Last contact (and updates)

[Derbolfinger 0]

I have a problem with at least one computer (Windows 10). Because of the corona crisis this computer wasn't used since June 15.

To reactivate and clean the computer and for updates i took it in my own office. But ESET Cloud Administrator shows "last contact June 15" since yesterday, I can't update Eset Endpoint Security (7.2.2055.0) or Eset Management Agent (7.1.717.0) remote (lokal I can update only some modules=
The "Staus Log" (status.html) looks "happy" (evrything green, no error), but it remains "generated June 15"

 

[Marcos 5,074]

Did you check C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html on the troublesome client? Is the ESET Management service running on the machine? Just in case, please collect logs with ESET Log Collector on the machine and upload the generated archive here.

[Derbolfinger 0]

Quote

Did you check C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html on the troublesome client?

Yes.

Quote

Is the ESET Management service running on the machine?

Oh, if I try to start EraAgentSvc, I get error 70, What means error 70?

[Marcos 5,074]

Please delete C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\trace.log and then try to start the service. If it fails, provide trace.log.

[Derbolfinger 0]

Error 70 (if i try to start manually EraAgentSvc and no new trace.log 😵

[MartinK 378]

Could you please check whether trace.log file is updated during such startup? This error indicates that something fails during initialization, which might be related to some missing dependencies (visual studio runtime libraries) or possibly permissions related issue. Also we have seen that specific files might be blocked (for example logs) and thus preventing startup.

As an alternative, you might try to start ERAAgent.exe from administrator terminal and check whether output to console or possible error popup dialog would help to locate source of the problem.

[Derbolfinger 0]

There is no trace.log anymore.

I startet ERAAgent.exe and I got an error 0xc000012f  "Bad Image" Protobuf.dll, not designed for Windows or contains an error.

(sfc /scannow shows no errors,)

 

[Marcos 5,074]

Please provide C:\Program Files\ESET\RemoteAdministrator\Agent\Protobuf.dll.

[Derbolfinger 0]

Okay, no I have a trace.log:

2020-09-11 09:20:26 Information: [Thread 1ac4]: Loading ESET modules from C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Modules\
2020-09-11 09:20:26 Error: Service [Thread 1ac4]: ModuleManager: Unable to load module MODULE_ID_SSL. Reason: 7001

 

[Marcos 5,074]

Where can I download the requested dll from?

[Derbolfinger 0]

oh sorry, I misunterstood you.

I  renamed the file to Protobuf.alt and replaced it by a Protobuf.dll from a working computer, and so i get the trace.log.

Both Protobuf.dll had the same size and date.

Inside the zip ist no the renamed file

Protobuf.zip

[Marcos 5,074]

You've uploaded protobuf.alt which contains nothing but 10MB of zeroes. Please provide protobuf.dll, not protobuf.alt.

[Derbolfinger 0]

I have wrote you, that i have renamed the protobuf.dll to protobuf.alt on this not working system und replaced it with a protobuf.dll from an other computer with working Eset Endpoint Security.

Yes, you're right, this protobuf contains only zeroes, amazing. Virus? windows file system failure? hard drive failure? Looks not friendly. That could be the reason for error 0xc000012f  "Bad Image" Protobuf.dll, or not?

Can't we go further with the trace.log?

protobuf.zip with the working dll from the other computer (same license)

Protobuf.zip

[Marcos 5,074]

The dll is ok, the digital signature is valid. Are you getting a "bad image" error with this dll when trying to start the agent service?

Maybe a Procmon log from the time you attempt to start the service would be helpful but let's wait for @MartinK to comment on first.

[Derbolfinger 0]

49 minutes ago, Marcos said:

The dll is ok, the digital signature is valid. Are you getting a "bad image" error with this dll when trying to start the agent service?

No, no "bad image" since this dll. But "Unable to load module MODULE_ID_SSL. Reason: 7001" in trace.log

 

[MartinK 378]

Any chance you tried to "repair" AGENT installation using standalone (MSI) installer? Hard to guess what is going on, but seem that more files might be corrupted or missing. MODILE_ID_SSL is stored in Modules directory, side-by-side with Logs directory where trace logs are located, but failure is indicating either corrupted or missing file.

Also as there is a ESET security product installed, AGENT's files should be protected from unauthorized access - any chance there are some special HIPS policies applied in security product that might block access to files on disk?

[Derbolfinger 0]

I have reinstalled both and it looks like it works correctly.

21 hours ago, MartinK said:

any chance there are some special HIPS policies applied in security product that might block access to files on disk?

I don't think so. There exists no special policies for this computer in cloud administrator and about 40 computers work well.

I will watch the computer for a few days and then back to the staff with it. 🙂

Thank you both for the support