Disable email protection via ERAS

[sedell]

How do I disable the email protection via the ERAS configuration editor? I'm trying to set up a configuration for a server using NOD32 3.0.684. In the program itself, I'm looking right at the checkbox under Antivirus and antispyware -> Email protection -> Enable email protection, but I can't seem to find a setting in the ERAS configuration editor that will unset that.

[CarlB]

You'll actually find it under Personal firewall -> Setup -> Enable email checking.

Alternatively, check the following:

Email filter -> Setup -> Scan received messages, Scan sent messages, Scan read messages.

Email client -> Setup -> Integrate into (everything)

Set all of that to "No" and you'll be good.

[sedell]

-{ Quote: "You'll actually find it under Personal firewall -> Setup -> Enable email checking." }-
Then I have another issue. I have this set to "No" in the policy config file. When I view the machine's configuration through ERAS, it shows it set to "No". When I open up NOD32 on the machine, it's set to "Yes". I thought I had the wrong setting since it didn't make the change I expected to see.

[CarlB]

Interesting. Try exporting the configuration from the client to XML, then get that file in the same place with the XML configuration file from the server. Open up a command prompt and type:
-{ Quote: "fc file1.xml file2.xml" }-
(Replace file1 and file2 with your files, of course)

Look for areas of interest, particularly this one:
-{ Quote: "<NODE NAME="pop3_enable" VALUE="0" TYPE="DWORD" />" }-

If you want to post the pertinent portions of FC's output here, that would be cool.

[sedell]

Well, it looks like they "forgot" to include the setting in the configuration editor. I took a blank configuration, disabled 'Enable email checking', then saved the file. I got:

<?xml version="1.0" encoding="utf-8"?>
<ESET>
<SECTION ID="1000103">
<SETTINGS ID="3315216C">
<PLUGINS>
<PLUGIN ID="1000200">
<PROFILES>
<NODE NAME="@My profile" TYPE="SUBNODE">
<NODE NAME="pop3_enable" VALUE="0" TYPE="DWORD" />
</NODE>
</PROFILES>
</PLUGIN>
</PLUGINS>
</SETTINGS>
</SECTION>
</ESET>

It's the switch for POP3 scanning. I then took a client with 'Antivirus and antispyware' -> 'Email protection' -> 'Enable email protection' enabled and exported the config file. I then disabled the setting, and exported the config file again. I ran a file compare on those files and came up with:

Comparing files VPC03_Email_Disabled.xml and VPC03_EMAIL_ENABLED.XML
***** VPC03_Email_Disabled.xml
<NODE NAME="MoveFolder" VALUE="Infected Items" TYPE="STRING" />
<NODE NAME="IsEnabled" VALUE="0" TYPE="DWORD" />
</NODE>
***** VPC03_EMAIL_ENABLED.XML
<NODE NAME="MoveFolder" VALUE="Infected Items" TYPE="STRING" />
<NODE NAME="IsEnabled" VALUE="1" TYPE="DWORD" />
</NODE>
*****

Then, I opened up the config editor, did a right-click and selected Mark on the 'ESET Smart Security, ESET NOD32 Antivirus' node, then saved. This should give me a file of every setting the config editor can set. I did a search of that file for IsEnabled, and it found nothing.

This new ERAS is becoming a nightmare.

[CarlB]

This just went to the top of my pile. I'll replicate it here and report it if necessary, and let you know how it goes.

Thanks for being a sport and checking the files out for us :thumb:

[sedell]

Thanks for looking into that. It's becoming an issue submitting cases through the website. They never have an answer, and sometimes completely wrong answers.