Thib

Windows 'Behavior Alert!' freeze

Recommended Posts

Hello guys,

On a fresh installation, still in evaluation mode, I have the following issue.

On the first restart after the installation, I have the windows for the choice of allow/block a new connection. I cannot select any options, this windows is frozen and the worst and it's stay on top on all other windows in the middle of the screen.

I wait 10-15 minutes, without any reaction, before kill it with task manager.

I don't have access to Control Panel (classic and new version) since your application crash, it's doesn't open or show empty list.

Also, for the initial rules created after the installation, why I have all with program directly in trusted application without asking if I want it.

 

Subsidiary question:

If I finally decide to buy it, it's not possible to buy one or more different with the same group reduction? In my case, I don't need the firewall because I have an hardware FW with IPS. However I want one for my laptop.

 

Thanks for your help!

Share this post


Link to post
Share on other sites

Addendum:

After the second reboot, I have the same issue; pfa a screenshot.

The other issue is that I cannot shutdown properly my computer now, it's stay on the windows "Restarting..." screen and I must force the shutdown.

I wait +20 minutes before doing it; usually my computer reboot in less than 30 seconds (Win10 is installed on NVMe M.2 drive).

 

emsisoft-error.png
Download Image

Share this post


Link to post
Share on other sites

Do you have any other anti-malware or anti-virus programmes installed?   Do you know which version of EIS your trial install is for?   When you get the behaviour alert shown in your screenshot, is it possible to dismiss the "not responding" window, and then click the "View details" option to see what the alert is for?

Share this post


Link to post
Share on other sites
On 1/7/2017 at 6:35 AM, Thib said:

Also, for the initial rules created after the installation, why I have all with program directly in trusted application without asking if I want it.

More than likely it is digitally signed by a trustworthy publisher, and thus is always allowed automatically.

 

On 1/7/2017 at 6:35 AM, Thib said:

If I finally decide to buy it, it's not possible to buy one or more different with the same group reduction? In my case, I don't need the firewall because I have an hardware FW with IPS. However I want one for my laptop.

In that case you'd have to purchase Emsisoft Anti-Malware and Emsisoft Internet Security (they can both be on the same order). I don't think there's a "volume" discount applied when purchasing 1 license for each product, however I can ask one of our sales team for confirmation.

 

As for the freezing issue, lets try getting a diagnostic log. You can download the batch file for generating the log from this link, and there are instructions for running it at this link. Please be sure that you don't use the download link in the instructions, as it is out of date.

When it's done, it will open a log in Notepad (as explained in the instructions). Please save this log somewhere easy to find, such as on your Desktop or in your Documents folder, and then send it to me in a Private Message so that I can take a look at it.

Important: Don't post the log publicly. It contains a copy of your a2settings.ini file, which contains encrypted license information. If someone were to figure out how to break that encryption, then someone else could use your license key.

Share this post


Link to post
Share on other sites

I found one program to trying to connect at the startup and I make a rule for allowing this connection. I don't have this issue since.
For your information, it was the Synology Cloud Client who wanted to connect to my personal NAS.

I don't know what only this connection generate this issue... I can provide logs files if you want to investigate.

 

On 08/01/2017 at 16:26, JeremyNicoll said:

Do you have any other anti-malware or anti-virus programmes installed?   Do you know which version of EIS your trial install is for?   When you get the behaviour alert shown in your screenshot, is it possible to dismiss the "not responding" window, and then click the "View details" option to see what the alert is for?

I only have SypBot installed, but without active agents (only used for manual scan and blacklist hosts in the host's file).
I installed the last version available.
Neither buttons are responding.

 

On 10/01/2017 at 07:39, GT500 said:

More than likely it is digitally signed by a trustworthy publisher, and thus is always allowed automatically.

Yes, I understand but it's not that a program is digitally signed that we must trust it.

And in my opinion, this product miss a important option to allow/deny temporary a program a connection.
E.G. if I install a application/drivers, I don't need to have definitely a rule allowing/denying an external connection.

 

On 10/01/2017 at 07:39, GT500 said:

In that case you'd have to purchase Emsisoft Anti-Malware and Emsisoft Internet Security (they can both be on the same order). I don't think there's a "volume" discount applied when purchasing 1 license for each product, however I can ask one of our sales team for confirmation.

I want 4 licenses, at least 1 Security for the laptop and AM for others; so they are a difference on the price and on the discount (50% instead 30%).
However, I already tried to order both version and I only found in my basket the last product added

 

Share this post


Link to post
Share on other sites
17 hours ago, Thib said:

I don't know what only this connection generate this issue... I can provide logs files if you want to investigate.

Before getting logs, our developers may want to see a memory dump. To do this you will need to go in to the Settings in EIS, and turn off the Self Protection (it'll be one of the option in the upper-left, right under Guard Settings). You will also need to add an exclusion for the program you are using to save the memory dump, otherwise it will freeze when it tries to save the dump.

Exclusions is in the menu at the top in EIS, and there will be two lists (one for the anti-virus/scanning engines, and one for the Behavior Blocker/monitoring). You will need to exclude the program in both lists. If you system is 64-bit, then excluding Process Hacker is easier, so we'll try it. You can get it from this link. Just use the Add file and Add program buttons to the right of the exclusion lists to add the Process Hacker file that needs to be excluded (or just add the whole Process Hacker folder) to each list. Here's an example of the path to the file that needs to be excluded:

C:\Users\<username>\Desktop\processhacker-2.39-bin\x64\ProcessHacker.exe

If your system is 32-bit, then be sure to exclude the one in the x86 folder instead of the x64 folder.

Once you've excluded Process Hacker, try to reproduce the problem you were having, and then launch Process Hacker and find a2service.exe in the list. Right-click on it, and select Create dump file to save the dump. Once it is saved, I recommend zipping it with something like 7-Zip or WinRAR to reduce the size, and then you should be able to attach it to a reply so that I can forward it to our developers.

 

17 hours ago, Thib said:

Yes, I understand but it's not that a program is digitally signed that we must trust it.

Digital signatures are there to provide a way to verify the safety of programs. They allow us to determine that a program came from a publisher that is trustworthy, and hasn't been modified since it was distributed by that publisher. If there is a malicious program that is digitally signed, then we generally blacklist the certificate so that any software that is signed with it will be automatically blocked by our Behavior Blocker.

 

17 hours ago, Thib said:

... this product miss a important option to allow/deny temporary a program a connection.

The "Allow once" button will allow it for the session (until the application is closed).

 

18 hours ago, Thib said:

I want 4 licenses, at least 1 Security for the laptop and AM for others; so they are a difference on the price and on the discount (50% instead 30%).
However, I already tried to order both version and I only found in my basket the last product added

I'll ask one of our sales representatives about this.

Share this post


Link to post
Share on other sites

Hello Thib,

I'll be glad to help you with your order so that we can consider volume rebate even if the products are different.

As you've mentioned "at least" a license for Emsisoft Internet Security for one system should be included, please could you let me know how many seats for Emsisoft Internet Security and for Emsisoft Anti-Malware you would need and I'll prepare a purchase link for you which can fit your needs.

You might want to reply to me per private message (PM) here in the forum so that I can help you with your order and send you a link to the shopping cart there.

 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.