ESET SS4 & LAN problem in Win7

I've been using SS4 for a while now, and under Vista 64 was flawless. Since installing Windows 7 however, it's been awful.

Some system(s) details:

Windows 7 Professional vers 7600.16385 FULL INSTALL!.. not upgrade... same on both my computers.

ESET SS4 version 4.0.467.0... same on both computers.

Auto update has installed the latest modules.

Virus signature database: 4626 (20091120)
Update module: 1031 (20091029)
Antivirus and antispyware scanner module: 1245 (20091116)
Advanced heuristics module: 1099 (20091030)
Archive support module: 1105 (20091029)
Cleaner module: 1047 (20091020)
Anti-Stealth support module: 1012 (20090526)
Personal firewall module: 1054 (20091015)
Antispam module: 1013 (20091104)
SysInspector module: 1213 (20090902)
Self-defense support module : 1009 (20090917)


The problem is intermittent LAN connection between my two machines.

It is a wired connection over a gigabit network, so it's not a wireless issue.

Before anyone suggests that it's another problem, I will say that disabling ESET's firewall on both machine immediately cures the problem. Re-enabling it, immediately re-introduces the problem.

When firewall is enabled on both machines, or even one of them, the other machine will occasionally drop off the network. If I try to stream 1080p for instance, it may manage to stream for 2 minutes, then it just stops. When it stops if I open my network connections, or read the contents of a shared folder, I just get the busy cursor until it either reconnects or times out.

I have gone into the IDS options and ticked everything in there. I have ticked all the Windows 7 options.

This was a clean install of Win 7 and so was the other machine... I did not upgrade from Vista.

I also have PC Tools Spyware Doctor enabled.... but I have always run with these two programs for years without issue.

Windows Firewall and Windows Defender is OFF on both machines.

All network IPs are static.

I have raised a ticket with no response!

Please help me, or I'll just have to say bye bye to ESET.

 

If you enable logging of blocked connection in the IDS setup and replicate the problem, do you see some connections blocked in the firewall log?

 

Still having problem even with firewall disabled... but when I uninstall ESET completely it's fine. Re-install it, back to square one.

Here's a screen grab of the event log.

http://i16.photobucket.com/albums/b26/pookeyhead/Untitled-1-40.jpg


Any of that make sense to anyone? 192.168.0.2 is obviously my machine on the network, but what are those other IP addresses?


What does incorrect packet checksum mean? If there were errors with the data being sent, how come it works perfectly when I uninstall ESET?

 

I have faced the same issue..until I untick the UDP Port Scanning Detection Under IDS and advanced option Under Personal firewall settings

 

We've seen routers as well as a network printer that actually produce UDP port scans which are subsequently detected and blocked. The solution is to add the IP address of your router to the list of Addresses excluded from active protection (IDS) in the firewall zone setup.

 

I don't much like the idea of disabling UDP port scanning to be honest... isn't that one of the reasons I HAVE a firewall?

I'll give that a go and report back.

 

Ok.... I added the IPv4 address of the router, and of the other PC in the Addresses Excluded from Active Protection section, and it has made no difference at all. Then again, I wasn't expecting it to. Surely if I have a trusted zone set as Address: 127.0.0.1 Subnet: 192.168.0.0 / 255.255.255.0 IPv6 address: ::1 that pretty much gives a green light to all traffic on my LAN?

When the data stops, I immediately get a Incorrect TCP Packet Checksum error in the firewall log. I refresh the view in the window of the networked shared folder, and then it starts again for a few seconds... then stops and logs another packet checksum error etc. Why is ESET blocking traffic in the trusted area because of a packet checksum error anyway? How is that a security issue?

I've been reading about this, and there are at least 6 other threads about this in these forums still unresolved, some of them have apparently had a ticket open for over a year with no solution found.

The annoying thing is, that the same router, same hardware, same everything worked just fine under Vista 64... including ESET SS4... everything was perfect. The ONLY thing that has changed is the move to Windows 7.

If I genuinely HAVE got checksum errors... then I've almost certainly always had them.

Disabling the firewall on both machines results in a rock solid connection that lets me move a 1GB file from machine to machine in around 10 seconds. Enable the firewall on even one of the machines, and it's back to.... transfer 500k and stop.... wait 3 minutes.... transfer 2MB and stop etc... so the same 1GB file takes around 10 minutes or so.

This is looking like a ESET/Windows 7 incompatibility issue to me.

Do I wait for a solution, or just buy PC Tools Internet Security... or even their Firewall program (free)? The trial version appears to work just fine under windows 7, so it's tempting.

I've also raised a ticket about this (48 hours without a response... not even an automated acknowledgement), so I guess I'll just wait and see how much ESET value their customers, because I'm not alone in this problem it seems. Oh, and how I laughed at the irony of ESET moving the authentication e-mail for THESE forums into the Anti-Spam folder LOL.

Call me cynical if you want, but I'm starting to think that ESET have just made a complete mess of making their existing products work well with Windows 7. Perhaps seeing as the world and his dog have been using Windows 7 in one form or another for at least 9 months if not more, there should have been a new version 5 ready for release on Oct 22nd... not a patched mess that I had to force pre release updates for in order to get it work at all.

The only reason I am currently using ESET is for it's virus protection. As it is I have to supplement it with PC Tools Spyware doctor in order to remove data mining cookies, and application tracking cookies.... things that ESET is blissfully unaware of. Only this morning PC Tools stopped an example of "Hijacker.specific911_hijack" that ESET missed completely. In light of this, and now the firewall issues, I'm seriously wondering why I use this product at all. Can someone from ESET please remind me why I pay you once a year for a license? My PC Tools Spyware Doctor subscription is up for renewal on December 11th. If this isn't resolved by then I'll just upgrade to their whole package and wave bye bye to ESET, or at least downgrade ESET to NOD32 only, and run PC Tools free firewall in conjunction with Spyware Doctor.

 

I'm having the same issue. I have two computers hooked up to a Netgear gigabit switch with cat5e cable. Both computers have gigabit NICs and have always worked well in the past. I usually see transfer rates ~60MB/s, so transferring files between the two is pretty snappy.

I've noticed an odd thing recently. If I get on the spare/server PC and paste a file from it to my gaming rig, it goes at the reasonable 50-60MB/s, even with the firewalls enabled. However, if I'm on my gaming rig and i browse to the spare/server PCs drive and copy and and paste a file to either of my local disks, the speeds are... less than satisfactory unless i disable the firewalls on BOTH computers.

I click on details to see the transfer rate and at first it will spike up to anywhere between 60-120MB/s, and then it will pause for a while and then drop down to 12-16MB/s and will transfer at that slower rate. I check my bandwidth graph during these transfers and there are quick, high spikes with 3-5 seconds of pretty much flat-lining in between.

If i disable the Eset firewall on both PCs i can copy things over to my rig w/o any problems/slowdowns, so the issue is obviously with the firewall. I tried uninstalling and downloading the latest version from the website and reinstalling and it worked fine for a day or so and now its back to the same thing. I keep it on interactive mode and havent even denied anything access yet... I checked my firewall log and there were IP checksum errors.

As it is now, I don't even want to use the firewall feature of Smart Security, which was the main reason i switched from nod32 to SS...

 

Still no response from ESET either in here, or via e-mail.

Crap product.... crap service.. will not be renewing in January.

 

did you try the latest version .474 ?

 

Nope... not even sure I want to. I've pretty much decided I'll let this subscription run out and leave it.

The very fact that it doesn't auto update to the new version, and that I had to come here to find out about it just ~ Snipped as per TOS ~ even more.

This company is a shambles.

 

Ok.. I thought I'd give it the benefit of the doubt, and installed the latest version on both machines.

Still exactly the same.



What annoys me most is that no one from ESET seems to care, or be interested in helping me. I've worked in customer services, and if there's one thing that will get a customer angry, it's exactly this.

ESET's product is rendering my home network completely useless. With this in mind, I think I'm being MORE than patient seeing as it's been like this for weeks.... no, actually months.

Does anyone from ESET other than moderators read or respond to these forums?

 

We'd need the following to troubleshoot general firewall issues:
- a pcap log made by Wireshark with fw disabled from the moment when the issue doesn't occur
- a pcap log made by Wireshark with fw enabled from the moment when the issue occurs
- the firewall log with logging all blocked connections enabled from the moment when the issue occurs

 

Ok.. installed Wireshark... ran a test for 10 seconds while it displayed the fault, and I have a log file that's over 300MB in size.


Now what? I can't attach it to this post.. I certainly can't copy and paste it in.... (shrug).

You know... as support goes this sucks. I have no idea what I'm doing with Wireshark. Until I read your post I didn't know what it was... I have no idea what it's telling me or even if I'm doing this right. It's taken 3 weeks for anyone to even suggest trying wireshark anyway... I'm lost. I'm a photographer, not a networking engineer. Am I supposed to now sit here and spend my valuable time learing how to use Wireshark in order to get any help from anyone?

Also.. while I'm here... why haven't ESET responded to my ticket?

 

I'm downloading wireshark now, but, same here... I'm not really familiar with wireshark or using it, but here's a .txt of my log file...

*edit*

Tried running Wireshark with my firewall disabled while transferring a large file over my LAN, but every time i tell it to stop the live capture i get a message that says "The application has requested runtime to terminate in an unusual way" and then the program crashes. I installed the win 64bit version since i'm on win7 64bit...

Tried telling wireshark to end capture after 1 minute, and it gives the same error whenever the time is up...

This is too much of a headache to go through in order to get a program i paid $90 for to work as it should. I got ESS for security and convenience, and I'm getting neither out of it atm.

 

I decided that the log file i attached above was a bit long, so I started transferring a file between my computer and another computer on my gigabit LAN and this is what the log file showed during the transfer.

I can download these files off the internet faster than i can transfer them on my LAN...

 

I wonder if you could try lowering the LAN speed from 1 GB/s to 100 MB/s to see if that has an effect on the issue.

 

Will try it later, but what if it does? Not a solution really. Without ESET present the router works fine. I've updated it's firmware to the latest version, and it's a popular, and well respected router (D-Link DIR-655).

I got fed up with waiting for my ticket to be responded to, and called ESET yesterday. They got me to install ISL light, and I just sat back and let them sort it out. All they did was go through all the same stuff I've already done.

They have no idea, and can't help me. I've to call back this morning for them to play with IDS settings again no doubt.


I just find this odd. By reading these forums, I'm not the only one with these problems. It's clearly not hardware specific as my wife's machine is utterly different. It all worked fine with Vista. The only common elements between the two machines is Win7, ESET SS4 and the router. As the Router worked perfectly with ESET under Vista it can't be that. As both machines are effected it can't be a PC hardware issue.... that leaves ESET and Windows 7.

It's looking like it's going to be a case of "Sorry, we can't help you" at this rate. Considering that this forum has 4 threads active regarding the same issue, and Googling the problem gives you many, many more, how come this is baffling ESET so much? I'd be sympathetic if I had some obscure hardware that no one's heard of but a D-Link router, and a Asus P6T motherboard and Windows 7 is hardly rare.

You suggested Wireshark yesterday... and I told the guy on the phone that I had it installed if he wants to use it and have a look, and I got the impression he didn't know what it was, or how to use it. Fine... neither do I really... but I'm not working on a IT helpline. He sounded about 16 and quite frankly, did nothing I've not already done myself and then said he can't help me.

Exactly the same problem I have here. So that rules out the router.... as you have a netgear router.

[EDIT]

I can see no means of lowering from 1Gbit to 100Mb. There are very little options for wired... just for wireless. I suppose you'd normally not ever want to do this... as it will auto switch between speeds if 1Gbit isn't possible, surely?

also....

https://www.wilderssecurity.com/showthread.php?t=258831

Why has no one suggested this (first post)? I have no idea how to do this however. Surely if that DOES work though, shouldn't it be informing ESET how they can fix the problem?

Here's another with teh same problem.

And another one.

Printer sharing caused by the same problem anyone?

Want more?

Seriously I'm bored now with copying and pasting.

This forum is RIFE with people having the same problem, yet no help is forthcoming.

Don't wanna take my word for it, or even other forum members?

http://i16.photobucket.com/albums/b26/pookeyhead/Untitled-1-41.jpg

Then don't... Just Google it.

Seriously... this is not good enough. I think some mailshots to hardware forums are in order. I'll post this on Bit-Tech... it won't take long to be spread to other sites.

[EDIT]

Just got off the phone for a second time with ESET. Did teh same stuff... ISL lite session... checked Firewall settings... no problem... then actually had the nerve to tell me he's GOOGLING the problem to see if there's a solution... LOL... I mean.. I pay for a 45 minute phonecall while some guy sits there Googling? WTF?

He disabled IPv4 checksum offloading in my LAN settings (As he read something that mentioned that after Googling it)... but that did nothing... he messed around for 40 minutes and basically gave up.

Does anyone of any importance from ESET read or monitor these forums? There's a serious problem with your software that you are utterly unable to help me with, and no one from ESET can do anything about it. Is this it? Just (shrug)... sorry?

Again I offered to run Wireshark while he had control of my desktop and again the offer was declined. Clearly your support staff are just working through a checklist, and don't actually know very much. When you call a IT helpline and get told "Hang on a minute while I Google it".... you know you're dealing with a bunch of amateurs. I may well record the next phonecall I make and post a link to the MP3 so you can all have a laugh.

Is it just me, or does anyone else think that ESET should either just fix this, or give me my money back? I don't think this is unreasonable.


[EDIT]

Just got off the phone AGAIN from ESET. Still can't fix the problem.. still have no damned idea what it is, or why it's happening, and they had to admit that they can't actually do anything to help me.

Will not be renewing license in January obviously.

I shall make it my life's mission to rubbish your product at every available opportunity to anyone who will listen.

NOD32 I have no problem with.... but your firewall software is complete garbage. You were woefully unprepared for Windows 7, and you still obviously haven't ironed out the problems. I refuse to carry on paying for what is essentially a beta version with more holes in it than a piece of swiss cheese.

 

try the latest version

 

I wish that Eset would look at the IRPStackSize which I have mentioned in another thread. Since I made this change, the network has been stable and fast. I am not sure whether this is a microsoft issue or not but they do blame antivirus software. I tend to think that Microsoft has to wear some of the blame as they recognised it as an issue many years ago and it has now resurfaced again with Win7.

 

Well... from a company who's Support team tell you to wait while they Google for a solution... what do you expect?

I have ditched ESET SS4 and gone with PC Tools instead. It works beautifully. I'm still using NOD32, but the SS4 firewall is awful.

Incidentally.... to stop future suckers.... err.. I mean customers getting frustrated, you should post a "How to" tutorial about how to change the stack size.

LOL... I love it when people don't read a whole thread