v4 IDS killing internet connection

[SEMEYE]

I've been testing Smart Security 4 for a couple days now in preparation of a deployment on our company network. So far, I've had very strange issues with the Firewall. In order to get even a volatile internet connection (in automatic mode) I've had to tune it quite a bit as well as look at the logs to try and get an idea as to why my connection drops all of a sudden. Before any tuning, I was completely blocked from all internet access on any port/program.

According to the logs, my last outage was:

"Packet blocked by active defense (IDS)"
Source: 65.175.38.194:80 (which is Wilders IP btw)
Target: my private IP
Protocol: TCP

During that outage, all internet connected programs were disconnected.

So far, I've made the following changes which have improved my connection but I still get random disconnects:

Disabled ARP and DNS poisoning detection
Enabled allow UPNP in trusted zone
Enabled maintain inactive TCP connections
Switched to "Applications marked..." for protocol filtering.

So, any idea why the IDS drops my connection? Obviously, disabling the firewall works like a champ, but that's not an option.

[funkydude]

Is your network configured to "allow sharing" or "strict protection"? Does changing it make a difference?

[SEMEYE]

It's configured to allow sharing. it doesn't appear that changing to strict makes a difference, other than my shares are no longer accessible.

[ingber]

We're having the same problems, right after upgrading from v3 and installing v4 on two Thinkpads under XP Pro SP3. However, I see no entries in the logs.

Lester

[Forellenblau]

Same here, i switched back to V3...

Internet connections were down every half hour, Firefox couln't find any site anymore.

I had to wait a couple of minutes and then Internet was back - for the next 30 minutes...

Not good!

Forellenblau

[ingber]

-{ Quote: "Same here, i switched back to V3...

Internet connections were down every half hour, Firefox couln't find any site anymore.

I had to wait a couple of minutes and then Internet was back - for the next 30 minutes...

Not good!

Forellenblau" }-

Yes, that is the same problem we're having. The Logs are set to include all info, but nothing shows there. Clearly, this is an ESET software problem, and I hope they are faster to fix this than they have addressed some other problems last year -- or else the competition will gain customers.

When I disable the firewall from the tray, "by magic" I can get into google.com!


Lester

[alexkamp]

-{ Quote: "We're having the same problems, right after upgrading from v3 and installing v4 on two Thinkpads under XP Pro SP3. However, I see no entries in the logs.

Lester" }-

Same Probleme here. I hope ESET is working in a update. After updating from 3 to 4 - only problems. It seems that ESS works *sometimes* - sometimes not.

[Uroboros]

Having similar problem as well. Vista Business 32.

I installed version 4 and all was fine as it was able to update itself. But eventually I lost Internet connection. Was stuck with just a local connection. Not sure what happen but perhaps it received something it didn't like and it killed the connection. This happen the 2-3 times I installed it

I'm behind a router. repairing the connection from Vista didn't help as it seemed not to get any data from the DNS server.

I remember having a similar problem way back when it another Firewall where it would crash or something and suddenly I had no connection.

Back to version 3 for now.

[Marcos]

Could someone of you having these issues create 2 Wireshark logs with the http communication captured, one with the firewall enabled when the communication is blocked and the other with the fw disabled?

[silverfox55]

V4 is crippling my internet in Vista. Firefox or Opera continually time out and when they do it is very much slower. Gone back to Ver3 until I see some positive movement on a fix. How did this not show up on testing is beyond me.
:thumbd:

[alexkamp]

-{ Quote: "Could someone of you having these issues create 2 Wireshark logs with the http communication captured, one with the firewall enabled when the communication is blocked and the other with the fw disabled?" }-

I can't - sorry. Don't have a clue how to use Wireshark.

[ingber]

Marcos:

I have a better idea: Since enough people have demonstrated there is a problem with v4, why don't you directly contact support and have them escalate this really annoying problem with the software! I've submitted a ticket, but in the past that can take weeks for them to address. I think the moderators in this forum that know the people in support should be more active to do this ASAP.

Lester

[SEMEYE]

-{ Quote: "Could someone of you having these issues create 2 Wireshark logs with the http communication captured, one with the firewall enabled when the communication is blocked and the other with the fw disabled?" }-

i'll start a capture and post in a bit.

[The Nodder]

I'm haveing the same problem and its most annoying - to put it nicely.

This should not be happening, as posted above why was it not found in testing. ?

[pomocnik]

same problem here :-(. in beta no problem of that kind. i wait today and maybe return to v3

[MasterTB]

Hi, does this problem happen on every site and randomly?
Did any of you having problems enable the option to check SSL protocol?
@SEMEYE you said "automatic mode" have you tried Learning Mode or Automatic With Rules? they are good alternatives and perhaps seeing the rules created by the firewall can give you a clue as to what is causing this problem you experience...

[alexkamp]

I made a clean,fresh installation of Win XP Pro with SP3 and Eset Smart Security 4. Still the same problems. I thought that it would only happen after an update from version 3 to 4. And to be honest i'm very pissed because there's no statement from Eset. Many users have this problem and the software -in this state- is unusable. I work in my home office and i'm rely on the software.

alex

[silverfox55]

On my setup it is set to automatic mode. I am not into firewalls and have not seen any decent/well written and easy documentation on setting up rules. I expect a firewall to work out of the packet. Also it happened on every site I visited. Ver3 works, Ver4 does not. I am at a loss to understand why ESET is asking for field information from users and they are unable to recreate this on there test equipment. There testing methodology is in dire need of rewriting if they cannot pick these problems up. Continually denying that the problem exists is going to force a lot of customers away and ESET loose it's fame as an excellent product. Burying one's head in the sand will not make the problem go away and never has or will do.
???

[KOKOtm]

Same for me. After some time the firewall blocks all internect access. Was a fresh installation. If i disable IDS(all options), the connection is back again. I think one of the IDS options have a bug...hope it will be found soon.

[pomocnik]

hmmm today at 11:21:25 were updated some program modules. after that i enabed again firewall and actually firewall is on and my internet connection is up and running.

i saw info about update in pop-up menu and after that i found it in logs too.
updated modules with today date:
system diagnostic module
antivirus and antispyware module

edit: 13:59 lost connection again :-(

[SEMEYE]

-{ Quote: "Hi, does this problem happen on every site and randomly?
Did any of you having problems enable the option to check SSL protocol?
@SEMEYE you said "automatic mode" have you tried Learning Mode or Automatic With Rules? they are good alternatives and perhaps seeing the rules created by the firewall can give you a clue as to what is causing this problem you experience..." }-

Yes, im actually running Auto w/ Rules now and its a lot better then a couple days ago. i ran capture after capture with wireshark yesterday in an attempt to catch a failure, but it never happened. so my question is, when you make a settings change to the firewall, whether it be a rule or zone entry, IDS change, or anything like that, does SS have to be restarted in order to reflect that change? it's possible that all of my changes throughout the day would have worked but they weren't applied until yesterday when i booted up.

at this point, i'm going to export my config, add it to my base package, and test it out on a few more machines. i'll let you know how it goes.

[MasterTB]

Well SEMEYE, to my knowledge, changes are immediate but if you're having troubles, rebooting after making considerable changes to the Firewall Rules may be a good move.
Glad to see things are improving.

[RonZ]

I have ESET Smart Security installed on 3 computers, 2 are laptops that connect to my DSL router via wireless and the other is a desktop connected via ethernet to the router. I upgraded the 2 laptops to version 4 and experienced no problems at all. They are working very well actually. When I upgraded the desktop it had all of the problems mentioned in this thread. The 2 laptops continue to work properly. My installations are all custom, and I use the settings described elsewhere. I use the "interactive" setting. All of the computers are running Windows XP SP3. I finally returned to version 3 on the desktop and it is working fine again. Those of you who are having problems, are you using a wireless or wired connection?

[eisefr]

Damn.. whats that for a crap....?

This bug with the firewall was already in the first beta.. and in the RC as well.

And now in the final version its still the same ??

:ouch: I wont extend my license if this BIG error is not gonna be fixed very soon.

Only work with deinstalling and new installing version 3.

Thanks alot !!!

Edit:
i am using wire connection!

But thats not really important.
Firewall HAS to work when it is a final version.
The firewall is a essential function in a security suite and thats what I am paying money for too !!!!

[SEMEYE]

Well, I exported my configuration, pushed it out to another machine and I get the same result- dead internet connection every 20 minutes or so.

I had the user run a wireshark capture during the time he lost and then tried to reestablish a connection, but I don't see anything out of the ordinary in the capture file.

I have a question about the item installed under the network card properties labeled "ESET Personal Firewall." It seems when I disable, or uncheck this item, my problems disappear, yet the SS dashboard reports that the firewall is still on and enabled. I also still receive firewall warnings in the admin console so it's seemingly still doing its job, so what is that network card component actually doing? Is it required for the firewall to function properly? And I say properly very loosely in this case because it seems that this component is causing a lot of connectivity issues. Can someone else with similar issues confirm that unchecking this component works for them ?

[silverfox55]

Wired and automatic. Straight out of the box and it should work without setting any rules. If this bug was reported in Beta and RC as mentioned how on earth has this problem been released in public. I hope this is fixed soon or ESET will loose its place at the top of the tree and sink to Symantec level of dross.

[eisefr]

I am back to V3.
Works as it should.
The firewall also.

[ibarnett]

I'm back to V3 as well.
Now all working as before.
I found that V4 was also choking my internet speeds.
V4 down:4834 up:269
V3 down: 7031 up:314

[bodgy]

Have any of those with this problem tried enabling show hidden devices in System Devices\Hardware and seeing if any of the miniport entries have a problem under Network Adapters icon?

Also are your broadband connections Cable/ADSL or 3G wireless?

Colin

[ibarnett]

No problems in Device Manager.
ADSL connection with Ethernet (not wireless).

[anruler]

No problems in Device Manager!
I'm using WLAN 802.11g ...

[Scoty]

I have the same Problem. I use Eset Smart Security 4 for first Time and every start from Vista i can not use Internet and Eset give me a Error. With next Boot i can use all.

[sogood]

I have the same problem with ESS4 (trial version) - its firewall is causing internet disconnection every 15 to 30 minutes!

I can only use the internet when I disable firewall. If I enable firewall again, the problem reappears.

I decided to give ESS4 a try today after reading positive reviews on how good & light this security software is, but didn't expect the firewall can disconnect the internet connection itself.

I believe every security software has their own problems, so I'll use Windows Firewall temporarily and give ESS4 a chance until my trial version expires.

My laptop info:
- Windows XP Pro SP3
- Previous used antivirus: AVG Free (uninstalled)
- Previous used firewall: Online Armour Free (uninstalled)

[bodgy]

This happened on the trial version of ESS4 as well, but I ignored it as I was trialing it on W7 beta.

However, it is doing it intermittently on XPpro SP3, and strangely continues even if the firewall is set to disable.

I had a fiddle last night and so far this morning it is working OK.

Colin

[bodgy]

I may have found an answer!

I noticed that ESS4 had set my internet browser to allow Internet out, only.

I've just changed that to 'Both' and suddenly my browser is much faster (Operar 9.63), but fingers crossed, it hasn't stalled as yet.

Colin

[Erroneus]

Same problem here, has been having disconnects the last two days, after I installed v4 trial

I notice it quite easy, as I'm running on mutiple IRC networks and the moment it happens, i get dissed from them.

Running in Vista and nothing to see in log, beside some DNS cache poisoning attacks was stopped from my ISP's DNS server O_o

I hope ESET is going to get this fixed or else I would have to find another solution, when the trial runs out, instead of buying SS v4.

[bodgy]

What I thought might be the answer tunred out just to be an improvement.

I think it is actually blocking outgoing communications. I had a look in the real time connections, and I see two things.

1. Eset kernel seems to be holding on to old sockets for quite some while.

2. I have a number of WAIT_STATE messages appearing in SysInspector and WAIT_CLOSE all directed via localhost but with different port numbers.

ALl are local host and broadcast IP - 127.0.0.1 and 0.0.0.0

I'll run the SysInspector again and then might email Eset.

Colin

[1000db]

I have also sent my SysInspector info to Eset but have yet to hear from them. I imagine I won't until there is an actual fix. This seems to be fairly common with v4 judging by the number of threads similar to this. I'm actually thinking of rolling back to v 2.7 or finding another product when my subscription is up.

[miki69]

Had the same problem, had to disable firewall, disconnect/re-connect network and than re-enable firewall. Real pain in the a$$. At the end, I have reinstalled ESS v4, so far works ok. Never had such issues with v3 though.

Cheers,
Miki

[Dracula87]

The program modules have been updated. Did you update them too?

[eisefr]

-{ Quote: "The program modules have been updated." }-

When was that ?

Download section still offers the 'old' version:
March 2, 2009 - 4.0.314

[Dracula87]

Not the PROGRAM. The MODULES (they are called so in the russian package).

I see the scanning and heuristics modules as of today in the About section.

[eisefr]

-{ Quote: "
I see the scanning and heuristics modules as of today in the About section." }-

But they don't have anything to do with the firewall... ?
Or was the firewall module updated too?

[psi2003]

With the updated modules the problem still there.

Connectivity lost :wacko: :wacko: :wacko: :wacko: :wacko: :wacko:


ESET !!!!!!!!!!!! WAKE UP :wacko: :wacko: :wacko:

[eisefr]

I thought so. :)

Oh well.

My license expires in July.

If it's not working until then.. I have to look for another suite.
We'll see.

Hope dies last :)

[Dracula87]

oops, mistake. Firewall is 1044 from january 21. Sorry :)
Still... 4 days without bugs...

Maybe one should try the interactive firewall? I'm with the automatic with exclusions for rules.

[eisefr]

-{ Quote: "Maybe one should try the interactive firewall? I'm with the automatic with exclusions for rules." }-

I never used automatic - firewall.
ALWAYS interative.

And there I found that bug in Beta1 already and now in public version.

[psi2003]

I already try automatic with exclusions for rules and inernet still blocked :wacko:

Eset must change something more....


ESET WAKE UP (round 2) :thumbd:

[Dracula87]

By the way... a know people who used the interactive fire in 3.0 and got problems with browsing etc. D'know... :( Always used auto+rules and never had any problems. Firewall works great.

[eisefr]

This is really a joke.

Firewall module is from 21st of january.
RC was published AFTER that.

So the RC was already still with that firewall bug !

Not very professionel.

Time pressure for the cebit in Germany ??? :dry: :dry:

[psi2003]

-{ Quote: "By the way... a know people who used the interactive fire in 3.0 and got problems with browsing etc. D'know... :( Always used auto+rules and never had any problems. Firewall works great." }-
Dracula87,

What is your network card?

[Dracula87]

D-Link AirPlus DWL-G520 Wireless PCI Adapter(rev.B) + Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller

[psi2003]

Don't you loose connectivity using Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller?

I starting to thing that this bug is related to network adapters :wacko:

[Dracula87]

-{ Quote: "Don't you loose connectivity using Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller?

I starting to thing that this bug is related to network adapters :wacko:" }-

Nope... No bugs here... ::) And this freaks me out, 'cause I can't find out the source of the problem. Got ESET home on my PC and mother's laptop. Installed today for my father at the office... mo bugs with internet connection or slow browsing. Everywhere - auto+rules in the firewall.

[SEMEYE]

well, I guess this settles it. I'm downgrading to v3 until ESET has a handle on this issue. thanks to all who attempted to fix a broken program.

[psi2003]

-{ Quote: "well, I guess this settles it. I'm downgrading to v3 until ESET has a handle on this issue. thanks to all who attempted to fix a broken program." }-
YES! I agree with you SEMEYE.... ESS 4 is broken :gack: PERIOD!



ESET WAKE UP:wacko: :wacko: :wacko:

[SEMEYE]

I'm left wondering why we didnt get a single response/possible solution/temp fix or anything for that matter from an ESET rep. this is the official forum, is it not?

[eisefr]

They are all celebrating their new product on the cebit in Germany...

Not knowing whats going on here in their forum.... :D :D

-Just kidding- ;)

[Dracula87]

It seems they have many problems right now (and I am not talking about Cebit). For starters - server updates (as it seems). Then - this firewall bug. The 3918 update when Kryptik was a false alarm... But still I agree - where are you, ESET guys? I understand that I don't have bugs... But still... ???

[grndady]

THANK YOU ALL for your posts.

I too upgraded to 4.0 on 3/6, and the internet died. Spent ALL DAY working on the problem, only to eventually get 5 or less minutes of connect time several times that day.

Went to work 3/7 and came here to see if I was the only one, and BAM! All you guys are suffering with me!

I downloaded 3.0 on my work computer and burned it to cd; came home and deleted 4.0 and all it's directories; installed 3.0 and got everything BACK, EXCEPT, I now have approximately HALF of my usual internet speed.

Wrote a service request and sent it. Not expecting much of a reply.

Does ESET ever read any of these? I already dumped BitDefender for ESET on account of BitDefender's buggy software. Hope I don't have to repeat.

Thanks.

[Dracula87]

How about the system? I'm testing Win7. The laptop is XP Sp3. Windows firewall off?

In order to find out the source of the bug we should write the OS, network adapter, the on\off windows firewall and the ESET firewall position (auto, interact etc). Maybe we can find smth out of it... just a hunch...

[psi2003]

Here:

- Vista x64
- Realtek network adapter
- Automatic firewall

Connectivity lost all the time!

[Dracula87]

Windows 7 Build 7022 Ultimate x86
Windows firewall off
ESET Firewall auto+rules
D-Link AirPlus DWL-G520 Wireless PCI Adapter(rev.B) + Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller

No bugs. Internet connection and browsing works fine.

[silverfox55]

Vista x32
Realtec network adapter
Automatic firewall

[Erroneus]

This is a Joke ESET, at least give us a reply.

Two disconnects in two hours >_>

IF this is not fixed real fast, I'm jumping back to Avast. Not worth spending money on a broken product and apparently no support...

[miki69]

Today's module update (9th March) is update for scanner and heuristic modules. Like someone already mentioned firewall module is "ancient" old (21.01) as well as self-defense module (dated NOV 2008 ). Isn't that strange? So ESET didn't update those since RC? Doesn't sound like ESET, they've been know for very reliable company. Maybe V4 came too soon after all.

Anyhow, day 2 after V4 reinstall, so far so good.

[funkydude]

The firewall module had 4 updates during testing 1040>1044 and the self defense had 5 1000>1005

Ignoring the fact that the latest firewall module is somewhat dodgy, there's not much you can do in a firewall module, that goes for a self defense module as well.

[pomocnik]

hmmm strange thing this firewall.

yesterday i reinstaled my laptop. after install of system /vista home premium 32/ first thing which i instaled was ESS v3. and suprise, suprise, same problem with disconnecting as in ESS v4 ???. after that i disable fireval module and continue instaling other stuff. and after all vista updates were instaled i try firewall again and problem with disconnecting was gone :o

hmm something smell in world of eset :-(

[KOKOtm]

Hm. I also don't know, why they need so much time...The bug is in the IDS, the firewall rules work like charm. I only deactivated the IDS. Can't be a big thing...i bet most of IDS rules work also, but i am to lazy to find out, which of them is buggy.

[RonZ]

On page one of this thread I explained how I installed ESS 4 on two wireless laptops and one wired desktop computer. The wired desktop had the problems described here, the laptops are working perfectly. I opened a ticket with Eset Technical Support and got the following response:

Hi there, when you are having an issue with the ESET Personal Firewall and a program that you use please complete the following to place the Firewall into “Learning Mode” with version 4 of ESET Smart Security.

For Windows XP (Vista is very similar).

1. Click on “Start”.

2. Click on “All Programs”.

3. Click on “ESET”.

4. Click on “ESET Smart Security”.

5. Click on the 2nd “ESET Smart Security” (with the icon alongside it), this will open up the ESET Smart Security Control Center.

6. Click on “Setup” in the left column.

7. Click on “Personal firewall” in the right hand window.

8. Click on “Advanced Personal firewall setup…”.

9. In the right hand window, click on the dropdown menu where “Automatic mode” is displayed and choose “Learning mode”.

10. Click on “OK”.

11. Run the problematic program that the ESET Personal Firewall is having issues with and use it for a while.

12. Repeat the steps above and place the ESET Personal Firewall back into “Automatic mode”.

Is your issue now resolved?

Thank you for contacting ESET Technical Support.

I tried this but naturally it did not solve the problem, it was actually worse. The tech who responded doesn't seem to be aware of the larger issues described in this thread. That DOES worry me. I did have some success though, which I will detail in my next post.

[RonZ]

Ok, I did successfully get some events to show up in the log. These showed that packets were being blocked by IDS. That's what all of the errors were. So I tried disabling some of the rules in IDS. I had some success disabling TCP and UDP Port Scanning Attack Detection, but eventually this failed. The biggest positive change in Firewall behavior came when I disabled the rule "Block unsafe address after attack detection." Now things are starting to work. I've enabled all of the other rules again, I'm still running in "Learning" mode, and can see ESS creating new rules for itself. I'll let it go like this for a while and report back later.

[Dracula87]

-{ Quote: "Ok, I did successfully get some events to show up in the log. These showed that packets were being blocked by IDS. That's what all of the errors were. So I tried disabling some of the rules in IDS. I had some success disabling TCP and UDP Port Scanning Attack Detection, but eventually this failed. The biggest positive change in Firewall behavior came when I disabled the rule "Block unsafe address after attack detection." Now things are starting to work. I've enabled all of the other rules again, I'm still running in "Learning" mode, and can see ESS creating new rules for itself. I'll let it go like this for a while and report back later." }-

Emmm... Sorry, can you give a screenshot for the disabled features? Using russian language ::)

Worth a shot... though I installed on two PC's and a laptop at home (one trial on my very old PC with the printer on, and 2 licenses of v4) - still no bugs with the firewall. 4 days now.

[cupez80]

"Block unsafe address after attack detection." is a temporary solution .i think the problem is with the IDS rules...

[RonZ]

-{ Quote: ""Block unsafe address after attack detection." is a temporary solution .i think the problem is with the IDS rules..." }-

That actually worked for a while but eventually IDS began cutting off my connection again until it was unusable. I guess that I am going to have to just run with the firewall disabled and either trust my router's firewall or find a good freeware alternative. Can anyone suggest any good freeware firewalls?

[silverfox55]

PC Tools is supposed to be good. Too many problems with Comodo.

[Mr Eno]

I installed ESET Smart Security v4 and had problems, but i believe the latest Internet explorer v7 updates also has problems of stability.

I tried all options including uninstalling ESET Smart Security completely to clean installing win xp with all Microsoft updates and still had problems.

As I keep image files of my C drive I put back my old set-up reverted back to ESET Smart Security v3 and also installed Internet explorer v8 Beta.

I now have a computer that is steady as a rock again.

Internet explorer v8 although a beta seems very good and even worked with all my add-ons.

My conclusion is that Microsoft IEv7 latest updates are not stable and that ESET Smart Security has broken since v3

[RonZ]

Well, after some consideration I decided to uninstall ESS 4 (again) and download NOD32 and Online Armore or Comodo. I decided not to return to ESS3 because independent testing shows its firewall to be not very effective at all.

Take a look: http://www.matousec.com/projects/firewall-challenge/results.php

I can't waste anymore time on ESS4 considering ESET's silence on the issues brought to light here. Hope you all can work it out ...

[bodgy]

After this weeks Windows update, I tried re-installing ESS v4.

No change, still randomly blocks outgoing packets, even the log reports that.

Tried unticking everything in IDS and rebooting, no difference, except now I get a message 'Personal Firewall Rules cannot be converted for an unknown reason '

The antivirus/spam is showing 'Web access protection' as 'non functional'

I think this only leaves unticking the threat sense options to see if the problem can be resolved.

Tried on - XPproSP3 with Opera 9.63, IE7, and W7 beta with IE8 beta - same problem.

Colin

[funkydude]

Have you tried deleting all rules and changing to learning mode?

[bodgy]

-{ Quote: "Have you tried deleting all rules and changing to learning mode?" }-

Yes, as I uninstalled v3, but I might try it again.

Colin

[Stem]

Hi Colin,

-{ Quote: "No change, still randomly blocks outgoing packets, even the log reports that." }-Have you any examples of the log entries?

-{ Quote: "Tried on - XPproSP3 with Opera 9.63, IE7, and W7 beta with IE8 beta - same problem.

" }-What mode is the firewall set to?

If you are in "Interactive mode" then you may need to add a rule to the browser to allow it all outbound/inbound to/from the localhost (127.0.0.1).


- Stem

[bodgy]

-{ Quote: "

Have you any examples of the log entries?
" }-

Aargh, I uninstalled v4, I've just re-installed it again.

The log stated blocked (outgoing) 192.168.5.100 , which is my router and random incoming, - such as Seek, Yahoo, this forum, Nuts and Volts, and my email client (pocomail). Pocomail is set up as the email client in ESS.

-{ Quote: "
What mode is the firewall set to?
" }-

I changed it from interactive to learning, when it started blocking this morning.

-{ Quote: "
If you are in "Interactive mode" then you may need to add a rule to the browser to allow it all outbound/inbound to/from the localhost (127.0.0.1).
" }-

If it starts doing it again, I'll try this and perhaps adding the router as well.

The router is a Draytek Vigor 2820VN.

So far this 3rd installation seems to be behaving itself.

Are the log files backed up anywhere, when ESS is uninstalled, as I see the sysinspector I created on the 9/3 is still in the list.

Thanks for your suggestions.

Colin

[zfactor]

why should this all need to be done though? should this not be fixed yet. i was considering going back to ess4 but now i think i will be waiting...

[eisefr]

V4 is just not usuable.

Sad.

But I think I will have to look for another Suite.
As much as I liked Eset... But with this Firewall I cannot work.

[silverfox55]

The same question is repeatedly being asked. Why won't ESET do anything about these problems or even accept that there are problems and that they are working on them. This is supposed to be the official forum and even when I post a direct question to the mods, it goes unanswered. I expect this from Symantec but not ESET.

[TBR]

Ok, I've been able to kind of replicate the issue to the point i can post some useful info, firstly an image:-

http://img232.imageshack.us/img232/9651/ess4.jpg (http://img232.imageshack.us/my.php?image=ess4.jpg)

This shows whats happening when i simply try to use the IP for digg.com (which doesnt work) as opposed to the actual domain name www.digg.com (which does). Im not sure if there is some blocking in place on digg not to accept requests directly to the IP address though so this may be a red herring if thats the case.

Secondly, i have a wireshark trace which i will PM over to Stem as i would rather not share it here.

The trace shows me trying to connect to 64.191.203.30 by just putting this into Firefox URL bar, then after this fails, typing www.digg.com (which works), and finally by turning off the firewall and entering 64.191.203.30, which didnt work but got further.

Not in the trace, but observed, was that i couldnt ping 64.191.203.30 when i tried it moments later at the command prompt, but i could from another machine which is also running ESS4 but freshly booted.

Incidentally, im in LEARNING MODE, nothing should be being blocked.

I also have allow uPnP in the trusted zone and Maintain inactive TCP connections ticked and ARP + DNS poisioning unticked for testing.

Hope this helps.

[Stem]

-{ Quote: "The trace shows me trying to connect to 64.191.203.30 by just putting this into Firefox URL bar, then after this fails, typing www.digg.com (which works), and finally by turning off the firewall and entering 64.191.203.30, which didnt work but got further." }-

Hi,

I am getting the same direct connection problem to 64.191.203.30 on a PC just with the XP firewall, so the problem is not with the firewall.

Other direct IP entry for sites such as here work without a problem, so I m not sure as yet as to why this direct connection will fail.


- Stem

[TBR]

-{ Quote: "Hi,

I am getting the same direct connection problem to 64.191.203.30 on a PC just with the XP firewall, so the problem is not with the firewall.

Other direct IP entry for sites such as here work without a problem, so I m not sure as yet as to why this direct connection will fail.


- Stem" }-

So why is it showing as blocked in the log? ???

Thanks for looking though.

[bodgy]

I can report after the fourth install of ESS 4 (is there a link there for the supersticious?), it is behaving better, I'm no longer getting "Packet Blocked by active defense " (IDS) 192.168.5.100, but I'm getting occasional timeouts on various sites - mainly Seek, Yahoo and Ebay - this is not down to the sites per se, as my laptop is able to access them with no problem, which has ESS3 installed.

Seek (202.177.198.1:53) is captured by the log as providing DNS cache poisoning attacks, which seems unlikely.

Colin

[Stem]

-{ Quote: "So why is it showing as blocked in the log? ???

Thanks for looking though." }-

From a logged direct connection attempt to 64.191.203.30 on a non 3rd party firewalled system, when the attempt to make a direct connection to that IP, the connection is made but the GET/HTTP/1.1 is ignored by the server, the browser does make retransmits to attempt a connection, but does eventually time out with no_data. During that time there are no comms from that IP that could be blocked.

Maybe the logs are from a previously made/established connection that is now closed?


- Stem

[Stem]

-{ Quote: "Seek (202.177.198.1:53) is captured by the log as providing DNS cache poisoning attacks, which seems unlikely.

Colin" }-

Hi Colin,

What mode are you using?

If using interactive mode/rules system, then allow both outbound and inbound to the DNS servers remote port 53. You can do that as a global rule, or on a per-app basis.
It does appear to stop some connection problems and does not decrease security as the port is still fully filtered for a DNS reply.


- Stem

[ibarnett]

I've spat the dummy over this and I am now trialing Kapersky - so far so good.
A bonus - with Eset V3 & V4 - when using VOIP from my Netgear DG834GV, my internet suffered badly(I have plenty of bandwidth), some sites unreachable, some slow, and some OK.
Since I've changed to Kapersky these problems have disappeared.
Goodby Eset - what a shame.

[psi2003]

I agree with ibarnett

ESET launch a broken suite and doesn't fix it ASAP!

I'm gona buy a kaspersky license and destroy my ESET license! I'm very hungry with ESET :gack: :gack: :gack:

Goodbye ESS Generation 4

[bodgy]

A copy of my log file.

192.168.5.105 is me, most of the 202.177.x.x is my ISP's DNS servers, 202/203.5.x.x is Seek website.

Is this a light bulb moment for anyone?

Colin

-{ Quote: "13/03/2009 1:39:44 PM Packet blocked by active defense (IDS) 192.168.5.105:2776 203.206.129.17:80 TCP
13/03/2009 1:39:43 PM Packet blocked by active defense (IDS) 192.168.5.105:2770 202.58.38.94:80 TCP
13/03/2009 1:39:18 PM Packet blocked by active defense (IDS) 192.168.5.105:2776 203.206.129.17:80 TCP
13/03/2009 1:39:17 PM Packet blocked by active defense (IDS) 192.168.5.105:2770 202.58.38.94:80 TCP
13/03/2009 1:39:06 PM Packet blocked by active defense (IDS) 192.168.5.105:2776 203.206.129.17:80 TCP
13/03/2009 1:39:04 PM Packet blocked by active defense (IDS) 192.168.5.105:2770 202.58.38.94:80 TCP
13/03/2009 1:38:59 PM Packet blocked by active defense (IDS) 192.168.5.105:2776 203.206.129.17:80 TCP
13/03/2009 1:38:58 PM Packet blocked by active defense (IDS) 192.168.5.105:2770 202.58.38.94:80 TCP
13/03/2009 1:38:56 PM Packet blocked by active defense (IDS) 192.168.5.105:2776 203.206.129.17:80 TCP
13/03/2009 1:38:55 PM Packet blocked by active defense (IDS) 192.168.5.105:2770 202.58.38.94:80 TCP
13/03/2009 1:38:54 PM Packet blocked by active defense (IDS) 192.168.5.105:2776 203.206.129.17:80 TCP
13/03/2009 1:38:53 PM Packet blocked by active defense (IDS) 192.168.5.105:2770 202.58.38.94:80 TCP
13/03/2009 1:38:20 PM Packet blocked by active defense (IDS) 192.168.5.105:2738 193.149.47.82:80 TCP
13/03/2009 1:38:20 PM Packet blocked by active defense (IDS) 192.168.5.105:2748 193.149.47.98:80 TCP
13/03/2009 1:38:19 PM Packet blocked by active defense (IDS) 192.168.5.105:2796 203.206.129.24:80 TCP

13/03/2009 1:37:52 PM Packet blocked by active defense (IDS) 202.58.38.95:80 192.168.5.105:2730 TCP
13/03/2009 1:37:52 PM Packet blocked by active defense (IDS) 202.58.38.95:80 192.168.5.105:2728 TCP
13/03/2009 1:37:52 PM Packet blocked by active defense (IDS) 202.58.38.95:80 192.168.5.105:2726 TCP
13/03/2009 1:37:52 PM Packet blocked by active defense (IDS) 202.58.38.95:80 192.168.5.105:2724 TCP


13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 65.175.38.194:80 192.168.5.105:2686 TCP
13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 65.175.38.194:80 192.168.5.105:2684 TCP
13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 65.175.38.194:80 192.168.5.105:2676 TCP
13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 65.175.38.194:80 192.168.5.105:2674 TCP
13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2666 TCP
13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2664 TCP
13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2662 TCP
13/03/2009 1:07:56 PM Packet blocked by active defense (IDS) 209.85.143.127:80 192.168.5.105:2660 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2654 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2650 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2652 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2648 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2646 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2644 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2642 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2640 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2638 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2636 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 208.117.236.73:80 192.168.5.105:2632 TCP
13/03/2009 1:07:55 PM Packet blocked by active defense (IDS) 209.85.143.127:80 192.168.5.105:2628 TCP
13/03/2009 1:07:54 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2622 TCP
13/03/2009 1:07:54 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2620 TCP
13/03/2009 1:07:54 PM Packet blocked by active defense (IDS) 208.117.236.73:80 192.168.5.105:2618 TCP
13/03/2009 1:07:54 PM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:2616 TCP
13/03/2009 1:07:54 PM Packet blocked by active defense (IDS) 209.85.143.127:80 192.168.5.105:2614 TCP
13/03/2009 1:07:49 PM Packet blocked by active defense (IDS) 208.117.236.73:80 192.168.5.105:2462 TCP

13/03/2009 1:05:03 PM Packet blocked by active defense (IDS) 192.168.5.105:2548 195.189.143.187:80 TCP
13/03/2009 1:04:23 PM Packet blocked by active defense (IDS) 192.168.5.105:2548 195.189.143.187:80 TCP
13/03/2009 1:04:03 PM Packet blocked by active defense (IDS) 192.168.5.105:2548 195.189.143.187:80 TCP
13/03/2009 1:03:53 PM Packet blocked by active defense (IDS) 192.168.5.105:2548 195.189.143.187:80 TCP
13/03/2009 1:03:48 PM Packet blocked by active defense (IDS) 192.168.5.105:2548 195.189.143.187:80 TCP
13/03/2009 1:03:45 PM Packet blocked by active defense (IDS) 192.168.5.105:2548 195.189.143.187:80 TCP
13/03/2009 1:03:36 PM Packet blocked by active defense (IDS) 209.85.143.127:80 192.168.5.105:2540 TCP
13/03/2009 11:18:14 AM Packet blocked by active defense (IDS) 192.168.5.105:1877 203.206.129.19:80 TCP
13/03/2009 11:18:03 AM Packet blocked by active defense (IDS) 192.168.5.105:1879 203.206.129.25:80 TCP
13/03/2009 11:17:36 AM Packet blocked by active defense (IDS) 192.168.5.105:1877 203.206.129.19:80 TCP
13/03/2009 11:17:31 AM Packet blocked by active defense (IDS) 192.168.5.105:1879 203.206.129.25:80 TCP
13/03/2009 11:17:16 AM Packet blocked by active defense (IDS) 192.168.5.105:1877 203.206.129.19:80 TCP
13/03/2009 11:17:15 AM Packet blocked by active defense (IDS) 192.168.5.105:1879 203.206.129.25:80 TCP
13/03/2009 11:17:07 AM Packet blocked by active defense (IDS) 192.168.5.105:1879 203.206.129.25:80 TCP
13/03/2009 11:17:07 AM Packet blocked by active defense (IDS) 192.168.5.105:1877 203.206.129.19:80 TCP
13/03/2009 11:17:03 AM Packet blocked by active defense (IDS) 192.168.5.105:1879 203.206.129.25:80 TCP
13/03/2009 11:17:02 AM Packet blocked by active defense (IDS) 192.168.5.105:1877 203.206.129.19:80 TCP
13/03/2009 11:17:01 AM Packet blocked by active defense (IDS) 192.168.5.105:1879 203.206.129.25:80 TCP
13/03/2009 11:17:00 AM Packet blocked by active defense (IDS) 192.168.5.105:1877 203.206.129.19:80 TCP

13/03/2009 11:16:27 AM Packet blocked by active defense (IDS) 203.206.129.19:80 192.168.5.105:1827 TCP
13/03/2009 11:16:26 AM Packet blocked by active defense (IDS) 66.118.145.16:80 192.168.5.105:1801 TCP
13/03/2009 11:16:26 AM Packet blocked by active defense (IDS) 64.182.45.231:80 192.168.5.105:1799 TCP
13/03/2009 11:16:26 AM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:1797 TCP
13/03/2009 11:16:26 AM Packet blocked by active defense (IDS) 66.249.89.118:80 192.168.5.105:1795 TCP
13/03/2009 11:16:25 AM Packet blocked by active defense (IDS) 208.117.236.73:80 192.168.5.105:1793 TCP
13/03/2009 11:16:25 AM Packet blocked by active defense (IDS) 208.117.236.73:80 192.168.5.105:1791 TCP
13/03/2009 11:16:25 AM Packet blocked by active defense (IDS) 208.117.236.73:80 192.168.5.105:1789 TCP
13/03/2009 11:16:25 AM Packet blocked by active defense (IDS) 209.16.235.47:80 192.168.5.105:1787 TCP
13/03/2009 11:16:25 AM Packet blocked by active defense (IDS) 209.16.235.47:80 192.168.5.105:1785 TCP
13/03/2009 11:16:25 AM Packet blocked by active defense (IDS) 209.16.235.47:80 192.168.5.105:1781 TCP
13/03/2009 11:16:25 AM Packet blocked by active defense (IDS) 209.16.235.45:80 192.168.5.105:1779 TCP
13/03/2009 11:12:09 AM Packet blocked by active defense (IDS) 64.182.45.231:80 192.168.5.105:1777 TCP
13/03/2009 11:12:09 AM Packet blocked by active defense (IDS) 64.182.45.231:80 192.168.5.105:1767 TCP
13/03/2009 11:12:08 AM Packet blocked by active defense (IDS) 64.38.34.114:80 192.168.5.105:1747 TCP
13/03/2009 11:12:08 AM Packet blocked by active defense (IDS) 64.38.34.114:80 192.168.5.105:1731 TCP
13/03/2009 11:12:07 AM Packet blocked by active defense (IDS) 64.38.34.114:80 192.168.5.105:1729 TCP
13/03/2009 11:12:07 AM Packet blocked by active defense (IDS) 216.252.125.76:80 192.168.5.105:1709 TCP
13/03/2009 11:12:07 AM Packet blocked by active defense (IDS) 216.145.50.247:80 192.168.5.105:1699 TCP
13/03/2009 11:12:06 AM Packet blocked by active defense (IDS) 203.206.129.18:80 192.168.5.105:1691 TCP
13/03/2009 8:26:10 AM Packet blocked by active defense (IDS) 202.58.38.93:80 192.168.5.105:2990 TCP
13/03/2009 8:26:10 AM Packet blocked by active defense (IDS) 203.5.76.32:80 192.168.5.105:2988 TCP
13/03/2009 8:26:10 AM Packet blocked by active defense (IDS) 203.5.76.27:80 192.168.5.105:2976 TCP
13/03/2009 8:26:09 AM Packet blocked by active defense (IDS) 203.5.76.17:80 192.168.5.105:2960 TCP
13/03/2009 8:26:08 AM Packet blocked by active defense (IDS) 132.181.106.4:80 192.168.5.105:2932 TCP
13/03/2009 8:26:08 AM Packet blocked by active defense (IDS) 203.5.76.26:80 192.168.5.105:2922 TCP
13/03/2009 8:26:08 AM Packet blocked by active defense (IDS) 193.149.47.98:80 192.168.5.105:2916 TCP
13/03/2009 8:26:08 AM Packet blocked by active defense (IDS) 193.149.47.98:80 192.168.5.105:2914 TCP
13/03/2009 8:26:08 AM Packet blocked by active defense (IDS) 193.149.47.82:80 192.168.5.105:2912 TCP
13/03/2009 8:26:08 AM Packet blocked by active defense (IDS) 193.149.47.82:80 192.168.5.105:2910 TCP
13/03/2009 8:26:07 AM Packet blocked by active defense (IDS) 202.58.38.93:80 192.168.5.105:2900 TCP
13/03/2009 8:26:07 AM Packet blocked by active defense (IDS) 202.58.38.93:80 192.168.5.105:2898 TCP
13/03/2009 8:26:07 AM Packet blocked by active defense (IDS) 132.181.70.3:80 192.168.5.105:2896 TCP

13/03/2009 8:05:20 AM Detected DNS cache poisoning attack 202.177.198.1:53 192.168.5.105:50817 UDP
13/03/2009 8:05:20 AM Detected DNS cache poisoning attack 202.177.198.1:53 192.168.5.105:63906 UDP
13/03/2009 5:48:21 AM Detected DNS cache poisoning attack 202.177.198.1:53 192.168.5.105:57418 UDP
13/03/2009 5:48:21 AM Detected DNS cache poisoning attack 202.177.198.1:53 192.168.5.105:56581 UDP
13/03/2009 5:42:12 AM Detected DNS cache poisoning attack 202.177.198.1:53 192.168.5.105:57559 UDP
13/03/2009 5:28:55 AM Detected DNS cache poisoning attack 202.177.198.1:53 192.168.5.105:56933 UDP
12/03/2009 8:02:40 PM Detected DNS cache poisoning attack 202.177.198.1:53 192.168.5.105:63888 UDP " }-

[Stem]

-{ Quote: "A copy of my log file." }-

I am not sure what you are trying to show. Where you blocked from Internet access during the times in the log?

- Stem

[bodgy]

-{ Quote: "I am not sure what you are trying to show. Where you blocked from Internet access during the times in the log?

- Stem" }-

Yes indeed, you did ask me to post the log in post 82.

I would expect to occasionally have incoming blocked, by why outgoing? Either way, I lose all external access whilst the events above are occuring.

I have unticked the 'block unsafe addresses after attack detection'.

Under zones the trusted zone automatically has 127.0.0.1 with subnet 192.168.5.0 and it also lists the IPS's DNS servers and I have added 192.168.5.100 - which is my router, to see if that made a difference.


Colin

[Novicex]

-{ Quote: "Well, after some consideration I decided to uninstall ESS 4 (again) and download NOD32 and Online Armore or Comodo. I decided not to return to ESS3 because independent testing shows its firewall to be not very effective at all.

Take a look: http://www.matousec.com/projects/firewall-challenge/results.php

I can't waste anymore time on ESS4 considering ESET's silence on the issues brought to light here. Hope you all can work it out ..." }-


Cool;D - Online Armor's broad range of features help keep you safe when suring the internet. I want surfing, not suring the internet. Its on Product Features main page. And belive me man thats fuc*** ratings on many sites is only for a private advertisement.

[TBR]

Went back to version 3 myself, working a treat - no issues.

[zfactor]

i have uninstalled it myself and for the time being went back to nis2009 and vipre on my other machine. ill try it again maybe when they figure this mess out. i personally didnt like ver3 to much and had hopes for ver4 and this is not at all what i expected. id try it again maybe once all these reports are gone

[bodgy]

As i've just posted in another thread, I took the plunge and installed v4 on my laptop - works fine.

I wonder if it is just XP that is more likely to have the firewall problem?

Colin

[The Nodder]

I have it with Vista.

[sogood]

I changed my mind.... I decided to uninstall ESS4 completely now instead of waiting till my trial version expires.... Because disabling its firewall with its red icon showing at tray bar makes me feel unsecure when using the internet.

So I'm moving to Kaspersky trial version now. If I have no problem with their software, then I'll choose Kaspersky for 1 year.... I'm really glad that I use ESS4 trial version instead of buying it directly, so I can know if it works for my laptop... Unfortunately, its firewall doesn't work... So bye bye Eset...

[Uroboros]

-{ Quote: "I have it with Vista." }-

Same here.

Does this problem happen to both persons with AND without a router? Or is being behind a router the common link?

At this point it just seems strange that v4 should work fine for some people and not for others.

[Marcos]

-{ Quote: "Same here.
" }-

Does the problem persist even if you disable all IDS rules? If you enable logging of all blocked connection attempts in the IDS setup, does the firewall log show blocked connection attempts?

[bodgy]

-{ Quote: "

Does this problem happen to both persons with AND without a router? Or is being behind a router the common link?

" }-

I haven't tried it without the router, but then my laptop connects via the router's wireless lan, so that probably isn't the problem.

I downloaded Kapersky and didn't like it, so uninstalled and in the process I went through registry and deleted all references to all previous firewalls - Eset, Kerio, Kapersky (I only have one installed at a time, but discovered some orphan entries for Eset v3 as well as the two K's).

I then re-installed v4 BUT haven't updated the database. It's been on for 1.5 hours and has yet to block the internet connection. I'll see what happens after a reboot, and then after it's performed an update tomorrow.

Colin

[silverfox55]

Why is it only happening with v4 and not v3 ??

something is really wrong here, it should work straight out of the box without changing any parameters. Same PC everything the same but v4 breaks internet connection or slows it down so much it is unusable. Please can we some forward movement on this problem.

[zfactor]

-{ Quote: "Does the problem persist even if you disable all IDS rules? If you enable logging of all blocked connection attempts in the IDS setup, does the firewall log show blocked connection attempts?" }-

for me with every ids disabled the problem persists. if i turn off the firewall i can connect to the internet but even then for some reason it a lot slower than normal.

[Marcos]

-{ Quote: "for me with every ids disabled the problem persists. if i turn off the firewall i can connect to the internet but even then for some reason it a lot slower than normal." }-

Does this happen on Vista only?

[guest]

I am also having problems with ESET SS v4.
Have disabled all IDS rules. firewall log is full of Packet blocked by active defense (IDS). sometimes web pages are slow to load and sometimes do not load at all, refreshing will load them. With onling gaming after a few minutes ping rate gets high in the the 2000ms range where normally its 50ms.
Gonna try online gaming with firewall disabled.

With all the IDS rules enabled and Block unsafe address after detection enabled all sorts of addresses were getting blocked even computers on the local network.

OS is Vista 64bit.

[laneseda]

I must confess my disappointment with ESS4.0. I've used ESS3.0 ever since it came out and NOD32 2.7 before that. I can understand that there are bound to be teething problems with beta software, but version 4.0 has been released as a completed suite and still does not work as it ought to do - at least in my case.

I followed the instructions provided by ESET regarding uninstalling 3.0 and deleting the three ESET folders listed. It installs, but when I turn the system off and back on again the next day, a message informs me that ESS 4.0 cannot connect to the (Windows XP HOme SP3 - fully updated) kernel. Fair enough; maybe I stuffed up. So I go through the entire routine, re-delete everything and re-install. This time no firewall. So I run SysInspector and email the results to ESET with a detailed explanation. After a week, I've still not heared from them (not even an acknowledgement of receipt of the email). In the meanwhile I revert to 3.0. In the meantime I decide I must be doing something fundamentally wrong. So I download the 4.0 suite again (in case something's changed), go through the uninstallation/installation process and voila! it's installed. I update the virus database (8MB or so) and do a scan. No threats detected. Brilliant. I can rest peacefully now. I turn off my system and watch the grass grow for about three hours. Then I re-start the computer and guess what! A message says the anti-virus is not installed. So I uninstall / re-install (I'm becoming bloody good at this by now, even if I say so myself) and am back to 3.0.

I guess I'll stay with 3.0 until ESET either re-learn the basic principles of civility or software development. If neither happens before my licence runs out, I'll wish them well, thank them for the years of genuine service and take my custom elsewhere. At this time the Comodo suite is looking very good.

My departure will hardly cause ESET to fail as a business, but I will be satisfied in my mind that I stood by my principles. At no time did I offer ESET currency which was refused or was not accepted as legal tender.

Regards,
Lane

[RonZ]

-{ Quote: "Does this happen on Vista only?" }-

No, XP Pro SP3 had the problem in my case. FWIW I noticed that many of those who reported problems were using wired connections and RealTek network cards.

[Forellenblau]

I also have Win XP SP3 and a wired Realtec-NIC (RTL 8168/8111) on an Asus P5B Motherboard.

Forellenblau

[RonZ]

-{ Quote: "I also have Win XP SP3 and a wired Realtec-NIC (RTL 8168/8111) on an Asus P5B Motherboard.

Forellenblau" }-
My NIC is a Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC. As I stated in an earlier post, I also have two Laptops that connect via wireless 802.11g. They both have ESS4 and are working pretty well.

[Marcos]

-{ Quote: "I must confess my disappointment with ESS4.0. I've used ESS3.0 ever since it came out and NOD32 2.7 before that. I can understand that there are bound to be teething problems with beta software, but version 4.0 has been released as a completed suite and still does not work as it ought to do - at least in my case.
" }-

The beta as well as Release Candidate had been tested for several months by thousands of testers and no one had reported such issues. Otherwise we would have looked into it and fixed it before the beta went final.

The firewall issues are currently being looked at and a fix will be released through an automatic update. At the first stage, the fix will be delivered to the users with the "Test mode" option enabled in the update setup.

[silverfox55]

Several posters have reported that the exact same problems were present in RC and Beta releases. I find it very strange that none of these problems were found by your testers but have been reported here. I sincerely hope these problems are fixed soon so I can revert to Ver4.

[hawki]

-{ Quote: "The beta as well as Release Candidate had been tested for several months by thousands of testers and no one had reported such issues. Otherwise we would have looked into it and fixed it before the beta went final.

The firewall issues are currently being looked at and a fix will be released through an automatic update. At the first stage, the fix will be delivered to the users with the "Test mode" option enabled in the update setup." }-

http://www.wilderssecurity.com/showthread.php?p=1408366#post1408366

(I did try the final V4 and had the same result == no internet access and could re-establish it only by a fresh Vista 64 install.)

http://www.wilderssecurity.com/showthread.php?t=227206

http://www.wilderssecurity.com/showthread.php?t=233729

This has been very frustrating to say the least. ESET SS V4 is a "Kick-Ass" awesome program and myself and others can't use it :-(

[RonZ]

-{ Quote: "
The firewall issues are currently being looked at and a fix will be released through an automatic update. At the first stage, the fix will be delivered to the users with the "Test mode" option enabled in the update setup." }-

You should post an announcement when the fix is available so that those who have given up on ESS4 and gone back to ESS3 or on something else entirely will know when to try a fresh install.

[silverfox55]

-{ Quote: "You should post an announcement when the fix is available so that those who have given up on ESS4 and gone back to ESS3 or on something else entirely will know when to try a fresh install." }-

Well said, I hope we get an announcement very soon.

[HealingStargate]

I made my last attempt to install V4. My license on V3 was soon up and I thought I might be lucky.
I really like ESET and as many of us are valiantly working at using the product.
It just does not work properly and that is the final word on it.
Until I read here that it is working properly I went back to V3.
KOR-

[bodgy]

Referring back to my post somewhere on here, my latest attempt at installing v4 seems to have been successful, I've even been able to download MS Visual Studio (1 hour) with no hangs, blocks and I've been surfing (the web kind) during the download.

So the only thing different to other installs is that I trawled through registry manually and deleted any references to v3 and ancient Kerio/Kapesrsky left overs before installing v4,and I've changed local zone to strict rather than hsaring. I've had a couple of slow downs, but no outright blocking.

I'm set for interactive. One thing I've noticed is under WebAccess protection\Web browsers the auto ticked programs are different this time around, in as much it has extra programs it thinks are browsers.

I now have:

IE 7 - obviously
Opera 9.xx - obviously

Added:
A program that uses MS One-Click install/update system
svchost
Manager.exe - not sure what this is from, think it's a Windows install- in downloaded program files\conflict.1\Manager.exe

It's a mystery!

Colin

[zfactor]

-{ Quote: "Does this happen on Vista only?" }-

not sure i dont use xp any more so for me yes its vista only but i have seen other say they had the same issue with xp sp3 as well.

[Erroneus]

Uninstalled it. Eset lost me as a customer, that's for sure.
Nod32 might be good, but SS is clearly utter crap and customer support is not to be found, so there is no way I can trust Eset.

[camperguy01]

Same problem that everyone else is having. My connection drops every 10 minutes or so. Shame on you Eset.

I work for a Fortune 500 company that is replacing its virus software. I had plans to give you guys a plug since I've been so happy with V3. You just lost my recommendation.

Shame on you for releasing this garbage to the public. :thumbd:

[Wolfeymole]

Well I've been running V3 since last June on Vista with Firefox, won't use IE unless someone holds a gun to my head.
Got an email from Eset re V4 so I uninstalled V3, installed V4 and not had one single issue whatsoever.

[silverfox55]

I have V3 on vista home prem and firefox with no problems at all. Love it.
Tried V4 and had to remove it. To be honest a trainee analyst/programmer could have done it better.

Glad you seem to be the only customer who has got it to work and continues to work. There might be light at the end of a long dark tunnel then.

[funkydude]

-{ Quote: "I have V3 on vista home prem and firefox with no problems at all. Love it.
Tried V4 and had to remove it. To be honest a trainee analyst/programmer could have done it better.

Glad you seem to be the only customer who has got it to work and continues to work. There might be light at the end of a long dark tunnel then." }-

Only customer? Stop blowing this way out of proportion. There's more users without this problem than with it. If it was SOOO easy to replicate it would have been fixed already.

[jspratjr]

Installed on 32-bit and 64-bit Vista machines this morning without a problem.

Uninstalled version 3 using ESET's instructions (and I use Total Uninstall).

Love the product (been using for a few years) but I am disappointed with ESET's response on this forum.

[psi2003]

It's possible that ESS V4 don't work with REALTEK NIC drivers ????????????????????????


Hmmmmm......:gack:

[jspratjr]

Don't think so, both of my machines use Realtek drivers.

[RonZ]

-{ Quote: "It's possible that ESS V4 don't work with REALTEK NIC drivers ????????????????????????


Hmmmmm......:gack:" }-

Possible, but also possible that the problem is with the RealTek nics. I've seen lots of complaints about them. FYI there is a new driver available for the RealTek RTL8168/8111 dated Feb 26, 2009. I found it by right clicking on the RealTek nic in Device Manager and selecting update driver and letting it search on the net. Sure enough, there was one. I can't tell if this solves the problem with ESS4 because I've already moved on to another solution for my problem machine, but someone might want to give it a try and report back to the group.

[chromiumdomium]

-{ Quote: "Possible, but also possible that the problem is with the RealTek nics. I've seen lots of complaints about them. FYI there is a new driver available for the RealTek RTL8168/8111 dated Feb 26, 2009. I found it by right clicking on the RealTek nic in Device Manager and selecting update driver and letting it search on the net. Sure enough, there was one. I can't tell if this solves the problem with ESS4 because I've already moved on to another solution for my problem machine, but someone might want to give it a try and report back to the group." }-

I believe there was a recent update via MS Update site for the Realtek NIC you mention. This was/is installed on my PC. All was fine with V3 but V4 fails. Incidentally I've had other issues with random disconnections or rather re-connections! which only started (as far as I can re-call) after the updated driver was installed. Maybe this driver is actually where the problem originates?

Regards,

Greg

[EasternOkie]

Stop telling people that it's in their own mind. If they did not have a problem they would not be posting. I have a Atheros NIC Build into Asus MB and I had to remove ESS 4 due to many disconnects on Windows XP SP3.

[RonZ]

-{ Quote: "I believe there was a recent update via MS Update site for the Realtek NIC you mention. This was/is installed on my PC. All was fine with V3 but V4 fails. Incidentally I've had other issues with random disconnections or rather re-connections! which only started (as far as I can re-call) after the updated driver was installed. Maybe this driver is actually where the problem originates?

Regards,

Greg" }-

No, I was having the problem with the old driver. Would probably still have the same problem with the new driver. Point is that that since many users are NOT having problems it might be worth the effort to find out what, if anything, those of us who ARE having problems have in common.

[MasterTB]

-{ Quote: "The beta as well as Release Candidate had been tested for several months by thousands of testers and no one had reported such issues. Otherwise we would have looked into it and fixed it before the beta went final.

The firewall issues are currently being looked at and a fix will be released through an automatic update. At the first stage, the fix will be delivered to the users with the "Test mode" option enabled in the update setup." }-


I'm not sure what to feel about this statement of yours.
Enabling Test mode -even before all this major problems with the firewall started- made most of our computers revert to a prior firewall version (an older module than that which shipped with V4 final...)http://www.wilderssecurity.com/showpost.php?p=1418990&postcount=15 like you see here, so this is not actually a solution but a desperate attempt to correct a problem that should have never happened.
Besides, even when I'm not having this issues myself, you can see many threads in the Beta forum concerning this Firewall and Internet Browsing problems, all of which still remain in the final version so... in my non technical opinion, you went blind and released the final anyway...

Don't get me wrong, I'm not attacking Eset, like I have said many times before, I am a fan, have a license and use their programs but, you have to remember that you are a SECURITY Software Company that means that what you sell is much more important to us than other programs and so we will demand more of you... so a better answer or explanation of the issue would be appreciated.

[The Nodder]

Cant recall in which topic it was posted, but Beta testers did post that they DID report the firewall problem in beta testing.

BTW, I use a Netgear DG834 router Modem.
Asus P5Q mobo
Asus EA 4870 graphics card.
Intel DUO 8500 PSU

[miki69]

-{ Quote: "Well, after some consideration I decided to uninstall ESS 4 (again) and download NOD32 and Online Armore or Comodo. I decided not to return to ESS3 because independent testing shows its firewall to be not very effective at all.

Take a look: http://www.matousec.com/projects/firewall-challenge/results.php

I can't waste anymore time on ESS4 considering ESET's silence on the issues brought to light here. Hope you all can work it out ..." }-

Interesting article, however this one is quite opposite: http://lifehacker.com/5061933/five-best-windows-firewalls

Cheers,
Miki

[camperguy01]

I've also been forced to roll back from V4 to V3 due to the dropped internet connection issue. Not too thrilled that I dropped money on a 2 year license for a broken product, but I'm hoping Eset can get this fixed quickly.....

In the meantime, my V3 license was set to expire the end of this month. Now that I've reverted back to V3, am I out of luck with regards to getting virus updates? I was really very happy with V3. Any way to just keep V3 and continue to get virus updates?

Thanks in advance for any helpful replies.

[bodgy]

I believe you'll get updates until your licence runs out. My database is showing as 3937 20090314.

On my laptop which is very happy with v4 the database is the same build.

Colin

[miki69]

-{ Quote: "Any way to just keep V3 and continue to get virus updates?

Thanks in advance for any helpful replies." }-

You can always apply to free/trial username/password at ESET, just to prolong signature updates if your account expires before ESET offer fixes. Not the best solution, but it's only temp.

BR
Miki

[camperguy01]

-{ Quote: "I believe you'll get updates until your licence runs out. My database is showing as 3937 20090314.

On my laptop which is very happy with v4 the database is the same build.

Colin" }-

Thanks for replying Colin.

Just for my own clarification, which license?

V3 is set to expire the end of this month. I just recently purchased a license for V4 that will expire in March of 2011.

If I rolled back to using the V3 software, can I somehow continue to receive virus updates on V3 with the license I paid for in V4?

Sorry if the question is lame. I guess I don't understand the correlation between V3/V4 and how it relates to receiving virus updates...

[camperguy01]

-{ Quote: "You can always apply to free/trial username/password at ESET, just to prolong signature updates if your account expires before ESET offer fixes. Not the best solution, but it's only temp.

BR
Miki" }-

Thanks for replying.

Unless I'm misunderstanding, I'm not sure how a free trial would help. I can't use V4 and I already own V3...

Thanks though....

[bodgy]

Well my subscription runs to next year. Is your licence for v4 the same as the one given for v3 ? Or have you re-installed v3 and left the user name/password blank for the moment?

I would assume if the v4 details are accepted by the v3 install, all is well, if it sulks then all is not so good :(

Colin

[camperguy01]

-{ Quote: "Well my subscription runs to next year. Is your licence for v4 the same as the one given for v3 ? Or have you re-installed v3 and left the user name/password blank for the moment?

I would assume if the v4 details are accepted by the v3 install, all is well, if it sulks then all is not so good :(

Colin" }-

The username and password are the same for -

* The V3 license I purchased one year ago.
* The V4 license I purchased 2 days ago.

Due to V4/internet issues, I completely uninstalled V4 and reinstalled V3.

Really not understanding why Eset prompts you to an upgrade when all I really want is to continue to use the working software I had with virus updates. Pretty frustrating......

Thanks again for taking the time to reply.

[RonZ]

-{ Quote: "Interesting article, however this one is quite opposite: http://lifehacker.com/5061933/five-best-windows-firewalls

Cheers,
Miki" }-

That is based on "popular" vote, not actual testing. How many here would vote for ESET as the BEST FIREWALL available?:thumbd:

[miki69]

Of course, and as I already wrote ESS was built on NOD32 glory, just wanted to point out that many "reviews" can be misleading. If you check some popular web sites testing "the best AV 2008" you'll see that each site has their own top 10 list, quite different though.

Cheers,
Miki

[The Nodder]

-{ Quote: "I've also been forced to roll back from V4 to V3 due to the dropped internet connection issue. Not too thrilled that I dropped money on a 2 year license for a broken product, but I'm hoping Eset can get this fixed quickly.....

In the meantime, my V3 license was set to expire the end of this month. Now that I've reverted back to V3, am I out of luck with regards to getting virus updates? I was really very happy with V3. Any way to just keep V3 and continue to get virus updates?

Thanks in advance for any helpful replies." }-

Your ESS V4 licence will work on V3 and NOD32 also.

[funkydude]

Well ESET's firewall is light, and with the change to WFP in v4 it will be even lighter, but yeah.., bugs first, glory later.

[GaryRW]

While I haven't had internet disconnections, I have noticed IDS randomly stomps on even user defined rules. Mostly this is temporary and rules restore eventually. My money's on IDS being the culprit.......

-{ Quote: "I've been testing Smart Security 4 for a couple days now in preparation of a deployment on our company network. So far, I've had very strange issues with the Firewall. In order to get even a volatile internet connection (in automatic mode) I've had to tune it quite a bit as well as look at the logs to try and get an idea as to why my connection drops all of a sudden. Before any tuning, I was completely blocked from all internet access on any port/program.

According to the logs, my last outage was:

"Packet blocked by active defense (IDS)"
Source: 65.175.38.194:80 (which is Wilders IP btw)
Target: my private IP
Protocol: TCP

During that outage, all internet connected programs were disconnected.

So far, I've made the following changes which have improved my connection but I still get random disconnects:

Disabled ARP and DNS poisoning detection
Enabled allow UPNP in trusted zone
Enabled maintain inactive TCP connections
Switched to "Applications marked..." for protocol filtering.

So, any idea why the IDS drops my connection? Obviously, disabling the firewall works like a champ, but that's not an option." }-

[HealingStargate]

[B]Here is the response I received from ESET, yesterday, March 17, 2009.
I would like to see some comments on what others think.

~Private email removed. See the Terms Of Service. (http://www.wilderssecurity.com/tos.php)~

[silverfox55]

Well, at least it is something.

I would comment,
1) It is still not "works out of the box" and many people do not like fiddling with settings and prefer to leave them "as is"
2) I am tempted to take an image and try ver4 but to be honest I have a nagging doubt that it will work.
3) It is a very poor get out suggesting using antivirus and windows firewall if you have paid for the suite. Do you get a refund if you have to use the windows firewall ?
4) Is this the end of their bug fix ??

[miki69]

-{ Quote: "1) It is still not "works out of the box" and many people do not like fiddling with settings and prefer to leave them "as is"" }-
True

-{ Quote: "2) I am tempted to take an image and try ver4 but to be honest I have a nagging doubt that it will work." }-

Why would you take an image for? you can just try with advance settings-> update-> test mode ON/OFF to make it work (and all you need to do is restart, not more than that).

-{ Quote: "3) It is a very poor get out suggesting using antivirus and windows firewall if you have paid for the suite. Do you get a refund if you have to use the windows firewall ?" }-
I believe this is temp solution

In nice words, they offered him to disable firewall :thumbd:

Cheers,
Miki

[HealingStargate]

I agree, the suggestion to use the Windows firewall was really not what I was looking to do.
Any other security suite I have used simply 'works out of the box' without any tweaking to be able to be on the internet.
I am left with V3 and will stay with that for the time being.
Looking around now for other possibilities.
KOR-

[silverfox55]

-{ Quote: "

Why would you take an image for? you can just try with advance settings-> update-> test mode ON/OFF to make it work (and all you need to do is restart, not more than that).

Miki" }-

I went back to using ver3 as ver4 crippled my connection

[miki69]

-{ Quote: "I agree, the suggestion to use the Windows firewall was really not what I was looking to do.
Any other security suite I have used simply 'works out of the box' without any tweaking to be able to be on the internet.
I am left with V3 and will stay with that for the time being.
Looking around now for other possibilities.
KOR-" }-
Well you can use NOD32 v4 (anyhow it's the same license) combined with Online Armor FREE firewall and see how this will work out for you until ESET comes with the solution, then you can go back to ESS.


-{ Quote: "I went back to using ver3 as ver4 crippled my connection" }-

At first I did too :), but then I decided to force it to work.

Just for the record, I had v3, installed v4, reinstalled v3, reinstalled v4 (twice) and my laptop is still great, so no need to fear that one might need to reinstall Vista.

Cheers,
Miki

[eisefr]

-{ Quote: "True


I believe this is temp solution


Miki" }-

Seems not to be.

Some sites are still blocked.. startet after 5 minutes temp. solution.... what a crap.

[miki69]

-{ Quote: "Seems not to be.

Some sites are still blocked.. startet after 5 minutes temp. solution.... what a crap." }-

did you try this:http://www.wilderssecurity.com/showthread.php?t=236335

Worked for me!

Cheers,
Miki

[RonZ]

-{ Quote: "Well you can use NOD32 v4 (anyhow it's the same license) combined with Online Armor FREE firewall and see how this will work out for you until ESET comes with the solution, then you can go back to ESS. " }-

This is what I chose to do and after a very brief learning period with Online Armor I had it working very well with NOD32 v4. I liked Online Armor so much that when they sent me an offer of $10 (USD) off if I bought the paid version within within 5 days, I decided to go for it. I think OA is easier to use than the ESS Firewall and available test results seem to indicate that it is more effective as well. I'll stick with NOD32 v4, I have no problems with that product at all. This is just proves once again that suite security solutions are not always sweet deals for end users. Just because a company makes a killer anti-virus product doesn't mean that their firewall will be up to the same standards.

[stratoc]

-{ Quote: "This is what I chose to do and after a very brief learning period with Online Armor I had it working very well with NOD32 v4. I liked Online Armor so much that when they sent me an offer of $10 (USD) off if I bought the paid version within within 5 days, I decided to go for it. I think OA is easier to use than the ESS Firewall and available test results seem to indicate that it is more effective as well. I'll stick with NOD32 v4, I have no problems with that product at all. This is just proves once again that suite security solutions are not always sweet deals for end users. Just because a company makes a killer anti-virus product doesn't mean that their firewall will be up to the same standards." }-
exactly! i know they want a bigger market and are following the rest of the pack, but stick at what you do best:)

[miki69]

RonZ,

you know there's say "Nothing is perfect" but this comes pretty close! Enjoy :)

[Forellenblau]

I gave V4 another try and disabled the settings as recommended from Eset (as shown in that recently deleted forum post by the Mod):

- ARP Poisoning attack detection
- DNS Poisoning attack detection
- TCP Desynchronisation attack detection
- Reverse TCP Desynchronisation attack detection

Nothing was better... Every 15 to 20 mins lost of connection...
I'm now back to V3!

Forellenblau

[anruler]

-{ Quote: "I gave V4 another try and disabled the settings as recommended from Eset (as shown in that recently deleted forum post by the Mod):

- ARP Poisoning attack detection
- DNS Poisoning attack detection
- TCP Desynchronisation attack detection
- Reverse TCP Desynchronisation attack detection

Nothing was better... Every 15 to 20 mins lost of connection...
I'm now back to V3!

Forellenblau" }- Same behavior for my system, I also switched back to v3 and everything is working fine again (no internet problems!!!). Before I switched back I tested the described settings, and the problem is NOT gone, I still had the internet connection problems!!!

[Marcos]

Those having problems with Internet connectivity after installing ESS v4, please drop me a PM. There's a newer firewall module available that should resolve all these issues. If you're willing to try it out before we make it available via automatic update (for those with the test mode enabled at the first stage), please let me know. It has already been provided to some clients with a positive response.

[pirat]

-{ Quote: "Those having problems with Internet connectivity after installing ESS v4, please drop me a PM. There's a newer firewall module available that should resolve all these issues. If you're willing to try it out before we make it available via automatic update (for those with the test mode enabled at the first stage), please let me know. It has already been provided to some clients with a positive response." }-
Hello! How can I get this firewall module? I am willing to try it!

[miki69]

send him private message (PM), that's what he said. Click on his name, and then you'll see "send private message".

[pirat]

-{ Quote: "send him private message (PM), that's what he said. Click on his name, and then you'll see "send private message"." }-
The private messaging system is currently unavailable.

[Marcos]

I've sent the new module to a couple of people who have contacted me. After they confirm the new module works fine for them, we'll make it available for public providing that you have test mode enabled in the update setup.

[pomocnik]

i´ve got activated test mode, few minutes ago was firewall again "actualised" to 1044 (20090121)

[Forellenblau]

I got from Marcos the new Personal firewall module: 1045 (20090318 ) and for an hour now i have no more internet drop outs. I will monitor it the next hours and days.

It seems that finally the error is found (hopefully...)!

Forellenblau

[bodgy]

Indeed, I've been on since 5am (about 2 hours now) and no problems so far.


Colin

[camperguy01]

-{ Quote: "I got from Marcos the new Personal firewall module: 1045 (20090318 ) and for an hour now i have no more internet drop outs. I will monitor it the next hours and days.

It seems that finally the error is found (hopefully...)!

Forellenblau" }-


Woo Hoo! :thumb: :fingerscrossed:

[camperguy01]

-{ Quote: "I've sent the new module to a couple of people who have contacted me. After they confirm the new module works fine for them, we'll make it available for public providing that you have test mode enabled in the update setup." }-

Thanks for digging into this Marcos - appreciated much.

Couple of Questions - assuming the new module works, you state that we would have to enable test mode. Would we enable test mode, get the new module, and then disable test mode again? Not sure I understand the pluses/minuses of having test mode enabled.

Other question - are you able to explain what the cause of the problem was?

Thanks Marcos.

[Forellenblau]

-{ Quote: "Couple of Questions - assuming the new module works, you state that we would have to enable test mode. Would we enable test mode, get the new module, and then disable test mode again? Not sure I understand the pluses/minuses of having test mode enabled." }-

Marcos wrote in my PM that it is not necessary to enable Test Mode. I didn't enable it and the 1045 build was not overwritten by an older one. Test mode is only for beta purposes he said.

Forellenblau

[camperguy01]

-{ Quote: "Marcos wrote in my PM that it is not necessary to enable Test Mode. I didn't enable it and the 1045 build was not overwritten by an older one. Test mode is only for beta purposes he said.

Forellenblau" }-

Got it. I should have read more carefully. Thanks much for replying.

[hawki]

My network and internet connection gets destroyed when I install ESS. How do I get the update? I forget -- is there an option to not install or activate the firewall when you install ESS?

[The Nodder]

I had re-installed Vista and V4 works.

To find out if the new module works I saved that Vista and restored a vista image that was having the "firewall" problem and I got the module, its still working 10 hours now.

Its looking good.

[pomocnik]

19. 3. 2009 22:35:54 detected similar IP on network 192.168.1.1 192.168.1.2 ARP


first is my router, second is my pc - why the hell ARP?

[pomocnik]

with firewall module 1045 - internet was blocked right after the start, after cca 1 hour and few refresh of network adapter settings is now net online. how long?

[bodgy]

Interesting, I had 1045 at my last post here, shut PC down and have just rebooted and I now have firewall module 1043 (20081111).

Yup just checked the file has been overwritten, I downloaded at 4:51 am and installed by 5:00 am the modifed time is now showing as 7:52 am, along with all the other module updates.

Having said that, I have had no problems with internet access so far.


Colin

[funkydude]

With test mode on or off?

[bodgy]

-{ Quote: "With test mode on or off?" }-

Good question, I did disable test mode, but can't recall if it was before or after manually installing the module. Pretty sure I disabled it before the install.

Colin

[Forellenblau]

Internet runs without dropouts so far with 1045.

I had some problems this morning because my VPN connection together with normal Internet surfing was slowing down. I had to disable QOS in the network options and now all is well.

Forellenblau

[pomocnik]

1045 with disabled ARP poisoning detection works few hours without interruption. only problem is that after restart PC i must disable and enable my network controller.

ARP must be disabled, because when I enable it, connection is gone. attacking adress is my own firewall :-)

[silverfox55]

Looks like progress is being made, but there are still a few bugs by the looks of it.

[SBMongoos]

Clearly there's an issue. I inquired about this not long ago and got no where. Hell I even exchanged my router as I wasn't certain where the problem is and v4 still causes this problem. Today I simply lost connection but the other to PCs are running v3 with no issues. Plus the PC running v4 has no shared access to the other PCs even though it's setup correctly. This is frustrating!

I decided to use a tool to restore the registry that I booted with this a.m. and got back on. So apparently their is an issue with the firewall module. How do you tell which version you are using?

I'm running XP Pro SP3.

I have v4.0.226. I see a later version is on Eset's web site. Does this have the fix or is it still an issue?

[miki69]

You're using Beta version, latest one (final) is 4.0.314, but still it has problematic firewall 1044 (dated Jan 21 2009). You can try playing around with test mode on/off (hit F5 -> Update->Advanced update setup) to see if it clears your problem, like it did for me http://www.wilderssecurity.com/showthread.php?t=236335 , or use v3 until ESET comes with solution. You can check all your module version (right click on Eset icon in taskbar -> about)

BR
Miki

[SBMongoos]

-{ Quote: "You're using Beta version, latest one (final) is 4.0.314, but still it has problematic firewall 1044 (dated Jan 21 2009). You can try playing around with test mode on/off (hit F5 -> Update->Advanced update setup) to see if it clears your problem, like it did for me http://www.wilderssecurity.com/showthread.php?t=236335 , or use v3 until ESET comes with solution. You can check all your module version (right click on Eset icon in taskbar -> about)

BR
Miki" }-


ESS v3 reboots my PC. They never did figure it out and the ball seemed to get dropped. v4 doesn't do that. I'll look into what you said.

Sounds like I should download the latest version and install it although that's not the fix. It's a pain in the ass but it's not killing me right now.

[pomocnik]

why the hell is ESS blocking http://www.lyricsplugin.com/ ???????????????????

definitely return to V3 :-( i spent 2 days with testing and only partial succes.

[KOKOtm]

I also want to try 1045. fell free to send it to me. ;-)

[bodgy]

-{ Quote: "why the hell is ESS blocking http://www.lyricsplugin.com/ ???????????????????

definitely return to V3 :-( i spent 2 days with testing and only partial succes." }-

What happens if you whitelist that website?

Opens correctly for me.

Colin

[pomocnik]

-{ Quote: "What happens if you whitelist that website?

Opens correctly for me.

Colin" }-


whitelisted or not - same problem, after disabling FW all works ok.
ESS v4 is actually removed, im on v3.

i sent to eset few logs, few mails /they sent some tips/, from techsupp they send me also 1045...., this forum, still not satisfied with v4

good luck guys who still had some nerves and free time for testing

[funkydude]

-{ Quote: "whitelisted or not - same problem, after disabling FW all works ok.
ESS v4 is actually removed, im on v3.

i sent to eset few logs, few mails /they sent some tips/, from techsupp they send me also 1045...., this forum, still not satisfied with v4

good luck guys who still had some nerves and free time for testing" }-

v4 and v3 use the same list, so the problem is something else.

[pomocnik]

-{ Quote: "v4 and v3 use the same list, so the problem is something else." }-

what something else?

v3 installed - works
v4 installed and firewall stopped - works
v4 installed and firewall running - blocked

[robis]

Because PM is curently off.

Marcos how shoul I get this 1045? Shoud you enable it for me?

[gsapient]

Can someone send me 1045 too please?

[Farmand]

-{ Quote: "why the hell is ESS blocking http://www.lyricsplugin.com/ ???????????????????

definitely return to V3 :-( i spent 2 days with testing and only partial succes." }-


I have no problem connecting to that site.. It takes a few sec, but no problem.

[SBMongoos]

What's the status on this? I lost connection again on my ESS v4 machine on Monday, twice. Annoying!! >:(

[pirat]

Can someone send me module 1045 too please?

[dannih]

Can someone please send me the firewall module 1045 too?

[pegas]

I have sent a PM to Marcos recently (as per his instruction in another thread) but have never received 1045. As reported by others here I doubt build 1045 didn't prove itself as a final solution and probably ESET withdrew deployment of 1045 among users.

[dannih]

We started having network connectivity problems using ESS v3 on our broadcast system/network, so i came across version 4, that i NEVER should have installed......

[SEMEYE]

well, most of us are still having issues i see. I haven't checked the forums in a while and i was hoping to see some good news about the v4 firewall today. i guess i'll have to wait a bit longer.

[s4u]

yep, still the same here. therefore I choose to use ESS with Prevx on the side and disable IDS in ESS

[Marcos]

-{ Quote: "well, most of us are still having issues i see. I haven't checked the forums in a while and i was hoping to see some good news about the v4 firewall today. i guess i'll have to wait a bit longer." }-

Just a bit. Newer installers are being tested right now and will be available for download shortly. They will be announced here at Wilders as well.

[SEMEYE]

-{ Quote: "Just a bit. Newer installers are being tested right now and will be available for download shortly. They will be announced here at Wilders as well." }-

Thank you, Marcos. I'm sure I speak for all of us when I say that a fix can't come fast enough.

[proactivelover]

-{ Quote: "Just a bit. Newer installers are being tested right now and will be available for download shortly. They will be announced here at Wilders as well." }-
no new version release yet

[Marcos]

-{ Quote: "no new version release yet" }-

See here if you're having issues with ESS v4: http://www.wilderssecurity.com/showthread.php?t=237476

[silverfox55]

A bit of confusion here. The most recent post says 1044 yet previous posts say 1045 which is more recent.

Can we please have some clarification on this, and does it resolve all issues. Information from ESET is very wooly and not very clear on this Matter. Also when is this mtter going to be officially notified on this forum.

[bodgy]

-{ Quote: "A bit of confusion here. The most recent post says 1044 yet previous posts say 1045 which is more recent.

" }-

The patch is 1045 dated 25 March 2009.

But if 1044 is working for you, is it necessary to replace it?

For me it hasn't been overwritten - though if you have test mode enabled and perform a manual update - it will be.

I would suggest one extra step in the install procedure mapped out on the Eset website - don't delete the original file just rename it as ' em008_32.dat.old' or similar, that way you can always revert back if 1045 gives you problems.

Colin

Colin

[SBMongoos]

Thought this 1045 fix was going to work. However getting disconnects again.

[trial and error]

-{ Quote: "Just a bit. Newer installers are being tested right now and will be available for download shortly. They will be announced here at Wilders as well." }-

Thank you for the heads-up on this Marcos.

At the same time, I'm baffled that this fix hasn't been sent out to folks that have "Always update program components" and "Offer restart if nessecary" checked in our advanced options.

Take those off the menu if they don't do anything.

I just manually installed it and it works great here.

Yes I know it is afternoon on the 31st in the eastern USA and the fix was out on the 28th. This is a BIG PRIORITY in my mind and to many others. It SHOULD BE with Eset.
I didn't bother to contact Eset directly, I've used them since 2.4 I believe, and I have recieved the standard replies before. (I'm being nice here, but my current subscription expires at the end of the summer.) I dumped Norton right after XP SP2 came out and discovered NOD32.

I'm running Win7x64b. I don't post here regularly, but I do find the answers I need when I can't figure them out myself.

Please don't disregard this as one of the "whiney posts" that I see here and everywhere www from the immature.

** WOW, that was a super-fast response Agoretsky, didn't realise Eset valued my opinion so much :) If I'm gone for another year from here then I'm happy with it and still have an ESS license **

[agoretsky]

Hello,

ESET Smart Security v4.0.417.0 has been released which contains a number of fixes and updates. If you are experiencing a problem with a previous build of the software then please update to this version and let ESET know the results.

Regards,

Aryeh Goretsky

[eisefr]

Looks like a new BETA-Test to me.
Thats how it should be declared since problems with 1045 are already reported !

[Marcos]

-{ Quote: "Looks like a new BETA-Test to me.
Thats how it should be declared since problems with 1045 are already reported !" }-

Before making such conclusions, I'd suggest:
1, does disabling the firewall make a difference? If so, turn on the firewall and enable logging blocked connections. Then check the firewall log for details about blocked connection attempts. There might be an attack detected which causes the firewall to blocked the connection. You can try disabling IDS rules to narrow it down to the one that is blocking the connection.

2, if disabling the firewall doesn't help, go to the Protocol filtering setup and disable application protocol content filtering. Does it make a difference?

If none of the above suggestions worked, create a log from Wireshark with all communication captured and email it to support[at]eset.com along with a link to this thread.

[eisefr]

-{ Quote: "Before making such conclusions, I'd suggest:
1, does disabling the firewall make a difference? If so, turn on the firewall and enable logging blocked connections. Then check the firewall log for details about blocked connection attempts. There might be an attack detected which causes the firewall to blocked the connection. You can try disabling IDS rules to narrow it down to the one that is blocking the connection.

2, if disabling the firewall doesn't help, go to the Protocol filtering setup and disable application protocol content filtering. Does it make a difference?

If none of the above suggestions worked, create a log from Wireshark with all communication captured and email it to support[at]eset.com along with a link to this thread." }-


I dont want to TRY around anymore.

I want to pay, to downlad.. to install.. and to use !

Thats how it was with version 3.. and how it should be with version 4 !

[Marcos]

-{ Quote: "I dont want to TRY around anymore.
" }-

If you are having an issue but refuse to cooperate, you can either downgrade to v3 or explain the issue to your local distributor and ask him to refund you the money.

[Temp Member]

He should not need mess about to get it to work.

It has the same bugs from Beta through to RC as now as it was rushed for the Tech Conference.

Certainly was not fit for RTM and why should he now beta test it and waste hours of his time ?

I think I am going back to v3 for now and requesting a total refund, I had some issues with that bad 3-4 builds on v3 after .650 before they were fixed.

That's months of waiting and messing with PC instead of enjoying it.

[Hotep]

I totally agree! I have never seen such poor customer support & such a blatantly obvious condescending attitude. (Marcos) You speak to people as though everyone in this forum is a computer expert. This product should run out the box! Some glitches are expect, but it would be much easier to swallow if there was a sense of empathy for your paying customers instead of the snide comments!

"If one customer is satisfied, he may tell a few, but if one customer is dissatisfied, you better believe he will tell as many as he can!"

I love ESET products but this is becoming too much!

[SBMongoos]

Still having disconnects even after completely removing the previously updated version to .417. Other machines are fine as they are running v3.

[bodgy]

So far, I've only had one slow down connection, and that was before I rebooted after the install of 417.

I disobeyed orders and just installed over the top of 413 with 1045.

I've yet to test it on my laptop.

Desktop - XPproSP3

I have ARP/DNS poisining disabled and TCP overload and Block unsafe addresses disbaled at this moment.

It installed itself with Automatic mode enabled - I've just changed that to interactive to see if that makes a difference.

Colin

[eisefr]

-{ Quote: "If you are having an issue but refuse to cooperate, you can either downgrade to v3 or explain the issue to your local distributor and ask him to refund you the money." }-

For support:
http://screencast.com/t/t2kd8Q4Qn

[RickD]

Does the new version posted fix the internet bug?

If not then I am not going to bother putting in on untill a version is out that does.

I bought 3 coppies of this a few days ago and noticed right away my internet dropping.

I hadnt even read the forums at that time, elected to try version 3, have not had a problem since I did that and now I see this thread...

I will not put on version 4 untill it is definite that this problem is gone, why would I bother, I certainly did not pay 90 bucks to test software and have my internet crap out.

[Temp Member]

Is your issue the FW or the WEB AXX and HTTP Scanners that are messing with your surfing ?

[RickD]

I don't know which is mine, when I bought and installed the other day it was all defualt settings but I noticed within no time at all the spuradic internet dropping during just normal surfing.

[Temp Member]

Well until this new build (the fix build we got yesterday) I had no FW issues and even then it simply stops the web working not cause slow downs.

I think I have cured the new builds FW issue by getting FW .44 over .40 that Auto updates downgraded it to as soon as I installed it (may need run update in Test Mode).

I have had the WEB AXX and HTTP scanners issues in the Beta/RC and now Final builds.

For some reason disabling the AV will not fix it, you need disable the actual settings and you can then leave AV enabled.

This should make the ESS Icon Orange instead of Blue but on the Final version it only did this for 1 restart, its blue all the time.

I have stated/admitted it may only be 1 of those 2 settings to blame but I got sick fed up with trial and error of this ESS v4 so tied it down to the 2 settings and both are off till if ever ESS can fix it.

I will brave it later and turn them both on once I make sure FW and Windows Mail are ok on this build.

[SBMongoos]

Updated to .417 yesterday afternoon. Coming in this a.m. I'm dropping connections and the speed for the web (Firefox) is rather slow.

[butler360]

-{ Quote: "If you are having an issue but refuse to cooperate, you can either downgrade to v3 or explain the issue to your local distributor and ask him to refund you the money." }-

Eeek. :blink:

I have to say, the customer has a point and this response is a bit aggressive.

You guys need to come out and say, "Hey, we made a mistake. We launched the product too early. We're putting it back into beta status until we figure this out." Then you need to lock yourselves in a room and figure it out.

Honestly, BSODs, internet drops, detection of non-existent "attacks"... this is getting out of hand. Just be honest and transparent and deal with it. Don't get all confrontational with customers who are merely trying to use a supposedly non-beta program they paid for. :thumbd:

[Farmand]

-{ Quote: "Updated to .417 yesterday afternoon. Coming in this a.m. I'm dropping connections and the speed for the web (Firefox) is rather slow." }-

And not having any isues with the new release.. Everything is working great..

Thanks ESET..

[Uroboros]

Ditto. So far my connection is still working.

Knock on wood.

Considering with the last version of V4 I ran into trouble rather quickly looks like we're doing fine

[RickD]

Well in a moment of weakness I uninstalled v3 and put the newest v4 on.

Everything seemed to be smooth but then once again...stopped my internet connection. Jumped on my laptop and connection was just fine on it.

All day yesterday and today on v3 not a problem and within a couple hours internet gone on v4.

Forget this...

I will stay on v3 untill the community says v4 is working correctly.

No, I will not submitt or test anything. The community at large has provided enough of what is happening, I did not sign up to be in any beta, I paid 90 bucks for 3 coppies of a working security suite.

I guess that suite for now will be v3.

[The PIT]

Well my machine keeps freezing when browsing the internet so now dropped back to V3.

Problem is there's nothing logged anywhere, event viewer or esets logs so it may not be that program causing the problem. Only time will tell.

Without anything in any logs you can't submit anything.

[jlldn]

Well, I updated the Personal firewall module to 1045, and it stopped from blocking and disconnecting from the Ethernet (witch is good). But know it blocks access to Google Reader (for know is the only one I noticed), and nothing appears in the log file. If I disable the firewall, google reader is up and running :-\ .

[xxJackxx]

Though I have only been running it since yesterday, version .417 seems to have solved the issues I was having. I am not having any problems at this moment that I can blame on ESS. Looks good, so far...

This is on both a Vista 32 Ultimate Laptop and a Vista 64 Ultimate desktop.

[theseus47]

-{ Quote: "Well, I updated the Personal firewall module to 1045, and it stopped from blocking and disconnecting from the Ethernet (witch is good). But know it blocks access to Google Reader (for know is the only one I noticed), and nothing appears in the log file. If I disable the firewall, google reader is up and running :-\ ." }-

I've also had intermittent problems connecting to various google services, (mail, reader, search, etc.). It doesn't happen all the time, but every so often, I simply won't be able to connect to google.

Turning off the firewall will restore access again, but turning the firewall back on raises the problem again.

A reboot usually fixes it...until the next time it happens :(

[jlldn]

-{ Quote: "I've also had intermittent problems connecting to various google services, (mail, reader, search, etc.). It doesn't happen all the time, but every so often, I simply won't be able to connect to google.

Turning off the firewall will restore access again, but turning the firewall back on raises the problem again.

A reboot usually fixes it...until the next time it happens :(" }-

Still... I'm not going to restart every time this happens...:-\

In the log I get this some times, all of them are between my IP and my ISP Central... -.-
Detected DNS cache poisoning attack

[muppetman]

I just joined this thread to say that google reader (And in fact most google services) stop working for me with the firewall on, but only when I am using my HSPA Wireless modem.

If I'm at home using the laptop via Wifi, it works just fine.

Turning off the Firewall instantly makes google reader load up.

I have tried taking a packet dump with Wireshark, but there's nothing to show you, Wireshark catches nothing except the DNS lookup. Past that, not a single packet is caught.

I'm happy to give ESET remote access to my laptop (via VNC) to attempt to debug this problem, if they feel that it would help somehow.

Kind Regards,
Tim

[muppetman]

Actually sorry ESET, but I've gone back to v3. I have been getting really bad performance at home recently and I just twigged it was since installing the latest v4.

I have removed it and installed v3 for the moment. I hope that in the future v4 fixes this small, but annoying, problem.

If you're really keen I will install v4 if you want to debug, but somehow I doubt it :)

Tim

[silverfox55]

I thought this was supposed to be fixed !!!!!!!

I think it would be best to can V4 and start a fresh on V5 from the ground up

[ronjor]

The entire user base isn't having problems.

Those that posts with problems here should also name their operating system and any other security software they are using.

[Temp Member]

Still not our problem as far too many users got issues.

Same as with the 3 builds after v3 .650 and you blamed the end users PC but finally fixed it with the 4th build after v3 .650. 8)

I have nothing bar ESET ESS v4 on my PC, it was fine with v3 after the issues with buggy builds mentioned above were solved (they slowed WEB also due to AV Settings not FW).

I have Vista 64 Ult and ESET ESS v4.

Do what Lavasoft did and start over with a total rebuild from the ground up after they messed up on 2007.

[eisefr]

If Eset support cant reproduce the connection problem with the firewall... I can give you access to a workstation with ESS4 latest version through vnc or teamviewer.

[ronjor]

-{ Quote: "I can give you access" }-I can't speak for ESET but that seems helpful to me.

[Riony]

Same here, ESS is blocking google :o ! I used two computers and different connections.

a) Windows XP Professional SP3
Connection: DSL
Browsers: IE8, FF 3.0.8

b) Windows XP Home Edition SP3
Connection: Dial-up (yeah, haha this still exists)
Browsers: IE8, FF 3.0.8

ESET Smart Security 4.0.417, update 3986
Firewall: Automatic Mode
I'm not using any other security software

This problem is too weird. Somethings google loads and sometimes it does not (most of the time). When it is not working, I turn the firewall off, and then google loads immediately :blink: .

Thanks ;D

[theseus47]

-{ Quote: "The entire user base isn't having problems.

Those that posts with problems here should also name their operating system and any other security software they are using." }-

Problem with google as mentioned above. My specs probably aren't that helpful though...

Windows 7 x64
Minefield, Chromium
No other security system
4.0.417/3987
Interactive Mode

[muppetman]

-{ Quote: "The entire user base isn't having problems.
" }-
Agreed. The first version of v4 (the non-beta/rc) worked well for me. It's only since upgrading to the 1045 firewall module (which came with the latest version when I installed it three days ago) that I started to have problems.

So it seems like the new 1045 that was supposed to fix problems is actually causing problems for some people, where there wasn't problems before.

I hope they fix it soon, as stated, happy to provide any remote access necessary for debugging.

Tim

[Riony]

-{ Quote: "Agreed. The first version of v4 (the non-beta/rc) worked well for me. It's only since upgrading to the 1045 firewall module (which came with the latest version when I installed it three days ago) that I started to have problems.

So it seems like the new 1045 that was supposed to fix problems is actually causing problems for some people, where there wasn't problems before.
" }-

You're right. The problem started three days ago, when ESS was updated. Everything was working nice before.

[pomocnik]

ESSv4 beta was in my pc without problems. i´ve got problems with first verion of ESSv4. problems also with 1045 which was sent from here.
i came back to v3.

yestarday i give a try to ESSv4 again, this time 4.0.417.

And actually from yestrday cca 15:00 my connection works like a charm, no dropouts, no slowdown, no problems, no new loggings in logs.

system was same as before, i use full image.


for me all problems are gone :o

[The PIT]

Well two machines with XP sp3 one with Ie7 another with IE 8 both with latest firefox. One machine dual boot with Vista 64 bit. Both machines with firewall interactive mode.

On the machine with IE7 V4 firewall wouldn't even load up so it was back to version 3 on that machine.

One the machine with IE8 V4 would freeze while using firefox to browse the web. 99 times it would recover.

Now back with version three on that machine as well and no problems so far. The latest firewall didn't make any difference to the freezes.

Looks like version four needs pulling back to beta.

Don't use Vista much so i don't know if the freezing occurs with that one as it's still running on it.

[chromiumdomium]

Hi,

I decided to give the latest version a re-try and I've been running with it for about three days now without issue. Internet connections seem quick an solid now. I set the firewall in learning mode to start with and after about a day I switched it to interactive. Everything else is pretty much default except for sharing across the local network, which I have enabled.

I must say it's a bit quieter than Avira SS 9 that I was using during my wait for a fix to V4. My worry now is that Avira was catching various bits of malware stuck in my old e-mail archives and one or two things in some old zip files. Eset SS either V3 or V4 doesn't report any problems with these files.

I've already commented in my other thread about some Trojans being found by Avira. I fairly certain that these were false positives, but it's hard to be sure! Virus Total results were fairly inconlusive with the files I submitted. Avira didn't come back with any comments on the files I submitted to them!

On balance I think I'm happy to back in the Eset fold. However, I'm a bit perturbed by the occasionally quite poor customer relations experience from the Eset Moderators on this forum.

Regards,

Greg

[silverfox55]

-{ Quote: "
However, I'm a bit perturbed by the occasionally quite poor customer relations experience from the Eset Moderators on this forum.

" }-

Maybe because nobody has a clue what is wrong. In industry it is common to blame the customer or somebody else when you do not know what is wrong. I agree the moderators attitude to this problem and some customers is somewhat lacking.:thumbd:

[TBR]

Has anybody thought of going to somebody like theInquirer.net with this thread and a bit of background? I.e. Released despite concerns from the community about a prevalent bug which prevented internet access, still not resolved despite "patches" - not updates, and general lack of feedback or helpfulness from ESET.

Nothing like the kick up the financials a good bit of bad publicity has on getting a problem resolved a little bit quicker.

I mean, HOW long has it been now? How long do they need?

Im sure as hell fed up of it and to be honest, going nowhere near V4 until its fixed.