Peter Randziak

It's a false positive. A new update is being prepared which will address it. We apologize for the inconvenience.

I checked the detections on mentioned VT links and both files are subject of detection as of now...

Could you please provide us more details (trace logs from ESET PROTECT) via private message? It might indicate some database-related issue, possibly triggered by upgrade.

Hello,
our Italian office suggested to change the word fasulli to fraudolenti. The change will be visible in the next product build. Thank you for your report.
Tom

Ok i think i found solution.
On local task scheduled in advanced option is set to shutdown after finished task.
So i changed that and it should be it.
Thanks for help.

Try again in one hour, the support said that there is a problem with the main server.

Thanks Peter I appreciate it. 

Hello @BenoitR,
the ESET Server Security for Microsoft Windows Server supports the Auto-update.
Additional release for automatic updates of the build 9.0.12013.0 will replace the original major release build 9.0.12012.0, and is planned after the safety period (~30 days). 
Peter

Hello @Trooper
ESET PROTECT Cloud hasn't used the affected Configuration module, so #1 from the list is not applicable 
https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510/?do=findComment&comment=153054
#2 and #3 from the list should be resolved automatically with the fixed Configuration module so based on my current knowledge of the issue, you do not need to take any action.
 
Peter 

I think there may have been some corruption in the scheduled tasks. I was able to resolve the issue by deleting all of the scheduled tasks that were being pushed down by ESET PROTECT and recreating them. All computers have been stable all weekend.

Hi @Peter Randziak --
I was able to resolve the issue by deleting all of the scheduled tasks that were being pushed down by ESET PROTECT and recreating them. All computers have been stable all weekend.
Thank you,
--Rob

Hello @Rob Schember,
I assume that the computers are managed by ESET PROTECT / ESMC / ERA, right? 
 
I would first check the Action after scan in the scheduled tasks.
The policy / settings corruption might happen in 3 scenarios, see https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510/?do=findComment&comment=153054 for details.
If the issue occurs on your ESET PROTECT management console you need to
1. switch it to pre-release update channel to get the fixed Configuration module 
2. Manually fix the policies / scheduled tasks (if the policy is already corrupted, the Configuration module 2011.5 is not able to repair it, thus the manual fix is needed)
Please do not edit the policies using the older Configuration module, as it might cause further issues 
 
If it won't help, get an ESET Log Collector output from the affected machine, upload it to a safe location and send a private message with download details to me and Marcos to check with a reference to this post.
 
If correctly-looking policies would apply incorrectly on Endpoint 9.1 , the problem should be solved automatically (by just updating).
Peter
 

Thank you @Peter Randziak

Hello guys,
Fixed configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints

Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption.
 
Peter

Hello guys,
our technology and tech support teams are on it, we are investigating this with a priority.
We probably already identified the module version causing the issue.
 
We apologize for the inconvenience caused.
Peter

Hello @Trooper,
it has been reported at 
https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510
https://forum.eset.com/topic/32896-latest-endpoint-security-reboots-itself-after-updateagain/
I would recommend to check those for further updates.
 
We apologize for the inconvenience caused by it.
Peter

I have set a rule to block any traffic going to/from 8.8.8.8 at the top of ESET firewall table, so it is unlikely my machine is infected.
According to eveyone in this thread, I can only assume ekrn is using 8.8.8.8 sometimes.
 

(In Win10 and Linux I've set DNSWatch servers, the router uses the provider DNS servers, DoH is forced disabled with GP's)
I did some more testing and I can confirm that Eset antispam module is using google DNS servers for resolve *.e5.sk , it bypasses the custom firewall rule to block connections to 8.0.0.0/9 and no log entry is created.


This is why I've disabled the antispam module long time ago, but at least with the older EIS/ESS versions the firewall rule was respected (connection blocked + entries in the log).
I've disabled unused ESS features, so I can't check if Eset engine uses google DNS servers for other modules.

Hello guys,
our technology and tech support teams are on it, we are investigating this with a priority.
We probably already identified the module version causing the issue.
 
We apologize for the inconvenience caused.
Peter

Hello @JimChev3,
it has been reported at 
https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510
https://forum.eset.com/topic/32896-latest-endpoint-security-reboots-itself-after-updateagain/
I would recommend to check those for further updates.
We apologize for the inconvenience caused by it.
Peter

I've already raised the "Failed to copy files" under ticket 00388505, so will wait to hear back from that. 👍

Hello guys,
our technology and tech support teams are on it, we are investigating this with a priority.
We probably already identified the module version causing the issue.
 
We apologize for the inconvenience caused.
Peter

Thanks for the response. Just as an update, we did revert back to 9.0.2046.0 and we had no shutdowns after the scan last night.
Should I expect a response here in the form or on my support ticket?

We believe that we have nailed it down to the Configuration Engine 2011.4 that has been distributed to a couple of hundreds of ESET PROTECT users since yesterday so far. What is weird is that the module had been available for millions of Endpoint users without any such issue reported. We are working on it hard to figure out the cause and to bring a fix as soon as possible. We apologize for the inconvenience.

thinks for this information