Eset Apologises for blunder


Recommended Posts

Wilders Security Forums

Hello,

we are very sorry for the problems you have experienced with one of the recent updates. The root of the problem was a problematic section in the code that emerged just recently. It was not a typical false positive, such as a wrong signature or heuristics triggering an alarm on benign files. I can assure you that we do make tests before releasing updates to prevent false positives from occuring. In this case, the alarm was triggered under specific circumstances varying from computer to computer (ie. a specific file flagged on one computer was not flagged on each other). Right now we are preparing a knowledge base article concerning this issue. Those who are experiencing problems should follow these instructions:

- restart the computer in Safe mode (press F8 several times before the Windows logo appears)

- delete the file C:\Program Files\ESET\ESET Smart Security\em002_32.dat

- delete the folder C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Updfiles or If you have Windows Vista delete the folder C:\Users\All Users\ESET\ESET Smart Security\Updfiles

- delete all files in the folder C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Charon\ or

- restart the computer

- start Windows in normal mode and update ESET Smart Security/ESET NOD32 Antivirus by hitting the button ?Update virus signature database?

Note: Windows Vista uses the folder "Users" instead of "Documents and Settings"

It was not a typical false positive, such as a wrong signature or heuristics triggering an alarm, otherwise the problem would have been caught during the pre-release test. In fact it was a well hidden bug from v2 that resulted in this problem and which has been identified and fixed within a reasonable time frame.
Link to comment
https://www.neowin.net/forum/topic/638603-eset-apologises-for-blunder/
Share on other sites

You only needed to update to sig database 3121 to fix this, rather than going through all that crap. Either way they fixed it quite quickly, I sent them an email, had a call from them within half an hour or so confirming what was happening and what the errors were, half hour or so after that got another call to say all had been fixed and to do a manual update (the problem was with the new code and sig database 3120 apparantly) and that came direct from the ESET devs.

Yeah I had big trouble this morning, almost all my games has been detected to contain "unknown virus", system locked up several times, and eventually the repeated lock ups leaded to some file corruption which caused a BSOD when booting Windows!

Running Windows repair from the boot disk then removing/reinstalling/updating NOD32 fixed the problem.

This really makes me want to reconsider my choice of Antivirus.

Should have stuck to Kaspersky. Luckily I have a Kaspersky license and <pause> now Kaspersky is back on my PC. Sorry Eset. Can't afford to damage my PC with software that's meant to keep it safe from malware damage.

How would your computer be damaged?

A lot All of my Adobe software stopped working. I had to restore from quarantine and while I was doing this, NOD locked up my Pc twice. Also, a demo game stopped working too. But restore from quarantine didn't succeed.

By 'computer' I meant, effectively my computer was damaged because of NOD damaging my software. Without software my computer is just a box, a heavy useless box.

Statement from ESET, LLC regarding signature update 3119

Early this morning, ESET became aware that virus signature update version 3119 unfortunately caused a false positive detection of certain applications and drivers, most notably from Adobe. ESET is aware of the problem and promptly issued an update, version 3121.

For customers impacted by update v.3119, please visit ESET?s Knowledgebase for additional steps to resolve the conflict:

http://www.eset.com/support/kb.php?o...&articleid=812

ESET is continuing to assess the extent of the issue, and more information will be provided as soon as we have it. We regret any inconvenience this has caused to our customers and are working around the clock to assist those who have been affected.

- Anton Zajac, CEO of ESET LLC, 5/22/08

This is kind of funny, i just uninstalled NOD32 from all of my systems yesterday.

Because I realized 3.x sends all web traffic through ekern.exe as a web-proxy to scan for threats. The problem is you can't really turn it off, if you do when it then bugs you about not being fully active, and then when you reboot it turns it's self right back on.

Also the main issue in the way this setup is, if your running any kind of application rules based firewall, if you approve ekern.exe for access to the net, since all apps accessing the net are proxyied through this, you basically just approved all traffic from all applications, you can verify this by looking in like TcpView and opening Firefox, you'll see that Firefox doesn't open all the http connections to retrieve the content, but ekern.exe does.

Also this works the other way around, if you disable ekern.exe from internet access, chances are you just blocked most of your apps from getting to the web.

I didn't uninstall 100% for that reason, that is actually something that I came across while I was trying to figure out why I had a TON of open and half-open TCP connections.

The ekern part of the proxy is very inefficient at closing closed requests and I have seen reports of it actually slowing down internet/page requests.

This is just what I have noticed, so don't bash me on it... go test this stuff out for yourself.

after i read "eset going mad" thread i tried to replicate the false positive by opening programmes that were marked as virus/etc, nod identified comodo and two other apps as a virus, i did a manual update and it fixed the problem. guess i was lucky.

This is kind of funny, i just uninstalled NOD32 from all of my systems yesterday.

Because I realized 3.x sends all web traffic through ekern.exe as a web-proxy to scan for threats. The problem is you can't really turn it off, if you do when it then bugs you about not being fully active, and then when you reboot it turns it's self right back on.

Also the main issue in the way this setup is, if your running any kind of application rules based firewall, if you approve ekern.exe for access to the net, since all apps accessing the net are proxyied through this, you basically just approved all traffic from all applications, you can verify this by looking in like TcpView and opening Firefox, you'll see that Firefox doesn't open all the http connections to retrieve the content, but ekern.exe does.

Also this works the other way around, if you disable ekern.exe from internet access, chances are you just blocked most of your apps from getting to the web.

I didn't uninstall 100% for that reason, that is actually something that I came across while I was trying to figure out why I had a TON of open and half-open TCP connections.

The ekern part of the proxy is very inefficient at closing closed requests and I have seen reports of it actually slowing down internet/page requests.

This is just what I have noticed, so don't bash me on it... go test this stuff out for yourself.

It's something I have noticed too. Noticed web browsing can sometimes get really slow, then I uninstalled NOD32 and installed another product - no more speed problems. :/

This is kind of funny, i just uninstalled NOD32 from all of my systems yesterday.

Because I realized 3.x sends all web traffic through ekern.exe as a web-proxy to scan for threats. The problem is you can't really turn it off, if you do when it then bugs you about not being fully active, and then when you reboot it turns it's self right back on.

Also the main issue in the way this setup is, if your running any kind of application rules based firewall, if you approve ekern.exe for access to the net, since all apps accessing the net are proxyied through this, you basically just approved all traffic from all applications, you can verify this by looking in like TcpView and opening Firefox, you'll see that Firefox doesn't open all the http connections to retrieve the content, but ekern.exe does.

Also this works the other way around, if you disable ekern.exe from internet access, chances are you just blocked most of your apps from getting to the web.

I didn't uninstall 100% for that reason, that is actually something that I came across while I was trying to figure out why I had a TON of open and half-open TCP connections.

The ekern part of the proxy is very inefficient at closing closed requests and I have seen reports of it actually slowing down internet/page requests.

This is just what I have noticed, so don't bash me on it... go test this stuff out for yourself.

You?re totally right !

And even if you uncheck "Enable HTTP checking" (beside unchecking "Enable web access protection") it's just look disable but it's still doing the "proxy thing":angry:y:

I can't understand why ESET keep this "web access protection / proxy" "feature":x:x in the Antivirus ! this should be present only in the ESET Smart Security !

Better stay with v. 2.7 because v3 it's .........

Strange. I'm running v3 and I've had no problems. Sucks for you guys that had the issues though.

I'm willing to give them a free pass this time because I really like the AV and they have been really good thus far. If something like this happens again though, I'll consider switching back to Kaspersky.

Strange. I'm running v3 and I've had no problems. Sucks for you guys that had the issues though.

I'm willing to give them a free pass this time because I really like the AV and they have been really good thus far. If something like this happens again though, I'll consider switching back to Kaspersky.

I switched back to Kaspersky.

And now that Kaspersky 2009 has an 'a' patch that fixes a few important bugs. I'm really happy with it.

But I spent money on Eset Smart Security and it's not like I will get it back. :(

I switched back to Kaspersky.

And now that Kaspersky 2009 has an 'a' patch that fixes a few important bugs. I'm really happy with it.

But I spent money on Eset Smart Security and it's not like I will get it back. :(

Well Eset has a really good track record, and as far as I know, this is the first time something like this has happened with them. I wasn't effected by it, so I'm not all that concerned by it. They acted quickly and handled it well IMO. Like I said, due to their track record, I'm willing to give them a free pass on this one, but if they screw up again I will consider switching.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Indeed. But note that this has Wifi7, HDMI 2.1, BlueTooth 5.4, and 5G Ethernet, so even in the additional features list this bundle blows the Steam Machine away. And, with the money saved, one could improve this dramatically.
    • One of the strangest galaxies in our Universe could help answer some long overdue questions by Sayan Sen Image by Pixabay via Pexels | Not representative An international team of astronomers led by the Department of Astronomy at Tsinghua University has discovered an unusually metal-poor galaxy that may contain signs of first-generation star formation. The galaxy, named Metal-Pristine Galaxy COSMOS Redshift 3 (MPG-CR3), or CR3, was identified using observations from the James Webb Space Telescope (JWST), the Very Large Telescope (VLT), and the Subaru Telescope. The findings, published in The Astrophysical Journal Letters, describe CR3 as the most metal-poor galaxy known from the period known as "cosmic noon," around 11.5 billion years ago. Cosmic noon refers to a period when the universe was producing stars at its highest rate and galaxies were growing rapidly. In astronomy, "metals" refers to all elements heavier than helium, including oxygen, carbon, and iron. Because CR3 contains so few of these heavier elements, researchers say it closely resembles what scientists expect the earliest galaxies in the universe may have looked like. The discovery is significant because it could offer clues about Population III (Pop III) stars, the first generation of stars thought to have formed after the Big Bang. These stars are believed to have formed from gas made almost entirely of hydrogen and helium, before heavier elements were created inside stars and spread across the universe through supernova explosions. Hence this is why CR3 has been referred to as a "living fossil." Scientists have long believed that Population III stars existed only in the very early universe. As more generations of stars formed and died, they enriched surrounding gas with heavier elements, making the conditions needed for metal-free star formation increasingly rare. Because of this, researchers expected the formation of such stars to have largely ended after the epoch of reionization, a period when radiation from the first stars and galaxies transformed the neutral hydrogen filling the universe and made it largely transparent to ultraviolet light. CR3 appears to challenge that idea. The galaxy was observed at a redshift of z = 3.193 ± 0.016. Redshift measures how much light from a distant object has been stretched as the universe expands and helps astronomers determine how far back in time they are looking. In this case, the redshift corresponds to roughly 11.5 billion years ago during cosmic noon. Although the universe was already several billion years old by that point, CR3 shows characteristics more commonly associated with much earlier galaxies. Observations revealed exceptionally strong emissions from hydrogen and helium, including Lyα, Hα, and He I λ10830. Lyα, or Lyman-alpha emission, is a specific wavelength of light produced by hydrogen and is widely used to study distant galaxies. Hα emission is another hydrogen signature commonly used to trace active star formation, while He I λ10830 is produced by helium and can indicate the presence of very hot, young stars. The measured equivalent widths of EW₀(Lyα) = 822 ± 101 Å and EW₀(Hα) = 2814 ± 327 Å are among the highest ever observed in star-forming galaxies. Equivalent width is a measure of the strength of an emission line relative to the surrounding light, and such large values are typically associated with intense and very recent star formation. At the same time, researchers found no statistically significant detections of metal emission lines, including [O III] λλ4959, 5007 and C IV λλ1548, 1550. Emission lines act as chemical fingerprints that reveal which elements are present in a galaxy. Oxygen and carbon lines are commonly seen in galaxies that have already undergone significant chemical enrichment. Their absence in CR3 suggests an unusually pristine environment. Using abundance calibration methods developed with JWST observations, the team placed a 2σ upper limit on the galaxy's gas-phase metallicity of 12+log(O/H)<6.52, corresponding to less than 0.7% of the Sun's metallicity (Z < 7 × 10⁻³ Z⊙). Gas-phase metallicity measures the abundance of heavy elements in a galaxy's gas. A 2σ upper limit indicates that the true value is very unlikely to be higher than the quoted threshold. Even when accounting for uncertainties in the calibration methods, the most conservative limit remains 12+log(O/H)<6.95, making CR3 the most metal-poor galaxy identified at cosmic noon. The galaxy also appears to contain very little dust. Researchers measured a Lyα/Hα flux ratio of 13.9 ± 2.5, a result that suggests negligible dust attenuation, meaning very little of the galaxy's light is being absorbed or scattered by cosmic dust. Because dust is usually produced by earlier generations of stars, this finding further supports the idea that CR3 has experienced very little chemical enrichment. Further analysis using spectral energy distribution modelling, a technique that compares observed light with theoretical models, suggests that CR3 contains an extremely young stellar population only around 2 million years old. The modelling, which used Population III stellar templates, also indicates the galaxy has a stellar mass of approximately 6.1 × 10⁵ M⊙. The symbol M⊙ represents one solar mass, or the mass of the Sun. One of the key questions raised by the discovery is how such a chemically primitive galaxy could exist in a universe that had already spent billions of years producing heavier elements. To investigate this, the researchers examined CR3's surroundings. Their analysis suggests the galaxy may lie in a slightly underdense environment, with a density contrast of roughly δ ≈ −0.12. An underdense region contains less matter and fewer galaxies than average. The team suggests that this relative isolation may have helped preserve pockets of pristine gas. Metal-rich material expelled from nearby galaxies may never have reached CR3, while the lower rate of galaxy mergers and interactions could have slowed the mixing of enriched gas into the system. If future observations confirm these findings, CR3 could provide some of the strongest evidence yet that first-generation star formation continued well after the epoch of reionization. Such a result would challenge the conventional view that pristine star formation ended by z ≳ 6 and suggest that small pockets of metal-free gas survived much longer than previously thought. Researchers stress that more observations will be needed to determine the galaxy's true nature. Future spectroscopic studies with higher resolution and better signal quality could help confirm whether CR3 is genuinely hosting Population III star formation. The discovery is also expected to encourage searches for other similar galaxies, which could help astronomers better understand how the first stars formed and how galaxies evolved in the early universe. Source: Tsinghua University, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "I think in the immediate absence of a partner to apply relief" In the words of Sterling Archer... "Phrasing!"
    • For me, the fundamental problems with these "smartglasses" is that they really don't work well for people with significant prescriptions and massively up the price if you use attached lenses if they have displays, and if they don't, then they're not actually "smart" anything, rather just connecting to your phone and relaying voice to an AI. In a few cases like this, they throw in small cameras to feed video to the AI. All around, these feel like both a solution looking for a problem, and the problems it tries to solve seem more easily solved by different approaches and designs. Oddly, if the rumours are true, Apple may actually have invented something for once and it kind of does this right: put cameras in ear buds and manage the interface to AI exactly as most of us do: tapping on an ear bud and saying "Hey Google" or "Hey Siri." That makes them compatible with almost everyone, can double up as a hearing assist device, an impaired vision assist device, a "smart" device... and answer your phone and play music. That just seems like a better solution all around.
  • Recent Achievements

    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      454
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      107
    4. 4
      Michael Scrip
      84
    5. 5
      Steven P.
      71
  • Tell a friend

    Love Neowin? Tell a friend!