"Your license file does not contain a Username or Password."

[TheSkymanDC 4]

Marcos - my post from Wednesday at 7:40 am shows that the username and password are not found.  

Or am I misunderstanding?

 

 

[Jfa 0]

On 1/12/2018 at 9:40 PM, Marcos said:

As for the problems with LiveGrid, they are not related to the issue discussed in this topic in case that the Username and Password values are present in the registry and the license is valid.

It'd be related only if you are also getting the message "The credentials used to access LiveGrid servers are not correct" below the warning "ESET LiveGrid is not accessible". The best would be to discuss these issues in another topic so as not to mix different issues here.

On the client you can test LiveGrid by downloading the CloudCar test file. If it's detected as "Suspicious object", LiveGrid is working at the moment alright. To determine how often a problem accessing LiveGrid servers occur, temporarily set the minimum logging verbosity to Diagnostics in the advanced setup -> Tools -> Log files. You'll subsequently see unsuccessful connection attempts in the ESET Event log. For troubleshooting we'd need a Wireshark log from time when Endpoint is failing to connect to LiveGrid servers.

Regarding the username/password issue, we have a Configuration Engine for the ERA agent ready which will import the username and password from the license file to the registry which will eventually fix the issue for users who are still having this issue and haven't deactivated/reactivated the license nor uninstalled/reinstalled Endpoint on troublesome units yet. Also we expect a fixed version of Endpoint to be released next week (probably on Wednesday).

Dear Marcos,

Do you know if the new Endpoint version that probably will solve the problems of the v6.6.2068, will be released this week?

Thanks in advance

 

Edited January 17, 2018 by Jfa

[Marcos 5,074]

10 minutes ago, Jfa said:

Do you know if the new Endpoint version that probably will solve the problems of the v6.6.2068, will be released this week?

Yes, Endpoint 6.6.2072 will be released tomorrow. If you are having the issue discussed in this topic, did you try deactivating and reactivating Endpoint as per the instructions at https://support.eset.com/kb6636 ?

[Jfa 0]

2 minutes ago, Marcos said:

Yes, Endpoint 6.6.2072 will be released tomorrow. If you are having the issue discussed in this topic, did you try deactivating and reactivating Endpoint as per the instructions at https://support.eset.com/kb6636 ?

Thanks Marcos. Yes, we have tried that workaround with one computer but problem persists. The situation here is under control, we will wait for the new release

[Marcos 5,074]

I'm happy to announce you that we have released Endpoint 6.6.2072 which ultimately addresses the issue with the username and password being deleted from the registry as well as all further issues stemming from that.

On behalf of ESET I'd like to apologize for the inconvenience. We have adjusted QA test cases and included upgrade with a license selected in the Software install task to prevent issues like this from occurring in the future.

[Jfa 0]

21 minutes ago, Marcos said:

I'm happy to announce you that we have released Endpoint 6.6.2072 which ultimately addresses the issue with the username and password being deleted from the registry as well as all further issues stemming from that.

On behalf of ESET I'd like to apologize for the inconvenience. We have adjusted QA test cases and included upgrade with a license selected in the Software install task to prevent issues like this from occurring in the future.

Already tested Endpoint Antivirus and Endpoint Security v6.6.2072! Work like a charm (no problems with activation / updates / uninstall)

Thanks Marcos,

Thanks ESET

Edited January 18, 2018 by Jfa

[IT_BEE 0]

Hi everyone. I'm one of affected too. I installed version 6.6.2.068 on even 40 PCs nad NTBs. I tried everything in this tread, but nothink helped me. So i just wait for new version 6.6.2072 and yes, it helps me on few PCs, where i have older version (6.6.2046) or where eset is not installed, but on those PCs and NTBs where i have 6.6.2068 it end with errors and i have to manually uninstall eset from safe mode. Its frustrated that i have to go to all our employees and manually unistall esets. Is there better way to do it than from safe mode?

 

Thanks with regard

Jan Král

[Marcos 5,074]

1 minute ago, IT_BEE said:

I installed version 6.6.2.068 on even 40 PCs nad NTBs. I tried everything in this tread, but nothink helped me. So i just wait for new version 6.6.2072 and yes, it helps me on few PCs, where i have older version (6.6.2046) or where eset is not installed, but on those PCs and NTBs where i have 6.6.2068 it end with errors and i have to manually uninstall eset from safe mode.

Please provide me with an install log created as per the instructions at https://support.eset.com/kb406/ and logs collected with ELC. Does rebooting a computer prior to upgrading to v6.6.2072 make a difference?

What happens if you try to unistall ESET in normal mode? As for the Uninstall tool, it can be run only in safe mode.

[IT_BEE 0]

Can i post you just software-install.log from c$\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs?

 

Thanks

[Marcos 5,074]

38 minutes ago, IT_BEE said:

Can i post you just software-install.log from c$\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs?

Yes please. The best would be if I could also get logs collected by ELC in case there are related records in the system event log.

[IT_BEE 0]

Hi, so there is log from c$\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs, from one of our PC. I install eset from ERA using push install. 

If i try to install it manually, it ends with error that it can not stop ekrn service. If i use eset with AV remover, it ends with error MSI.1921. So is there any other way to uninstall/reinstall eset without uninstall tool from safe mode?

 

Thanks

software-install.log

[ITHoneyBadger 0]

I deactivated one of the affected machines in ELA, rebooted the machine and tried to push the new client via ERA, it fails.  I downloaded the updated client to my machine, which is one of the borked 6.6.2068 machines and ran it as admin, it gets most of the way through and throws the error "Service "ESET Service" (ekrn) could not be deleted.  Verify that you have sufficient privileges to remove system services."

 

[Marcos 5,074]

1 hour ago, ITHoneyBadger said:

I deactivated one of the affected machines in ELA, rebooted the machine and tried to push the new client via ERA, it fails.  I downloaded the updated client to my machine, which is one of the borked 6.6.2068 machines and ran it as admin, it gets most of the way through and throws the error "Service "ESET Service" (ekrn) could not be deleted.  Verify that you have sufficient privileges to remove system services."

@IT_BEE @ITHoneyBadger Please check if information about installed modules is displayed after clicking "Show all modules" in the Update panel. If no modules are shown, then ekrn is in a bad state and upgrade would likely fail. Try restarting the computer first. Let us know if it helped.

[IT_BEE 0]

I tried to stop resident protection in ESET, after restart PC i just rename folder C:\Program Files\ESET\ESET Security to ESET Security_old, next restart, and then it can stop service ekrn and install new eset. This worked on 2 PCs. Other two that i tested now have problem to install new eset, because error "You dont have privilege to install system services)" or something like that. So half way solution :(.

[Marcos 5,074]

2 minutes ago, IT_BEE said:

I tried to stop resident protection in ESET, after restart PC i just rename folder C:\Program Files\ESET\ESET Security to ESET Security_old, next restart, and then it can stop service ekrn and install new eset. This worked on 2 PCs. Other two that i tested now have problem to install new eset, because error "You dont have privilege to install system services)" or something like that.

This has nothing to do with real-time protection but rather with self-defense and a weird state of ekrn that can happen under certain circumstances on machines where the issue manifests. Normally you shouldn't do anything but reboot the machine. Are you getting the same error about starting ekrn even right after a reboot?

[ITHoneyBadger 0]

Rebooting my machine got the system tray icon back and no module errors, We have the client password protected so users cannot modify anything, normally when uninstalling, we enter this password and uninstall works.  Sadly on my system it fails, so i may need to try the Safe Mode uninstaller as the client will not open or populate the system tray.

Rebooting the other system and trying another push, and even an uninstall thru ERA still fails on each attempt. 

[Marcos 5,074]

38 minutes ago, ITHoneyBadger said:

Rebooting my machine got the system tray icon back and no module errors, We have the client password protected so users cannot modify anything, normally when uninstalling, we enter this password and uninstall works.  Sadly on my system it fails, so i may need to try the Safe Mode uninstaller as the client will not open or populate the system tray.

Rebooting the other system and trying another push, and even an uninstall thru ERA still fails on each attempt. 

This is weird. What about the modules in the Update panel -> Show all modules? If you click that link, do you get a list of installed modules or it's empty?

[Jboring 0]

The new patch has thankfully fixed the majority of our broken endpoints.  Unfortunately, I've got a decent chunk of 6.2068 installs I can't get rid of on remote machines (would take weeks to do each machine individually with the safe-mode uninstaller).  The problem is a registry key that refuses to be removed.

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe

Anyone have a way around this?

 

[Marcos 5,074]

8 minutes ago, Jboring said:

Anyone have a way around this?

If you click 'Show all modules" in the Update panel, do you get a list of installed modules or it's empty? If empty, after rebooting the computer ekrn should load alright and upgrade should finish alright as well.

[Jboring 0]

The majority of these appear to be in sort of a half-installed state, so I can't open up the GUI.  Today I found that I could remove the ekrn service registry key, reboot, then use the stand-alone installer to get 6.6.2072 working, at least on the machines I've tried it on.

[IT_BEE 0]

Hi. I end up to manually remove ESETs from safe mode, because there is no fix for reinstall it from windows or with push install from console. On few PCs i can reinstall esets, but most of them i end in safe mode.

Now even if eset is on PC in version 6.6.2072, there is still pop up windows from eset and something like "ESET need attention - ESET Main Gui" but when i open eset there is no error. Have anyone same error with ESET Main Gui?

 

Thanks

[Marcos 5,074]

We've already released an ERA Configuration module to several dozens of users which fixes the issue for those who haven't upgraded to v6.6.2072 yet. After a computer restart Endpoint should work alright.

[IT_BEE 0]

Ok i will wait. And in attachment is screen of error. In english that mean something like "Your system is at risk".

And i have another question. In ERA when i want to select package to push installation task, there is version 6.6.2072.1, but on your sites, there is version 6.6.2072.3. When will be version 6.6.2072.3 availlabel in ERA? And what changes are in this version?

 

Thanks and sorry for my english

[MichalJ 434]

ERA repository will be updated later, hopefully today. Version 6.6.2072.3 is a hot-fix, that resolves a potential of BSOD on the latest version of Windows 10, 32-bit systems (Microsoft has made a change in the latest update, that had conflicted with our Anti-Stealth functionality, so we have released a new module - those installers are just repacked with the new Anti-Stealth module). 

[ITHoneyBadger 0]

6.6.2072 is a no-go for our still affected machines.  Does ESET have any plans to issue an update that can actually fix the issue, or are the rest of us SOL and left with safe mode uninstalls with the uninstall tool as our only hope here?