ESET antivirus blocking internet and logins!

Hi

I've been recently having problems with ESET anti-virus on my terminal server.

It was working for a long time with no problems on all my servers and PCs, and then suddenly a couple of months ago the internet stopped working of one of the terminal servers. After investigating and finding wrong with the connection I start to kill off processes and the internet started working again when I killed off ESET.

This is strange as I have ESET everywhere and only this machine is displaying this behaviour. I then discover that I can just stop it check Internet Explorer and it'll work, so at least I had some for of AV. Weeks go by and I find no permanent solution to this problem.

Then last week I lose internet again! At first I thought that someone had undone my changes only to find they've not changed! Now the only way I could get it to work was to close it completely. I tried uninstalling and then reinstalling it, which worked at first but then things started to go even more wrong. Initially it worked fine with the Internet working with the standard settings. About 30 minutes later I get a call saying the internet has failed again and sure enough, it had. Shortly after that I start getting calls from users saying they can't login at all with the error message "User must be part of the remote desktop users group".

Naturally I think this is something seperate and start investigating. After hours of searching and more users breathing down my neck I decide to undo the only change I made all day - reinstalling ESET. I uninstall it and magically the users can login again!

What is going on with ESET? Why is it blocking internet and stopping users from logging in? Why just the one server?!?! I've looked all over the internet to try and solve this issue and at the moment all I can do is leave it anti-virus free.

Any help would be muchly appreciated!

Adam Taveirne

 

We'd need to get and check a log from SysInspector created on that machine. It sounds like an interference at the TDI/WFP layer with another driver probably belonging to 3d party software. Have you already contacted customer care on this matter?

 

Not yet. They're my next port of call!

 

You can upload the ESI log somewhere and PM me the link.

 

I'm not back into that office till tomorrow so i'll post it then.

Anything else you think of that I can try off the top of your head?

 

Actually, I have a bigger problem... If I reinstall ESET, it could kill the server again! The server is in a live production environment and I can't afford to have the system down.

 

Hi taveirne,

Are you running the latest version (4.2.67) on that server?

Please take the following articles into account when installing ESET security solution on a server OS:

ESET’s recommended Server settings.
http://kb.eset.com/esetkb/index?page=content&id=SOLN2144

Microsoft’s virus scanning recommendations for a server:
http://support.microsoft.com/kb/822158

Hope this helps.

 

Also, you don't need to install EAV to make a SysInspector log. You can download and use SysInspector separately (and its free)!

See: http://www.eset.com/download/free-antivirus-utilities