Derbolfinger 0 Posted September 10, 2020 Share Posted September 10, 2020 I have a problem with at least one computer (Windows 10). Because of the corona crisis this computer wasn't used since June 15. To reactivate and clean the computer and for updates i took it in my own office. But ESET Cloud Administrator shows "last contact June 15" since yesterday, I can't update Eset Endpoint Security (7.2.2055.0) or Eset Management Agent (7.1.717.0) remote (lokal I can update only some modules= The "Staus Log" (status.html) looks "happy" (evrything green, no error), but it remains "generated June 15" Link to comment Share on other sites More sharing options...
Administrators Marcos 4,909 Posted September 10, 2020 Administrators Share Posted September 10, 2020 Did you check C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html on the troublesome client? Is the ESET Management service running on the machine? Just in case, please collect logs with ESET Log Collector on the machine and upload the generated archive here. Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 10, 2020 Author Share Posted September 10, 2020 Quote Did you check C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html on the troublesome client? Yes. Quote Is the ESET Management service running on the machine? Oh, if I try to start EraAgentSvc, I get error 70, What means error 70? Link to comment Share on other sites More sharing options...
Administrators Marcos 4,909 Posted September 10, 2020 Administrators Share Posted September 10, 2020 Please delete C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\trace.log and then try to start the service. If it fails, provide trace.log. Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 10, 2020 Author Share Posted September 10, 2020 Error 70 (if i try to start manually EraAgentSvc and no new trace.log 😵 Link to comment Share on other sites More sharing options...
ESET Staff MartinK 376 Posted September 10, 2020 ESET Staff Share Posted September 10, 2020 Could you please check whether trace.log file is updated during such startup? This error indicates that something fails during initialization, which might be related to some missing dependencies (visual studio runtime libraries) or possibly permissions related issue. Also we have seen that specific files might be blocked (for example logs) and thus preventing startup. As an alternative, you might try to start ERAAgent.exe from administrator terminal and check whether output to console or possible error popup dialog would help to locate source of the problem. Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 11, 2020 Author Share Posted September 11, 2020 There is no trace.log anymore. I startet ERAAgent.exe and I got an error 0xc000012f "Bad Image" Protobuf.dll, not designed for Windows or contains an error. (sfc /scannow shows no errors,) Link to comment Share on other sites More sharing options...
Administrators Marcos 4,909 Posted September 11, 2020 Administrators Share Posted September 11, 2020 Please provide C:\Program Files\ESET\RemoteAdministrator\Agent\Protobuf.dll. Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 11, 2020 Author Share Posted September 11, 2020 Okay, no I have a trace.log: 2020-09-11 09:20:26 Information: [Thread 1ac4]: Loading ESET modules from C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Modules\ 2020-09-11 09:20:26 Error: Service [Thread 1ac4]: ModuleManager: Unable to load module MODULE_ID_SSL. Reason: 7001 Link to comment Share on other sites More sharing options...
Administrators Marcos 4,909 Posted September 11, 2020 Administrators Share Posted September 11, 2020 Where can I download the requested dll from? Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 11, 2020 Author Share Posted September 11, 2020 oh sorry, I misunterstood you. I renamed the file to Protobuf.alt and replaced it by a Protobuf.dll from a working computer, and so i get the trace.log. Both Protobuf.dll had the same size and date. Inside the zip ist no the renamed file Protobuf.zip Link to comment Share on other sites More sharing options...
Administrators Marcos 4,909 Posted September 11, 2020 Administrators Share Posted September 11, 2020 You've uploaded protobuf.alt which contains nothing but 10MB of zeroes. Please provide protobuf.dll, not protobuf.alt. Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 11, 2020 Author Share Posted September 11, 2020 I have wrote you, that i have renamed the protobuf.dll to protobuf.alt on this not working system und replaced it with a protobuf.dll from an other computer with working Eset Endpoint Security. Yes, you're right, this protobuf contains only zeroes, amazing. Virus? windows file system failure? hard drive failure? Looks not friendly. That could be the reason for error 0xc000012f "Bad Image" Protobuf.dll, or not? Can't we go further with the trace.log? protobuf.zip with the working dll from the other computer (same license) Protobuf.zip Link to comment Share on other sites More sharing options...
Administrators Marcos 4,909 Posted September 11, 2020 Administrators Share Posted September 11, 2020 The dll is ok, the digital signature is valid. Are you getting a "bad image" error with this dll when trying to start the agent service? Maybe a Procmon log from the time you attempt to start the service would be helpful but let's wait for @MartinK to comment on first. Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 11, 2020 Author Share Posted September 11, 2020 49 minutes ago, Marcos said: The dll is ok, the digital signature is valid. Are you getting a "bad image" error with this dll when trying to start the agent service? No, no "bad image" since this dll. But "Unable to load module MODULE_ID_SSL. Reason: 7001" in trace.log Link to comment Share on other sites More sharing options...
ESET Staff MartinK 376 Posted September 11, 2020 ESET Staff Share Posted September 11, 2020 Any chance you tried to "repair" AGENT installation using standalone (MSI) installer? Hard to guess what is going on, but seem that more files might be corrupted or missing. MODILE_ID_SSL is stored in Modules directory, side-by-side with Logs directory where trace logs are located, but failure is indicating either corrupted or missing file. Also as there is a ESET security product installed, AGENT's files should be protected from unauthorized access - any chance there are some special HIPS policies applied in security product that might block access to files on disk? Link to comment Share on other sites More sharing options...
Derbolfinger 0 Posted September 12, 2020 Author Share Posted September 12, 2020 I have reinstalled both and it looks like it works correctly. 21 hours ago, MartinK said: any chance there are some special HIPS policies applied in security product that might block access to files on disk? I don't think so. There exists no special policies for this computer in cloud administrator and about 40 computers work well. I will watch the computer for a few days and then back to the staff with it. 🙂 Thank you both for the support Link to comment Share on other sites More sharing options...
Recommended Posts