Internet Security stuck on updating product for days?

[Norm@Home 2]

I have a new notebook computer that I installed Eset Internet Security on, having downloaded the offline installer directly from the Eset website. I installed it and entered the license key I was provided and it seemed to activate, then it went to do it's first update and it's been stuck on "Updating Product" for more than 3 days. Any idea's on how to fix this?

[TomFace 539]

Have you tried uninstalling and reinstalling?

See https://support.eset.com/kb2788/

Regards,

Tom

 

[Marcos 5,257]

Was EIS activated correctly? Is license information displayed under Help and support? Does rebooting the machine (preferably by running "shutdown -r -t 0" in case you use Windows 8/10 fast boot) make a difference?

[Norm@Home 2]

As TomFace suggested, I uninstalled but using the normal "Programs and features" control panel app ended with an error something like "you may not have permissions" or some such error so I had to download the Eset Uninstaller and reboot into safe mode in order to remove the original installation. After reinstalling activation did take an unusually long time, almost an hour but it did activate. I haven't rebooted yet as the program is doing it's initial scan but also update its again "Updating product" and has been for more than an hour; this is the same problem that it had originally and this update never seems to finish. Previously no matter how many reboots the "Updating product" never finished and I have no reason to expect that this time it's going to be any different.

Once the initial scan finishes I'll try and reboot with "shutdown -r -t 0" since Fast Startup is enabled on this notebook computer.

[Norm@Home 2]

The computer ran for more than 5 hours last night and is still stuck on "Updating product". Any more idea's?

[Marcos 5,257]

Please carry on as follow:
- Under Help and support -> Details for customer care, enable advanced logging
- Reboot the machine (via "shutdown -r -t 0", just in case)
- Run manual update
- Stop logging after approximately 10 seconds of no update activity
- Gather logs with ESET Log Collector and provide me with the generated zip file.

[Norm@Home 2]

On 2/11/2019 at 9:40 AM, Marcos said:

Please carry on as follow:
- Under Help and support -> Details for customer care, enable advanced logging
- Reboot the machine (via "shutdown -r -t 0", just in case)
- Run manual update
- Stop logging after approximately 10 seconds of no update activity
- Gather logs with ESET Log Collector and provide me with the generated zip file.

Fast startup is disabled so no need to do "shutdown -r -t 0"; in regards to "Stop logging after approximately 10 seconds of no update activity" how am I supposed to do that when the problem is that "Updating product" never completes so there is no instance when there is no update activity? I'll let it run with advanced logging enabled for a couple hours and then gather the logs and post them here so you can look at it.

[Marcos 5,257]

You can leave it logging just for 1-2 minutes. Then disable logging and gather logs.

[Norm@Home 2]

I got the log files, however it's bigger than 100mb and I can't upload it directly so here's a link to the zip file on Google Drive:

https://drive.google.com/open?id=1jX7HUudp63DIFrsSe64H-AXngbO-rXCY

[Norm@Home 2]

On 2/13/2019 at 9:32 AM, Marcos said:

You can leave it logging just for 1-2 minutes. Then disable logging and gather logs.

Any idea's, the computer that has this problem is running very slowly which it wasn't doing before installing Internet Security.

[Marcos 5,257]

Is the update status stuck on "Updating product" every time you reboot the machine? According to the logs, it was connecting to update servers and downloading stuff.

Try holding Shift and click X to close the gui and start it again. Is the update status still stuck at "Updating product" ?
As for the performance issue, does any of the following make a difference?
- pausing protection
- pausing only real-time protection
- temporarily disabling HIPS and rebooting the machine

[Norm@Home 2]

14 hours ago, Marcos said:

Is the update status stuck on "Updating product" every time you reboot the machine? According to the logs, it was connecting to update servers and downloading stuff.

Try holding Shift and click X to close the gui and start it again. Is the update status still stuck at "Updating product" ?
As for the performance issue, does any of the following make a difference?
- pausing protection
- pausing only real-time protection
- temporarily disabling HIPS and rebooting the machine

The status has been stuck on "Updating product" for more than 3 days and through multiple reboots and in one case it was left running for more than 5 hours overnight and it never completed. I'll try your suggestions and get back to you.

[itman 1,746]

What I am wondering is if for some strange reason on this device, Eset has gotten stuck in a never ending update loop. Perhaps caused by updates running at default scheduled times but prior updates still in progress; or Eset detects they are but in reality are not?

What might be worth a shot is to temporarily disable all updating as shown in the Eset Knowledgebase article: https://support.eset.com/kb2767/ . Reboot the device. Then verify if the product updating activity has stopped. If the product updating activity has ceased, then reenable the previous disabled settings and verify that Eset is now updating as scheduled and without issue. If after reboot the product updating activity is still active, let the device run for a while to complete any current activity in process. Once that stops, then reenable the previous disabled settings and verify that Eset is now updating as scheduled and without issue.

Edited February 21, 2019 by itman

[Norm@Home 2]

Now I seem to be having a different problem on this computer; if need be I'll get you another set of logs but here's the problem: it appears to have finished updating as you can see in the picture of the update screen; however there are times that ekrn.exe is maxing out the cpu and making the computer so slow that it's very difficult to use - see screen shot of Resource Monitor and there's no scan taking place?

[Marcos 5,257]

Please create a full application memory dump of ekrn when there is a cpu spike. In the advanced setup browse to Tools -> Diagnostics, make sure that full dumps are selected (if not, select that option and click ok first) and then click Create to create one.

Also run Procmon and leave it logging operation for at least one minute. Afterwards stop logging, save the log, compress it, upload the archive and the dump to a safe location and drop me a message with download links.

[Norm@Home 2]

I'm trying to create a full application memory dump of ekrn, I followed your directions but when I clicked "Create" to create one the button has remained greyed out for more than a half hour and I'm not sure if it's completed because I would expect the button to go back to being enabled after it's finished?

I've attached a zipped up copy of the Procmon log file.

Logfile.zip

[Norm@Home 2]

Also as I was waiting for the full application memory dump of  ekrn  to complete, EIS started a update and the update again took a very long time i.e. hours to complete but as far as I can tell while it was doing this cpu load was normal / low so I'm not sure why the daily update seems to take hours to complete.

[Norm@Home 2]

11 hours ago, Marcos said:

Please create a full application memory dump of ekrn when there is a cpu spike. In the advanced setup browse to Tools -> Diagnostics, make sure that full dumps are selected (if not, select that option and click ok first) and then click Create to create one.

Also run Procmon and leave it logging operation for at least one minute. Afterwards stop logging, save the log, compress it, upload the archive and the dump to a safe location and drop me a message with download links.

What files exactly am I supposed to send from the diagnostics folder or use the log collector again after it finishes?

[Marcos 5,257]

Yes, use ESET Log Collector which will also gather all logs from the Diagnostics folder.

[itman 1,746]

Do you have issues with other software updating? How about Win Updates - do they download and install within a reasonable amount of time?

[Norm@Home 2]

6 hours ago, itman said:

Do you have issues with other software updating? How about Win Updates - do they download and install within a reasonable amount of time?

No, this computer had no problems up until EIS was installed and the problems started right after that and btw this computer had an older version of NOD32 which expired and I uninstalled before installing EIS and there was never any problem with that.

[Norm@Home 2]

7 hours ago, Marcos said:

Yes, use ESET Log Collector which will also gather all logs from the Diagnostics folder.

Again the EIS logs are bigger than 100mb so here's a link to the file on Google Drive:

https://drive.google.com/open?id=1oiZdQ6HcUr2jolSsOndVxbdtb3J-ZVo8

 

[itman 1,746]

12 hours ago, Norm@Home said:

No, this computer had no problems up until EIS was installed and the problems started right after that and btw this computer had an older version of NOD32 which expired and I uninstalled before installing EIS and there was never any problem with that.

My best guess is NOD32 was not completely uninstalled and remnants of it still exist. As noted in the Eset Knowledgebase article on the installer, it is sometimes necessary to run it multiple times. It may also be necessary to manually uninstall any existing Eset drivers if they exist in Windows device manager :

Quote

Click the link below that corresponds to your ESET product for help with reinstallation. If you continue to experience issues with reinstallation, delete the ehdrv driver using device manager and then repeat the steps above to run the ESET Uninstaller application again. Because ESET is designed as a security application, in some instances multiple attempts are required to uninstall the product completely.

https://support.eset.com/kb2289/?locale=en_US&viewlocale=en_US

[Marcos 5,257]

Please carry on as follows:
- delete the content of "C:\ProgramData\ESET\ESET Security\Diagnostics"
- enable operating system advanced logging in the advanced setup -> tools -> diagnostics
- reproduce the issue with high cpu utilization by ekrn
- disable logging
- compress "C:\ProgramData\ESET\ESET Security\Diagnostics\EsetPerf.etl" and supply it for perusal.

[Norm@Home 2]

8 hours ago, itman said:

My best guess is NOD32 was not completely uninstalled and remnants of it still exist. As noted in the Eset Knowledgebase article on the installer, it is sometimes necessary to run it multiple times. It may also be necessary to manually uninstall any existing Eset drivers if they exist in Windows device manager :

https://support.eset.com/kb2289/?locale=en_US&viewlocale=en_US

As I mentioned at the top of this thread "As TomFace suggested, I uninstalled but using the normal "Programs and features" control panel app ended with an error something like "you may not have permissions" or some such error so I had to download the Eset Uninstaller and reboot into safe mode in order to remove the original installation. After reinstalling activation did take an unusually long time, almost an hour but it did activate. I haven't rebooted yet as the program is doing it's initial scan but also update its again "Updating product" and has been for more than an hour; this is the same problem that it had originally and this update never seems to finish. Previously no matter how many reboots the "Updating product" never finished and I have no reason to expect that this time it's going to be any different." so the original NOD32 uninstalled fine and the first install of NIS was uninstalled using the Eset uninstaller in safe mode so I'm pretty sure that the original install was removed and the first install of NIS and any remnants of it were removed by the Eset uninstaller.