and the download failed anyway. I tried 3 times, and each time it failed. I then disabled Eset Smart Security protection from the taskbar icon, and the download completed immediately. I'm using Eset Smart Security 8.0.319.0. I'm not interested in upgrading to version 9 yet since a few bugs in it affect me. I just thought I would report it since it also slows down downloads. I'm on Windows 7X64 Ultimate with all the latest security patches. regards, cutting_edgetech Did you try to disable PUA detection and then attempt to download again? Then enable PUA detection after the download completes. Sometimes this doesn't work however if Eset's web filter is blocking the IP address. Another way to get around this is to download a zip file if they offer one. Eset won't detect the PUA until the file is unzipped and the installer executed. Yes, I tried disabling detection of PUA, and that worked. I was using this thread to report a bug with the detection of PUA's. If you the user choses to allow the download by prompt then the download still fails. I also tried disbling real-time protection, and that worked also. Link to comment Share on other sites More sharing options...
ESET Insiders cutting_edgetech 25 Posted December 12, 2015 Author ESET Insiders Share Posted December 12, 2015 Could you confirm or deny that temporarily disabling real-time protection before you start the download helps? Was a Firefox temporary file (*.part) detected prior to detection by web access protection? Yes, the download is successful if I disabled real-time protection. The download is also successful if I disable detection of PUA's. The problem is if I choose to allow the PUA when prompted the download fails anyways. Stackz above tried to download the same file using the same link with PUA enabled, and his download failed also despite him choosing to allow it when prompted. A .part file was detected in the first prompt. Below are the two prompts I receive. I allowed them both, but the download always fails. I'm using the latest version of Firefox 32bit. Link to comment Share on other sites More sharing options...
itman 1,659 Posted December 12, 2015 Share Posted December 12, 2015 (edited) Could you confirm or deny that temporarily disabling real-time protection before you start the download helps? Was a Firefox temporary file (*.part) detected prior to detection by web access protection? Yes, the download is successful if I disabled real-time protection. The download is also successful if I disable detection of PUA's. The problem is if I choose to allow the PUA when prompted the download fails anyways. Stackz above tried to download the same file using the same link with PUA enabled, and his download failed also despite him choosing to allow it when prompted. A .part file was detected in the first prompt. Below are the two prompts I receive. I allowed them both, but the download always fails. I'm using the latest version of Firefox 32bit. Try this. When you get the PUA alert, click on "Show advanced options." Checkmark the "exclude from detections" click box. Then click on the "No Action" click box. Note: This might create a permanent exclusion for Google Toolbar. Don't know if you want that to happen. Edited December 12, 2015 by itman Link to comment Share on other sites More sharing options...
itman 1,659 Posted December 12, 2015 Share Posted December 12, 2015 (edited) Think I found the culprit. This time I tried to simulate what you did. I tried to download from here: hxxp://www.piriform.com/speccy/download/standard . Got two PUA alerts for spsetup129.exe. I clicked on "No action" for both and the download in IE11 proceeded until 99% complete. Then I received another PUA alert with no option available that the download was automatically quarantined( I use strict cleaning option). Guess what Eset protection did that - Document Protection? 12/12/2015 11:47:34 AM Document protection file hxxp://download.piriform.com/spsetup129.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined XXX-XX\XXX(User name omitted) Per Eset help: The Document protection feature scans Microsoft Office documents before they are opened, as well as files downloaded automatically by Internet Explorer such as Microsoft ActiveX elements. -EDIT- The download BTW is in quarantine so it could be restored from there? You can also change the ThreatSense cleaning option for Document protection to "no cleaning." That will then result in an Eset popup for removal action and you can bypass any mitigation at that point. Or, just disable Document protection which I wouldn't recommend. Edited December 12, 2015 by itman Link to comment Share on other sites More sharing options...
ESET Insiders cutting_edgetech 25 Posted December 13, 2015 Author ESET Insiders Share Posted December 13, 2015 I only received two prompts. I chose "No action" for each prompt. The download failed. I'm using Firefox 42.0. Link to comment Share on other sites More sharing options...
ESET Insiders stackz 112 Posted December 13, 2015 ESET Insiders Share Posted December 13, 2015 (edited) On v9.0.349, my first alert is for PUA spsetup129.exe. If I click Ignore for this alert, then I receive an alert for a *.part file. If I then just let the alert notification sit on the desktop and not select any option, the download completes. After that I just click ignore to dismiss the notification. Edited December 13, 2015 by stackz Link to comment Share on other sites More sharing options...
itman 1,659 Posted December 13, 2015 Share Posted December 13, 2015 (edited) If I then just let the alert notification sit on the desktop and not select any option, the download completes. After that I just click ignore to dismiss the notification. This brings up an issue I have noticed in other Eset protection areas. If you don't respond to an alert, the default action appears to be "allow?" This to me is a security risk and is contrary to other security software I have used where the default response is "deny." Also, most security software gives you an option on what you want the default response to be. I have not been able to find any such settings in Eset for this. Edited December 13, 2015 by itman Link to comment Share on other sites More sharing options...
Recommended Posts