AV was 'uninstalled' from the system without any input

[ewong 8]

Hi,

It seems as if this week is stumping me a lot with the ESET Protect Setup.  This morning while figuring out my ESET Protect login problem,  I noticed that the AV on my system was updating and then since the system was getting sluggish, I decided to reboot my system.

After rebooting, I noticed that the AV taskbar icon was missing.  I went into the Control Panel-> Programs and Features and discovered that the AV (9.1 version as I'm still on Windows 8.1)  no longer exists in the list of installed programs.

The "C:\Programdata\ESET\ESET Security" path still exists  as does "c:\Program Files\ESET\ESET Security".  egui.exe still exists and when I run it, it would appear in the task for a brief moment and then prompt disappear(likely a crash).

At this point, I have no idea what happened.  Nothin in the c:\Programdata\ESET\RemoteAdministrator\Agent\EraAgentAplicationData\Logs\trace.log.

I'm not sure where to look for when the AV was 'uninstalled'.  The AV isn't mentioned in the Programs list; but the directories still exist.  I think I'm left with going to esetuninstaller and run it on the AV software then have the system pick up the "Software install" task.  

 

 

[Marcos 5,074]

Sounds like a failed program upgrade or an adversary gained access to the machine and tried to kill and remove ESET manually or whatever. It would need further investigation of the server and agent trace logs as well as ELC logs and some other logs from the client, yet we may still be unable to 100% identify the root cause. Please raise a support ticket for further investigation of the issue.

[ewong 8]

@Marcos  I think I've "fixed" the problem.

Previously, I just went to safe-mode and used esetuninstaller to uninstall just the AV.  When I went back to normal Windows, and ran the install-av task,  it did the same thing. 

So I went back into Safemode and just uninstalled both the AV and Agent.  After getting the GPO Agent package installed, and ran the install AV task,  It looks like it's working.   Mind you, for the v9 family, 9.1.2066.0 is the latest; but that's not available in the repository(local one, and I've sent a message to tech support but haven't heard from anyone), so I installed 9.1.2063.0. 

But you could be right that an update might have choked the 9.1.2063.0 version... dunno.  Currently, it's updating the product.

 

Thanks.

 

Ed

[ewong 8]

Fwiw, I think I've found out what's causing this. 

I'm on a Windows 8.1 pro system.  Agent is 10.1.0277.

1. Created a "Software Install" task that specifies 9.1.2063.0 as the installation package.
2. The installation runs and activates.
3. It promptly then starts to update.
4. It then displays a "Protection setup slow"
5. After a bit, it shows "Updating product"; but with an error stating "Network Firewall could not be started" (paraphrase..)  Needed to restart.
6. Restarted the system.  ESET AV icon in the taskbar is missing/not accessible.
7. I was about to open a page to download the latest v9, when the whole desktop went blank and gave me a dialog that "Explorer.exe has crashed" (paraphrase) and asks if I should close it or debug it(iirc).  Then the whole desktop went blue(not a blue screen)
8. I pressed Ctrl-Alt-Del, selected Task Manager, and ran a new Explorer.exe. 
9. After a bit,   the desktop appeared again, and the AV appeared back in the taskbar and proceeded to update.

Right now, it's scanning my computer. 

I'm still going to download the latest and install over 9.1.2063.0. 

Does anyone know if I create a new Software Install and have it point to the actual repository.eset.com's 9.1.2066.0's eea_nt64.msi file?  

Thanks

Ed