SEB and ESET

[ecahillgs]

Hello there!

I am trying to help a customer of mine who uses SEB. I manage their ESET antivirus.
In December they told me they'd been using ESET and SEB together for about 8 months with no issue.
They mentioned that in the summer there was a SEB update/change and now it doesn't work with ESET Endpoint Security installed.
I've tried excluding the SEB file paths in performance exclusions, as well as creating process exclusions for the exes.
I've also tried creating a firewall rule to accommodate the executable, just in case ESET was blocking traffic, but no luck.

I understand that ESET is not one of the compatible antivirus listed on your website, but I want to try and help my customer so I thought I'd come here.

They are running ESET Endpoint Security version 9.0.2032.6 on a Windows 10 device.
I am waiting to hear back on what version of SEB they are running.

Many thanks for any insights,
Erin

[dbuechel]

So far, it was most of the time the SEB service component SafeExamBrowser.Service.exe which runs under the system account which was detected as false positive. We thus decided to bypass the service component by default, starting with version 3.1.0 if I recall correctly. So yes, if it is a version minor or equal to 3.3.1 then that could be an explanation.

Do you happen to have a specific error message which SEB displays, or is there any data available in ESET which would give more information about why SEB would be blocked?

[ecahillgs]

I see! I wonder if I create a performance or process exclusion for the service, if that will help! I may try that.

I'm just waiting on them to let me know the version they are running. Would you recommend rolling back to a previous version of SEB, if we're unable to accommodate through rules/exclusions?

Unfortunately, we do not have any errors. Nothing in the network troubleshoot wizard, nothing in the log files. However, they have said since they need to complete the exams they are using two devices without ESET to run SEB, in the meantime.

As soon as I know the version, I will let you know.
Many thanks again for your help!
Erin

[dbuechel]

Would you recommend rolling back to a previous version of SEB, if we're unable to accommodate through rules/exclusions?

No, definitely not. We regularly update SEB with improvements and bug fixes, furthermore there are (often important) security updates for the browser engine, so we recommend to always use the latest release version.

Unfortunately, we do not have any errors. Nothing in the network troubleshoot wizard, nothing in the log files.

I unfortunately do not know ESET, but the anti-virus providers I've used always had a log or quarantine feature where one could see exactly which files and processes had been blocked and why.

[ecahillgs]

Understood!

They've communicated to me that they are using version 2.3.0, which looks to be quite behind.
I will recommend they upgrade to the latest version of SEB.

Yeah, typically those logs and the quarantine information are what I would use to solve something like this but this time they keep coming up blank. If I do happen to find a relevant log/information, I'll be sure to let you know.

I've created an IDS rule for the SafeExamBrowser.Service.exe service, and they should be testing today.