ESET EEA 7.3.3600.0 update broke my network

[karlmikaeloskar 6]

Today I got an alert in the ESET menu bar item telling I need to restart because of an update. So I did.

After the restart I lost my web browsing. The version number of the EEA Application was still 7.3.3600.0.

I had to resort to uninstalling.

[Marcos 5,267]

If the problem persists after installing Endpoint from scratch, please raise a support ticket. Couldn't it be that you have a VPN client installed?

[karlmikaeloskar 6]

I do have a VPN client installed but it is not running.

My coworkers are experiencing the same issue. I have already reached out to my support contact.

[karlmikaeloskar 6]

There was no change from our end on configuration profiles, network or management policies in the ESET Protect server (version 10.0.2133.0).

[Kimiya Kitani 0]

After applying today's update and rebooting, my colleague and I received an ESET startup error and could no longer connect to the internet.

The following Japanese message is as follows:

"All modules are up-to-date"
"We recommend restarting your computer"

As a matter of urgency, we removed the ESET proxy system (disabling ESET) and were able to connect to the net.

System Settings > VPN > Delete ESET VPN setting.

Then I reinstalled ESET 7.3.3600.0 and activated it and no problem there. After updating and rebooting, I get the ESET error(attached file: "Error: A communication error has occurred. again and can't connect to the internet.")

This is a serious problem.

 

Edited September 27, 2023 by Kimiya Kitani

[Kimiya Kitani 0]

 

I am attaching an English screenshot of the ESET error message dialog again with the English UI and a screen shot of the settings where you can disable ESET.
ESET Web&Email protection under System Settings > Network > VPN (turning this off will disable ESET and allow you to connect to the Internet. (However, you will need to reinstall ESET to be able to use it again).
 

My Mac OS: macOS 13.5.2 and 13.6

Edited September 27, 2023 by Kimiya Kitani

[Kurt Dodrill 0]

Same issue after being prompted by ESET to restart. I can confirm that removing ESET Web&Email filter is the only way to get browsing/internet functionality working again.

[DazOG 0]

Can confirm this affects every Mac we have in service, old and new, Intel and ARM.

Pretty poor really, particularly as you need admin privileges to uninstall & reinstall ESET (the recommended workaround).

[Marcos 5,267]

The issue was reported to Apple. A similar problem occurred after the release of macOS Ventura which Apple addressed in an OS update.

[Kimiya Kitani 0]

Hi, Mr. Marcos

Recently, I have not updated my operating system (macOS 13.5.2) and I got a warning to restart ESET, so I restarted it and now I have a problem.
Is this a macOS problem?

If it affects all Mac users, all Mac users need to disable or remove ESET. The impact is too great.

Is there any way to temporarily disable ESET so that when the problem is fixed it can be re-enabled again without having to install ESET?
 

[SimonC 2]

Hi we are affected by this issue, all of our macs with 7.3.3600 installed needed a restart after the reboot get the communication error popup and the console says Product is installed but it is not running.  Attempting to reinstall 7.3 or 7.4 fails from the console.

[karlmikaeloskar 6]

1 hour ago, Marcos said:

The issue was reported to Apple. A similar problem occurred after the release of macOS Ventura which Apple addressed in an OS update.

But this was because of an eset update. MacOS was not updated. 

[Kurt Dodrill 0]

This seems to only appear for users with 7.3.3600.0. I've had them remove the Web&Email filter by going to System Settings --> Network --> VPN & Filters and removing the ESET Web & Email filter by clicking the “-” sign, then pushed the 7.4.1100.0 update to them. The laptop restarts and after that they are all green according to the ESET web console.

[Kimiya Kitani 0]

Hi Kurt Dodill!

Awesome! Yes, I downloaded 7.4.1100.0 and installed it manually, and the reboot warning disappeared and it appears to be working fine.
So it must be an ESET problem.

I need to do some more testing, but I think I can get by with this.

[karlmikaeloskar 6]

Ok, so we can uninstall and install the new version but the real problem here is that eset needs to understand that they remotely turned off web browsing on thousands of macs without warning and without a version number change. 

[Marcos 5,267]

Do you mean that we pushed an update to an older version 7.3.3600.0 to existing users with older versions? I'm not aware of such product update but I will check with colleagues if that's the case.

[Kurt Dodrill 0]

14 minutes ago, Marcos said:

Do you mean that we pushed an update to an older version 7.3.3600.0 to existing users with older versions? I'm not aware of such product update but I will check with colleagues if that's the case.

I think this is the case. The users affected already had 7.3.3600.0 installed, so the title of the thread is not exactly correct. It's more of an update to 7.3.3600.0. Personally, I had the ESET icon on the top right of my screen turn yellow and when I opened ESET it said that a restart was needed. After the restart was done all web functionality was broken but I could still resolve DNS and ping my router. Even the Mac Wireless Diagnostics reported connectivity as functioning.

Removing the Web & Email filter you instantly regain internet, so Im assuming whatever update that was prompting the restart broke that filter and with it, web connectivity.

Edited September 27, 2023 by Kurt Dodrill

[karlmikaeloskar 6]

6 minutes ago, Marcos said:

Do you mean that we pushed an update to an older version 7.3.3600.0 to existing users with older versions? I'm not aware of such product update but I will check with colleagues if that's the case.

I was running 7.3.3600.0 and that had a module update. No version of EEA or macOS was changed. It was a module update AFAIK. 

[Kimiya Kitani 0]

I have been able to confirm here is that for macOS Ventura 13.5.2 and 13.6 devices with ESET 7.3.3600.0 installed, on September 27, 2023, a yellow warning message prompted a reboot, and the reboot After the reboot, ESET Web&E-mail, which is present in the VPN settings, stopped working, and this caused the inability to connect to the Internet, which was also reproduced on several terminals.

The network was restored by removing ESET Web&E-mail in the VPN settings and disabling ESET. Subsequent installation of ESET 7.4.1100 solved the problem.

Perhaps something in them was broken because the problem occurred when the ESET module or per-definition file was automatically updated (ESET itself was not updated).

Since the problem is fairly easy to reproduce, one wonders why it was not noticed in the testing phase before the release of the latest modules, etc., in the previous version (but there is no release information for 7.4 on this forum).

The following screenshot, taken only from the Japanese version, is a warning that appeared today in ESET 7.3.3600. If you reboot with this warning, it means that ESET is the cause of your Internet connection failure.

The main messages in the figure below are as follows
Attention.
All modules are up-to-date
We recommend that you restart your computer

Edited September 27, 2023 by Kimiya Kitani

[Kurt Dodrill 0]

16 minutes ago, karlmikaeloskar said:

I was running 7.3.3600.0 and that had a module update. No version of EEA or macOS was changed. It was a module update AFAIK. 

Module update, that's the term I was looking for, thanks. It really has to be caused by that. Luckily our users are very proficient on their Macs and removing the filter was a quick fix, but I can imagine the kind of nightmare this would create on environments with thousands or even 10's of thousands of Mac's of average users with locked down rights.

Edited September 27, 2023 by Kurt Dodrill

[karlmikaeloskar 6]

After some research today I found that it might have been a failed "product update". In my policy from ESET Protect product updates were disabled but the setting was not enforced with the blue dot or the flash.

If I looked in the settings on the client, it had product updates enabled. So I'm thinking it could be a update to 7.4 that got stuck and left EEA in an unusable state.

[Marcos 5,267]

Please raise a support ticket, logs will be needed for further investigation. From the logs we've got from such user we saw that the upgrade was not triggered from ESET PROTECT and v6 didn't have a mechanism for auto-upgrade either. Moreover, Endpoint didn't upgrade to the latest version available. There is a suspicion that the upgrade was performed by a 3rd party tool.

[karlmikaeloskar 6]

Just now, Marcos said:

Please raise a support ticket, logs will be needed for further investigation. From the logs we've got from such user we saw that the upgrade was not triggered from ESET PROTECT and v6 didn't have a mechanism for auto-upgrade either. Moreover, Endpoint didn't upgrade to the latest version available. There is a suspicion that the upgrade was performed by a 3rd party tool.

I have an ongoing support case with my local organisation and I've submitted the logs.

V6 is not part of this problem (for me).

What do you mean by a 3rd party tool? I'm using JAMF but there were no changes in there. 

[j-gray 37]

Just piling on here, as I'm encountering similar with the forced auto-upgrade from 7.3 to 7.4.

After the upgrade the ESET icon indicates a reboot is recommended. After reboot, unable to launch the ESET GUI due to "Communication Error Occurred".

EP Console shows 'Security Product Version' column with no value (blank). Individual clients in EP Console still reflect 7.3 and "Product is installed but not running". Can't verify on the individual clients, as the GUI won't load.

So far, uninstall and reinstall seems to resolve the issue.

[DazOG 0]

On 9/27/2023 at 9:50 AM, Marcos said:

The issue was reported to Apple. A similar problem occurred after the release of macOS Ventura which Apple addressed in an OS update.

Thanks, but in my case at least no users had done any macOS updates.  All of them had received the "Attention required" yellow dot notification in the menu bar telling them they needed to restart to finish an ESET update.  Upon restarting, they had access to websites, etc, and the ESET Web & Email proxy thing would just say "Connecting" endlessly.