Can't remove old version of ERA agent on some PCs

[av-user 0]

Hello!

I tried to start task from ESET Remote Administrator Console, to update ERA Agent (new version 6.5.522.0), so, on some computers it ended with an error: "Service 'ESET Remote Administrator Agent' (EraAgentSvc) could not be stopped"

When I try to remove ERA Agent through the computer's Control Panel, the installation hangs at ERA service stopping.

Why on some PC uninstaller can't remove ERA agent? 

 

Edited October 3, 2017 by av-user

[tmuster2k 22]

what version of the agent are they on?  Have you tried GPO uninstall?

[Markovskij 2]

Maybe i can hijack this thread?

When trying to update agents to the latest version,  i get errors like "access denies or file not found". It appears that the installer wants the old version of agent_64.msi file to uninstall the old agent, but in that location a new version of agent_64.msi is already present for installation, so uninstall cannot continue and rolls back. The same happens through Web Console or manual installation with bat file.

Is this a bug? Where can i download old versions of agent.msi to uninstall them?
[EDIT] i found old installer on the computer and it did not help, it reject those files, says they're not a valid installation package, i'm reading about manual removal now, i hope it will help:
https://support.eset.com/kb6007/?locale=en_US&viewlocale=en_US

Edited October 19, 2017 by Markovskij
more info

[MartinK 378]

On 10/3/2017 at 1:48 PM, av-user said:

Hello!

I tried to start task from ESET Remote Administrator Console, to update ERA Agent (new version 6.5.522.0), so, on some computers it ended with an error: "Service 'ESET Remote Administrator Agent' (EraAgentSvc) could not be stopped"

When I try to remove ERA Agent through the computer's Control Panel, the installation hangs at ERA service stopping.

Why on some PC uninstaller can't remove ERA agent? 

 

There is quite too many possibility to guess without logs. I would recommend to contact your local support and provide them trace logs from client machines. Possible issues with stopping AGENT includes:

• AGENT is executing long-term task, that it for some reason cannot interrupt
• There is something wrong with self-defense, which is handled by HIPS module of installed EES/EAV
• AGENT was not properly installed and thus not stopping properly

I would also try to reboot machine and try to uninstall AGENT after startup. Also disabling HIPS module in EES/EAV may help (disabling requires reboot) and if this would help, please provide us HIPS module version as seen in EES/EAV version information.

[MartinK 378]

12 hours ago, Markovskij said:

Maybe i can hijack this thread?

When trying to update agents to the latest version,  i get errors like "access denies or file not found". It appears that the installer wants the old version of agent_64.msi file to uninstall the old agent, but in that location a new version of agent_64.msi is already present for installation, so uninstall cannot continue and rolls back. The same happens through Web Console or manual installation with bat file.

Is this a bug? Where can i download old versions of agent.msi to uninstall them?
[EDIT] i found old installer on the computer and it did not help, it reject those files, says they're not a valid installation package, i'm reading about manual removal now, i hope it will help:
https://support.eset.com/kb6007/?locale=en_US&viewlocale=en_US

Not sure I understand. In case there is new installer on path, why there is "access denied or not found" error? Or installer is trying to load installer with different name than agent_x64.msi? Asking because this is known limitation of MSIEXEC, which requires presence of old installer when repairing. IS there any change you are actually repairing installation, i.e. installing the same version?

[Markovskij 2]

Sorry if it sounds awkward, i was also confused when it happened. Later i found out that the Agent files in "Program Files" directory were the latest version (6.5), but Web Console reported the Agent to be 6.2. Installation, repair or uninstall did not work with any version of agent_x64.msi package. So i manually removed the Agent, and manually reinstalled the latest version and now everything is OK. I'm not sure what has happened. I had problems with remote installations, because smb1 is disabled on windows now, so i had to edit Linux server scripts to use smb=2.0, maybe something went wrong in between.

Thank you for your reply!

[av-user 0]

On 10.10.2017 at 8:29 AM, tmuster2k said:

what version of the agent are they on?  Have you tried GPO uninstall?

1. ERA 6.4.283.0

2. I tried this method with the same result.

Quote

 please provide us HIPS module version as seen in EES/EAV version information.

HIPS module: 1299 (20170926)

 

Edited October 23, 2017 by av-user

[MartinK 378]

Could you please post me a PM with:

• MSIEXEG log of failed AGENT upgrade (see documentation for enabling installation log)
• AGENT trace log (see documentation for trace log location) from the same time as failed installation.

There are two most common issue when stopping AGENT service: stopping is not possible because of glitch in self-defense (HIPS module in security product) or because of problem in AGENT itself, caused by long-running task, or possible other "stuck" operations that are blocking proper shutdown required during upgrade.

How does AGENT behaves after failed upgrade attempt - is it still connecting to ERA? Have you tried to uninstall in safe mode? Or even using ESET Uninstaller tool in safe mode? What is the version history of AGENT installation on problematic computers - i.e. what method was used to deploy AGENT (manual, remote deployment, GPO, SCCM) and which version?

[av-user 0]

Hips deactivation, PC reboot and remote update of ERA Agent helps me on two problem PCs.

There is no problem with removing Agent using ESET Uninstaller tool in safe mode.

>How does AGENT behaves after failed upgrade attempt - is it still connecting to ERA?

Yes, after fail of uninstallation Agent works and connecting with ERA server fine. 

>What is the version history of AGENT installation on problematic computers - i.e. what method was used to deploy AGENT (manual, remote deployment, GPO, SCCM) and which version?

I'm using two methods of Agent deployment:

- EraAgentInstaller.bat

- Server task from ERA server.

and the problem arises and both cases are selective.

Problems arose only with the agent version 6.4.283.0. On computers on which v. 6.4.283.0 was originally installed and on computers that were updated from v. 6.2.190.0.

Edited October 26, 2017 by av-user

[HSW 9]

Deactivate Agent service (dont stop only disable) and reboot. After this the uninstall is mostly possible. Sometimes in the past i must clean manuell. Deactivate, reboot, delete programm folder, programm data folder and reg (sometimes also must delete the services manuell) i hope for you deactivate and reboot is enough ^^

[av-user 0]

HSW, It's hardly to repair every PC manually with this method :((

[HSW 9]

i know i know ^^ but since 6.4 i dont had this problems anymore before every update 1-5% of the clients

 

[av-user 0]

HSW, so mb it might be some notes at this article about known issue of ERA 6.4.283.0.

On 23.10.2017 at 11:55 PM, MartinK said:

Could you please post me a PM with

I did it, MartinK.

Edited October 26, 2017 by av-user