ESET NOD32 v12

Discussion in 'other anti-virus software' started by FanJ, Oct 23, 2018.

  1. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,652
  2. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,652
    Does anybody know more about this:
    • Added: New Telemetry settings collected from our users

    What exactly is meaned by this?
    Can a user change those settings? If so, where?

    I can go to Advanced setup > User Interface > Customer Experience Improvement Program
    But is there really something changed there compared to the previous version?

    Am I looking at the wrong place? Do I misunderstand it?
    Thanks.
     
  3. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    6,941
    Location:
    USA
    Excellent questions, FanJ. I'd like to see them addressed on the ESET forum!

    I have 12.2.23.0 on both machines as of yesterday, so I can't compare new to old. But I will say this... "Added: New Telemetry settings collected from our users" may simply mean the 'feature' (Customer Experience Improvement Program) was there previously, but now they have changed the default setting to disabled rather than enabled. Just guessing.
     
  4. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    I did notice one change on 12.2.23. My real-time ThreatSense cleaning mode was changed from my previous manual setting of strict to normal.

    I am going to leave it that way for the time being. Believe this might be to ensure "suspicious" alerts are now shown in regards to advanced behavior detection module.
     
    Last edited: Jul 18, 2019
  5. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,652
    Thanks @Page42
    It is puzzling me.
    Maybe better wait until official announcements are released ...

    ==========

    Thanks @itman
    I haven't yet looked at (new?) ThreatSense cleaning mode settings.

    ==========

    I understand now, after having read thread https://forum.eset.com/topic/20173-tls-13-compliant/ , why the Cryptographic protocol support module: 1034 (20190701) was gone back to version 1028.2 (20190716). It were strange date and version numbers...
    This has been puzzling me for some days... It appears that version 1034 was pulled by Eset due to some issues, according to Marcos in that thread. (this on regular updates).
     
  6. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,652
    Some remarks about changelogs, ESET News, Telemetry

    1.
    There is still no news article about the new version 12.2.23.0 at https://support.eset.com/news/

    2.
    Marcos posted the changelog today at the ESET forum:
    https://forum.eset.com/topic/20218-eset-windows-home-products-version-122230-have-been-released/
    https://forum.eset.com/topic/20219-eset-windows-home-products-version-122230-have-been-released/

    3.
    The changelog given by Marcos is not exactly the same as the one from the download page https://www.eset.com/int/home/internet-security/download/ (go to advanced download).
    In the changelog given by Marcos I don't see Telemetry mentioned.
    Maybe there are good explanations for the differences, maybe it is only the wording. But where is the Telemetry mentioned in the changelog from Marcos?
    Judge for yourself:

    Changelog given at the download page

    • Added: New Telemetry settings collected from our users
    • Added: Scanner logs
    • Added: Drag and Drop capabilities to Quarantine feature
    • Added: Cryptocurrency wallets (BPP)
    • Added: Option “Disable Keyboard protection” (BPP)
    • Added: HTTP2 support (BPP)
    • Changed: Windows XP is not supported
    • Improved: Graphic elements in GUI
    • Improved: In browser blocking in Parental control / Web Access Protection
    • Fixed: Various functional and localization bugs

    Changelog given by Marcos

    • Changed: Installation on Windows XP is not possible
    • Added: Drag and Drop support for quarantine
    • Added: Trusted Devices feature (ESET Password Manager)
    • Added: Two-Factor Authentication with Google Authenticator (ESET Password Manager)
    • Added: iOS Face ID Authentication (ESET Password Manager)
    • Added: Secure sharing of login information (ESET Password Manager)
    • Added: Cryptocurrency wallets (Banking and Payment Protection)
    • Added: Option “Disable Keyboard protection” (Banking and Payment Protection)
    • Added: HTTP2 support (Banking and Payment Protection)
    • Added: Advanced scanner logging for diagnostic purposes
    • Improved: In-browser alerts and notifications of Web Access Protection and Parental Control
    • Fixed: Stealing focus from active window under certain circumstances
    • Fixed: Various functional and localization bugs
     
  7. klarm

    klarm Registered Member

    Joined:
    Apr 7, 2012
    Posts:
    85
    Location:
    europe
    I wasn't aware that even ESET now uses telemetry.
    nothing is secret any more.
    Is it possible to disable this?
     
  8. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    6,941
    Location:
    USA
    I believe it is disabled by default.

    ESET telemetry setting.jpg
     
  9. Azure Phoenix

    Azure Phoenix Registered Member

    Joined:
    Nov 22, 2014
    Posts:
    1,560
    Are you guys talking about LiveGrid or the customer experience improvement (which was added in a previous version)?

    In both, the user can decide to enable or disable them.

    Here's some info on the customer experience program
    https://help.eset.com/eis/12/en-US/ceip.html
     
  10. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,652
    More remarks about changelogs, ESET News, Telemetry

    There is a recent thread at the Eset forum about the Telemetry :
    https://forum.eset.com/topic/20240-new-telemetry-settings-in-12223/

    In the reply Marcos pointed to the Customer Experience Improvement Program.

    Well, we knew that the Customer Experience Improvement Program already existed in the previous version.

    Marcos didn't answer the question there:
    "Does this mean the new telemetry data which is introduced in recent version is a part of Customer Experience Improvement Program?"

    Are we supposed not to know what the New Telemetry settings are, what they collect, etc.?
    Is it something secret? Is it something Eset don't want us to talk about and to know?

    Why exactly is the line "Added: New Telemetry settings collected from our users" in the changelog at the EIS download page?
    Was that a mistake? Is that changelog telling the truth?
    Who are we supposed to believe: Marcos or the person who posted that changelog at the download page?

    It isn't the first time that info from changelogs differs.
    Wouldn't it be time that everyone at Eset is telling the same thing?
    Maybe something in the Eset organisation needs to be changed in that respect.

    And why is there still no article at Eset news : https://support.eset.com/news/ ?

    Oh well, maybe it is just only the holiday time that is playing a role here. That could very well be.
     
  11. bellgamin

    bellgamin Registered Member

    Joined:
    Aug 1, 2002
    Posts:
    8,102
    Location:
    Hawaii
    I am using ESET Internet Security. It rather often pops up an alert with the heading, "Unknown Operation." In the body of the alert, it always says "operation permitted". The alert usually pertains to a registry item. There is no evident consistency among the unknown items being reported.

    What is going on here?
     
  12. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    I don't know how you have Eset's HIPS configured.

    To start, you would see "unknown operation" activity if for example, you had the option to log all HIPS events. It is usually related to Eset self-protection activities:

    Time;Application;Operation;Target;Action;Rule;Additional information
    5/28/2019 11:22:09 AM;C:\Windows\System32\SecurityHealthService.exe;Unknown operation;C:\Program Files\ESET\ESET Security\SecurityProductInformation.ini;blocked;Self-Defense: Protect ESET files;

    However, it can also appear for really, any activity. The main point is you would only see this activity if you selected that all HIPS activity be logged or alerts generated from same. This option should only be enabled for HIPS diagnostic purposes since it will rapidly fill up the HIPS event log. Hence, the setting being located under advanced HIPS settings.

    Also if you have Eset Desktop notifications set to Diagnostic level which is the most verbose alert setting and one or more of Eset's protection settings have been set to advanced logging level, this could result in the alert activity you are seeing. The default Desktop notifications setting is Informative.
     
    Last edited: Aug 28, 2019
  13. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    939
    Location:
    Land o fruits and nuts, and more crime.
  14. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    First, make sure the setting I showed in this posting: https://forum.eset.com/topic/20594-...an-click-on-it/?do=findComment&comment=100285 is set to 120.

    Appears everyone having this issue is running Win 7. As I posted in that thread, I tried to duplicate the issue on Win 10 and had no problem with alerts remaining on the desktop. So I suspect the issue has something to do with a recent Win 7 update.

    Also someone recently posted it happens when these two apps are running:
    Do you have either installed?
     
    Last edited: Aug 28, 2019
  15. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    939
    Location:
    Land o fruits and nuts, and more crime.
    It was set at Default I guess that would be 120.
    I don't update windows, so that's not what it is.
    Has to be an Eset update. Nothing has changed when this happened.

    Thanks.
     
  16. bellgamin

    bellgamin Registered Member

    Joined:
    Aug 1, 2002
    Posts:
    8,102
    Location:
    Hawaii
    Guilty as charged. I fixed that. Let's see if that does the trick.

    Much aloha for your assistance!
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    UPDATE: I just did a scan with Hitman Pro, minutes after an ESET scan. Evidently ESET takes no cognizance of tracking cookies because HMP found a LOT of them. Also, ESET popped 3 alerts that HMP's operations are "Unknown" -- but ESET permitted them, nonetheless.

    I carefully checked -- there is no logging turned on by me anywhere that I found. The drop-down box said "Informative." In fact, the only settings changes I made after installing ESET yesterday was to turn off ESET's splash screen when I boot up.

    I have used many AVs over the years. I have had AVs that would pop alerts when they spotted malware, or pop alerts when a process was unknown & was being analyzed or run in a sandbox. ESET is the first one that says, "We have never seen this operation before so we're just going to let it run." I *assume* that ESET's behavior blocker would intervene if the "unknown operation" turned nasty, but it still seems rather an odd sort of alert.
     
    Last edited: Aug 29, 2019
  17. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    What mode do you have the HIPS set to?

    Is this advanced HIPS option, Notify when changes occur in Startup applications, enabled? That setting is extremely aggressive and will do exactly what it states; notify you of all changes to startup directories, registry keys, etc. associated with OS startup activities. I tried it a couple of times and abandoned using it. Instead, I created my own HIPS rules to do the same.

    Again, Eset advanced settings should only be enabled by advanced Eset users.
     
    Last edited: Aug 29, 2019
  18. bellgamin

    bellgamin Registered Member

    Joined:
    Aug 1, 2002
    Posts:
    8,102
    Location:
    Hawaii
    Hmm... I had to search around a bit before I could find the "advanced" for HIPS. I had to go to the Setup screen, then hit "Advanced Setup" then hit "HIPS" then scroll down & hit "Advanced Setup" yet again. I assume all settings were at default because I had never been there before. The switch for "Notify when changes occur in Startup applications" was NOT on (it was a white box with a "X" beside it).
     
  19. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    You didn't answer my question in regards to HIPS filtering mode. What do you have it set to?
     
  20. bellgamin

    bellgamin Registered Member

    Joined:
    Aug 1, 2002
    Posts:
    8,102
    Location:
    Hawaii
    It was set at whatever the default is when ESET is installed. I uninstalled ESET. I do not use a real-time AV -- I was giving ESET a trial for my outfit.
     
  21. simmersK00L

    simmersK00L Registered Member

    Joined:
    Mar 20, 2013
    Posts:
    323
    Location:
    USA
    my experience with eset nod32 v12.2.23.0 on win7_x64 has been trouble-free for past 6 weeks. I've made several "advanced" tweaks based on experienced user recommendations at MT. HIPS are "smart mode." after I installed eset, win7 actually seemed to preform better (not that it was preforming poorly). I had used eset in the past, and now I'm happy to be using it again. that aside, mostly I go online from a linux VM.
     
  22. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    My advice to anyone installing Eset for the first time or evaluating it is to run with default settings. Then modify one setting at a time always monitoring the impact of that change. The worst thing that can be done is to modify a bunch of Eset settings and then try to determine which change is causing a problem. Finally unless you are willing to put forth the effort to learn Eset's internal protection mechanisms, you should leave Eset at its default installation settings.
     
  23. jadinolf

    jadinolf Registered Member

    Joined:
    Sep 2, 2006
    Posts:
    1,047
    Location:
    Southern California
    I agree 100%

    I have ESET on all 5 computers and everything is at default with NO problems.
    Only thing I do is set up is a scheduled scan set for times that the computer will be on.
    No complaints at all.
     
  24. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,652
    Hmm, on my Eset Internet Security 12.2.23.0 I just got Eset Password Manager 2.0.0.59 offered.
    Maybe I'm wrong, but is Eset Password Manager actually for EIS?
    I let it "install"; but ehh I got it again offered ...
    After a reboot that seems to be settled for now.
    I don't use it and actually I don't want it.

    Anyone else with EIS installed seeing this too?
    Thanks in advance.

    Eset_2019-09-10_01.png
     
  25. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    No. And if anyone should be seeing this behavior it would be yours truly. I have a Smart Security license but installed Internet Security instead. I also did a manual update check and it was not offered.

    Suspect you just had a borked Eset update server connection. I wouldn't be concerned unless it keeps happening.

    Note that the Password Manager feature exists in the Internet Security versions. It just isn't activated.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.