New Error After Upgrade: Event 7006 Service Control Manager

[tjg79 3]

I'm getting a new error in my Windows Logs after upgrading to ESET Smart Security Premium. The error occurs during start up. The error is Event 7006 Service Control Manager. The general description is: The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

Is this a known condition for ESET Smart Security Premium?

Regards

 

[tjg79 3]

A Google search for this error seems to indicate that this error is associated with Internet Security/Anti-virus software. Therefore, I getting an impression that this error is related to the ESET Smart Security Premium software program.

 

[itman 1,659]

For future reference, you should search both the Internet Secuity and NOD32 sections of the forum for similar threads: https://forum.eset.com/topic/15143-update-11142-event-error-scregsetvalueexw/

[tjg79 3]

So, what's the fix? It appears to be ESET related.

[tjg79 3]

Attached are screen shots of the Windows Log: System that report the error.

 

[tjg79 3]

OK, this problem is fixed. I sent a message to ESET Tech Support and they sent the following instructions. I'm no longer seeing the error in my Windows Logs: System.

An ESET Technical Support Representative has updated this case with the following information:

Hello,

Thank you for contacting ESET North America Technical Support. In order to resolve the issue you will need to uninstall and reinstall ESET in order to resolve any registry issues.

For illustrated instructions to uninstall or reinstall ESET Smart Security Premium, visit:

hxxp://support.eset.com/zap/kb2788

Or, follow the steps below:
=========
DOWNLOAD:
=========
1. Download ESET Smart Security Premium from the link below:
------------------------------------------------------------------------------
https://download.eset.com/com/eset/tools/installers/live_essp/latest/eset_smart_security_premium_live_installer.exe
------------------------------------------------------------------------------
2. When prompted to Run or Save, click ‘Save’ and save the file to your Desktop. Do not run the file until you uninstall your previous installation, explained in the next step.
=========
UNINSTALL:
=========
After the download completes, you must uninstall your current ESET product. Please follow the instructions from the applicable Knowledgebase article below:
------------------------------------------------------------------------------
Windows 10 users

hxxp://support.eset.com/zap/kb5547/

Windows 8 users

hxxp://support.eset.com/zap/kb3160/

Windows 7 users

hxxp://support.eset.com/zap/kb6338/

------------------------------------------------------------------------------
1. From the Start menu, select ‘All Programs’ -> ‘ESET’ -> ‘ESET NOD32 Antivirus’ -> ‘Uninstall’.

2. Follow the prompts to uninstall your ESET product and restart your computer to complete uninstallation.

3. Once your computer has restarted, click ‘Start’ -> ‘My Computer’ -> ‘Local Disk(C:)’ -> ‘Program Files’ and attempt to locate an 'ESET' folder. In most circumstances, this folder should have been removed by the uninstall process but if it is still here, delete it.

WARNING: Delete the ESET folder ONLY. Do not delete the 'Program Files' folder.
=========
REINSTALL:
=========
1. After successfully removing your ESET product, you will need to reinstall it. Navigate to your Desktop where you saved the ESET Live Installer file (If you are using Windows 8.x, press the Windows key + F to search and then type "eset" into the search bar) and double-click the file to open it.

2. Follow the steps in the installation wizard to complete your installation.

3. In the Product Activation window, type your License Key (or Activation Key) into the field and click 'Activate'.
Make sure you enter the License Key exactly as it appears and include the hyphens. If you copy/paste be sure you don't accidentally select additional space around the text. Your license information is included below for your convenience:

Edited April 11, 2018 by tjg79

[itman 1,659]

I believe the reason you're no longer seeing the registry access denied Win event log entry is because when you reinstalled Eset, you installed ver. 11.0.159 since ver. 11.1.42 is no longer available for download.

[tjg79 3]

So, ver. 11.1.42 is newer and no longer available? ESET must have realized it had bugs.

The error I was seeing in the Windows Logs: System disappeared as soon as I uninstalled my original version of ESET Smart Security Premium. I don't recall the version number.

Regards

[Marcos 5,074]

We have identified a new code added to HIPS in v11.1 as the cause of "extra" protection of the ekrn-related registry key that services.exe attempted to modify . We'll add an internal exception so that the event is not generated.

[Corso 1]

Just clean installed the latest 11.1.54 and the same problem still exists in the log: ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

Why do you release this new version with the same bug? Not acceptable.

Going to install back to  v11.0.159.9.

[Marcos 5,074]

1 hour ago, Corso said:

Just clean installed the latest 11.1.54 and the same problem still exists in the log: ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

Why do you release this new version with the same bug? Not acceptable.

Going to install back to  v11.0.159.9.

Did you try switching to pre-release updates? Please read my last post at https://forum.eset.com/topic/15143-update-11142-event-error-scregsetvalueexw/.

[Corso 1]

55 minutes ago, Marcos said:

Did you try switching to pre-release updates? Please read my last post at

.

There's so many threads people link to here. It gets confusing. Mine about this issue were closed.

I'm back at 11.0.159.9, but i did try pre-release too in latest v11.1.54, and the latest HIPS i got downloaded available were 1315 and not 1317.

Edited April 25, 2018 by Corso

[Marcos 5,074]

1 hour ago, Corso said:

I'm back at 11.0.159.9, but i did try pre-release too in latest v11.1.54, and the latest HIPS i got downloaded available were 1315 and not 1317.

I've double checked and HIPS 1317 is indeed on pre-release update servers. Also users in the linked topic confirmed that the new HIPS module resolved the issue.

[Corso 1]

1 hour ago, Marcos said:

I've double checked and HIPS 1317 is indeed on pre-release update servers. Also users in the linked topic confirmed that the new HIPS module resolved the issue.

As i said, I didn't get that HIPS update 1317 with pre-release on, with 11.1.54 earlier today. Maybe it does right now but it doesn't matter anymore I'll  stick with 11.0.159 for now.

[Hijin25 12]

I am presented with the same error in the event log and I can see that the HIPS module is version 1315.

Does anyone know where I can download version 11.0.159 to reinstall it?

[tjg79 3]

Follow the instructions in post number 6 above. You need to do a complete removal to clear the error.

Regards

[Hijin25 12]

1 hour ago, tjg79 said:

Follow the instructions in post number 6 above. You need to do a complete removal to clear the error.

Regards

Thanks, I was able to return to version 11.0.159.9.

[Hijin25 12]

So, is there any news about when this incident will be fixed?

[Marcos 5,074]

37 minutes ago, Hijin25 said:

So, is there any news about when this incident will be fixed?

It was addressed about a week ago in HIPS module 1317 which is currently available on pre-release update servers.

[Hijin25 12]

22 hours ago, Marcos said:

It was addressed about a week ago in HIPS module 1317 which is currently available on pre-release update servers.

Thank you very much for the information, and is there news of when this module will be available for everyone?

[Corso 1]

On ‎2018‎-‎04‎-‎28 at 8:24 PM, Marcos said:

It was addressed about a week ago in HIPS module 1317 which is currently available on pre-release update servers.

Have just installed it and no, it's not fixed with module 1317 installed with pre-release v 11.154.0.  Same error in event log.

After a couple of reboots the error have changed to another error instead:

The application-specific permission settings do not provide Local permission Launch for the COM server application with the CLSID
{7022A3B3-D004-4F52-AF11-E9E987FEE25F}
  and APPID
{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}
  to the user C \ A SID (S-1-5-21-3952601726-1600335574-1119794870-1001) from the LocalHost (with LRPC) address running in the program container Not Available SID (Not Available). You can change the security permissions using the Component Services Administration Utility.

 

I have Windows 10 pro x64 1803 17134.1

Detection Engine: 17312P (20180501)
Rapid Response module: 12034 (20180501)
Update module: 1014 (20180123)
Antivirus and antispyware scanner module: 1538.1 (20180426)
Advanced heuristics module: 1187 (20180328)
Archive support module: 1273 (20180309)
Cleaner module: 1157 (20180319)
Anti-Stealth support module: 1131 (20180424)
Firewall module: 1374.1 (20180410)
ESET SysInspector module: 1271 (20180305)
Translation support module: 1678 (20180410)
HIPS support module: 1317 (20180417)
Internet protection module: 1331 (20180409)
Web content filter module: 1058 (20170406)
Advanced antispam module: 7262P (20180501)
Database module: 1097 (20180320)
Configuration module (33): 1659.4 (20180412)
LiveGrid communication module: 1045 (20180410)
Specialized cleaner module: 1012 (20160405)
Banking & payment protection module: 1128 (20180413)
Rootkit detection and cleaning module: 1019 (20170825)
Network protection module: 1648P (20180430)
Router vulnerability scanner module: 1046 (20180314)
Script scanner module: 1037 (20180417)
Connected Home Network module: 1019.1 (20180220)
Cryptographic protocol support module: 1027 (20180404)

Edited May 1, 2018 by Corso

[tjg79 3]

Did you follow the instructions in post number 6 above explicitly? You've got to do a complete removal of the program to clear the error. Then perform the install as noted above. Regards

[Hijin25 12]

Today I realized that the HIPS module was 1317, so I proceeded with the update of the program, and in effect, the aforementioned error is no longer displayed in the event viewer in my case.

[Corso 1]

I installed latest version today and i have received HIPS module 1317 on pre-release server and seems to be working fine, and the error in eventlog is gone.