Jump to content

Last contact (and updates)


Recommended Posts

I have a problem with at least one computer (Windows 10). Because of the corona crisis this computer wasn't used since June 15.

To reactivate and clean the computer and for updates i took it in my own office. But ESET Cloud Administrator shows "last contact June 15" since yesterday, I can't update Eset Endpoint Security (7.2.2055.0) or Eset Management Agent (7.1.717.0) remote (lokal I can update only some modules=
The "Staus Log" (status.html) looks "happy" (evrything green, no error), but it remains "generated June 15"

 

Link to post
Share on other sites
  • Administrators

Did you check C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html on the troublesome client? Is the ESET Management service running on the machine? Just in case, please collect logs with ESET Log Collector on the machine and upload the generated archive here.

Link to post
Share on other sites
Quote

Did you check C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html on the troublesome client?

Yes.

Quote

Is the ESET Management service running on the machine?

Oh, if I try to start EraAgentSvc, I get error 70, What means error 70?

Link to post
Share on other sites
  • Administrators

Please delete C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\trace.log and then try to start the service. If it fails, provide trace.log.

Link to post
Share on other sites
  • ESET Staff

Could you please check whether trace.log file is updated during such startup? This error indicates that something fails during initialization, which might be related to some missing dependencies (visual studio runtime libraries) or possibly permissions related issue. Also we have seen that specific files might be blocked (for example logs) and thus preventing startup.

As an alternative, you might try to start ERAAgent.exe from administrator terminal and check whether output to console or possible error popup dialog would help to locate source of the problem.

Link to post
Share on other sites

Okay, no I have a trace.log:

2020-09-11 09:20:26 Information: [Thread 1ac4]: Loading ESET modules from C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Modules\
2020-09-11 09:20:26 Error: Service [Thread 1ac4]: ModuleManager: Unable to load module MODULE_ID_SSL. Reason: 7001

 

Link to post
Share on other sites

I have wrote you, that i have renamed the protobuf.dll to protobuf.alt on this not working system und replaced it with a protobuf.dll from an other computer with working Eset Endpoint Security.

Yes, you're right, this protobuf contains only zeroes, amazing. Virus? windows file system failure? hard drive failure? Looks not friendly. That could be the reason for error 0xc000012f  "Bad Image" Protobuf.dll, or not?

Can't we go further with the trace.log?

protobuf.zip with the working dll from the other computer (same license)

Protobuf.zip

Link to post
Share on other sites
  • Administrators

The dll is ok, the digital signature is valid. Are you getting a "bad image" error with this dll when trying to start the agent service?

Maybe a Procmon log from the time you attempt to start the service would be helpful but let's wait for @MartinK to comment on first.

Link to post
Share on other sites
49 minutes ago, Marcos said:

The dll is ok, the digital signature is valid. Are you getting a "bad image" error with this dll when trying to start the agent service?

No, no "bad image" since this dll. But "Unable to load module MODULE_ID_SSL. Reason: 7001" in trace.log

 

Link to post
Share on other sites
  • ESET Staff

Any chance you tried to "repair" AGENT installation using standalone (MSI) installer? Hard to guess what is going on, but seem that more files might be corrupted or missing. MODILE_ID_SSL is stored in Modules directory, side-by-side with Logs directory where trace logs are located, but failure is indicating either corrupted or missing file.

Also as there is a ESET security product installed, AGENT's files should be protected from unauthorized access - any chance there are some special HIPS policies applied in security product that might block access to files on disk?

Link to post
Share on other sites

I have reinstalled both and it looks like it works correctly.

21 hours ago, MartinK said:

any chance there are some special HIPS policies applied in security product that might block access to files on disk?

I don't think so. There exists no special policies for this computer in cloud administrator and about 40 computers work well.

I will watch the computer for a few days and then back to the staff with it. 🙂

Thank you both for the support

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...