Jump to content

mayowa

Members
 View Profile  See their activity

  • Posts

    89

  • Joined

  • Last visited

 Content Type 

Posts posted by mayowa

    ESET ESMC Agent not installing

    in ESET Endpoint Products

    Posted

    Dear All

    We tried installing ESET ESMC Agent for a customer on three windows 8 desktop computers, but met with the error below during installation 

    Service ‘ESET Management Agent’(EraAgentSvc)failed to start.

    Verify that you have sufficient privileges to start system services

     

    Remediation 

    • We tried installing using admin account with the highest privilege but still encounters the same error stated above  

     

    Kindly Note

    Installation of ESMC Agent on laptop computers and servers were successful 

     

    Looking forward to your response 

     

    P.s  Please find the system log for your perusal  

     

    Regards 

    ees_logs.zip

    fhc.JPG

    ESET features disabled

    in ESET Endpoint Products

    Posted

    Some two machines at a clients branch have their ESET features disabled.

    Attempt to enable it has not been successful.

    Their license is not expiring soon as it’s usually the case when a license is about to expire.

    Currently, the IDS and HIPS are features not functioning on those machines.

    Remote deployment For Mac

    in ESET Endpoint Products

    Posted

    Dear All, 


    We are in the middle of closing a 1000 user Endpoint Security For MAC and client insist on a remote installation. 
    Please kindly confirm if the Endpoint Security for MAC can be push installed remotely ? 
    Can we have any documentation or guide on how to do achieve this ? 
    Looking forward to your quick response. 
    Regards. 

    Accessing ERA with a domain account credential

    in ESET PROTECT On-prem (Remote Management)

    Posted

    3 hours ago, MichalJ said:

    No, it is not possible to disable "Administrator" account. What is recommended is to secure the Administrator account with strong password, stored in a secured place. In case anything goes wrong with ESMC / ERA, it´s the only account that might be able to resolve the problems. 

    Thanks MichalJ

    How can they login using their domain credential ?

    Regards  

    ESET file security not installing on a server

    in ESET Products for Windows Servers

    Posted

    Dear All, 

    We upgrading a customer from version 5 to version 6 but during the process of upgrade on one of their DB server (windows server 2003, SP1 , 12GB ram and 1TB HDD)having an error pop up "ESET file security cannot be installed on this server", a similar server(application server) with the same spec installation of file security version 6 was possible 

    Action Taken

    •  Tried running as administrator (installation still not going through )
    • Checked if ESET file security V6 is compatible with  windows server 2003 SP1,from our list of server requirements,saw we support it and from what i saw of the application server with the same spec,i felt it is also possible 
    • I tried pushing file security from the ERA but AV push failed
    •  Requested for a server restart,followed up with installation still faced with the same error installation not possible 
    • Flushed temp folder,proceeded with installation but result still the same 

     

    Observation 

    Though there might be fragment of the previous version on the server , i suggested we use the manual uninstaller to check and removed such if possible,but as a DB server such can only be done at night,when people are not connected

    Kindly check attached document for log collect via ESET Log Collector for your perusal 

    Anticipating you swift response as always 

     

    Best Regards 

    ELC_logs.zip

    Decrypthelp@qq.com Ransomware

    in Malware Finding and Cleaning

    Posted

    26 minutes ago, Marcos said:

    Files with the arrow extension were encrypted by Filecoder.Crysis. Unfortunately, decryption is not possible. It is common that Filecoder.Crysis is run by attackers after performing a bruteforce RDP attack on a system and getting in with administrator rights. Subsequently they either disable or remove the security product in order to be able to run ransomware and encrypt files. I will drop you a personal message with further instructions shortly. If you had important files which were encrypted, we suggest keeping them in case that decryption would be possible in the future.

    Thanks for your quick response, on my way to the client site to intervene and get the encrypted files,also await your personal message for further instruction 

    Coin Miner

    in Malware Finding and Cleaning

    Posted

    15 minutes ago, itman said:

    Post screen shots of what Eset is detecting. For example, the actual alert popup and entries from the log file.

    Thanks Itman for your response as requested please find attached document for "screen shot of what ESET is detecting "on entries from the log file",Kindly check the ftp support server for the log as requested with the name Egbin efsw_logs.zip

    I await your response in anticipation for a quick resolution 

    Regards 

    Egbin 2_LI.jpg

    Coin Miner

    in Malware Finding and Cleaning

    Posted

    On 5/28/2018 at 1:43 PM, mayowa said:

    Hello Macros

    I will like to follow up on the subject matter as reported earlier 

    Hello All,

    kindly help with above subject caption,we need immediate remediation because the client is running out of patience as it keeps coming backing after ESET detects and deletes it

    Actually we thought of isolating the server,but it has spread to other servers and work stations 

    Coin Miner

    in Malware Finding and Cleaning

    Posted

    On 5/24/2018 at 4:18 PM, mayowa said:

    Thanks Marcos for your swift response

    Kindly check the ftp support server for the log as requested with the name Egbin efsw_logs.zip

    I await your feedback for a resolution 

    Thanks in anticipation 

    Best Regards 

    Hello Macros

    I will like to follow up on the subject matter as reported earlier 

×
×
  • Create New...