Sander de Cocq 0 Posted August 15, 2019 Share Posted August 15, 2019 Hello, I had a W10 client that I could not upgrade through the SMC from 6.3 to 7 Endpoint Security. Manual installation of the package failed because the processes could not be stopped. I disabled the services, and the installation proceeded, and the client reported correct version in SMC. However, all modules are disabled, and cannot be enabled from the gui on the client (not blocked by policy, it enabling/disabling is possible on all other clients). Can you help me sort this out? ESET Management Agent 7.0.577.0 Up-to-date version ESET Endpoint Security 7.1.2053.0 Up-to-date version Regards, Sander Link to comment Share on other sites More sharing options...
Administrators Marcos 5,242 Posted August 15, 2019 Administrators Share Posted August 15, 2019 Please collect logs with ESET Log Collector from the client and upload the generated archive here. Link to comment Share on other sites More sharing options...
Sander de Cocq 0 Posted August 15, 2019 Author Share Posted August 15, 2019 Log files collected ees_logs (1).zip Link to comment Share on other sites More sharing options...
Administrators Marcos 5,242 Posted August 15, 2019 Administrators Share Posted August 15, 2019 Run the following command as an administrator and then reboot the machine: sc delete epfwwfpr If you would like to prevent pausing protection or uninstalling ESET by unauthorized persons, set up password protection. Also I'd recommend enabling detection of potentially unsafe applications to prevent applications capable of disabling or removing antivirus from running. Also enabling SSL/TLS filtering will protect you from malware on https websites and will also enable you to control access to https websites (e.g. by Web Control categories or by directly blocking specific https urls). Link to comment Share on other sites More sharing options...
Sander de Cocq 0 Posted August 15, 2019 Author Share Posted August 15, 2019 Thank you. After the reboot, the scanner is running, however the firewall, anti-phishing and email scanning modules are not running and cannot be enabled in the GUI. Attached are new log files. ees_logs-2.zip Link to comment Share on other sites More sharing options...
Administrators Marcos 5,242 Posted August 15, 2019 Administrators Share Posted August 15, 2019 In the last logs epfwwpr is still running. 1, Run cmd as an administrator. 2, Enter: sc delete epfwwfpr 3, Enter sc query epfwwfpr If everything went alright, you should get: C:\>sc query epfwwfpr [SC] EnumQueryServicesStatus:OpenService FAILED 1060: The specified service does not exist as an installed service. Link to comment Share on other sites More sharing options...
Sander de Cocq 0 Posted August 16, 2019 Author Share Posted August 16, 2019 Yeah, the service is not deleted, we can't do it with the command line or directly in the registry (HKLM/system/currentcontrolset/services). We're going to try booting in Safe Mode and deleting from registry next, unless you have other suggestions. Link to comment Share on other sites More sharing options...
Sander de Cocq 0 Posted August 16, 2019 Author Share Posted August 16, 2019 Deleting the service from registry in safe mode did the trick, case closed. Thank you for your assistance. Link to comment Share on other sites More sharing options...
Recommended Posts