ESET Mail Security for exchange - Antivirus and Antispyware protection is non-functional

[Yafu Ji 3]

Hi,

I'm running ESET Mail security for exchange for our business.

I just received an email notification with saying "During execution of Kernel on the computer [server name], the following event occurred: An error occurred during loading scanner modules. Malware protection will not work correctly."

Then, I logged into the server and found the message, as shown in the picture below.

I rebooted my server twice but the problem wasn't solved.

Here is some of my basic info

• OS version: Windows server 2012 R2
  , 6.3.9600.21620
• ESET version: 10.1.10012.0
• License: valid until 01/06/2024

 

Does anyone know the cause? Also, can anyone point me to the solution?

 

 

[Yafu Ji 3]

The same issue happened to our ESET server security this morning. 

Then, we went through the following steps for both servers.

• 1. Click Setup on the ESET monitoring software.
• 2. Click on the Advanced Setup at the right bottom.
• 3. Choose "Update" tab
• 4. In the module rollback, click the "rollback" button and select "until revoked".

 

Then, the red alerts disappeared on both servers. 

 

 

Here are our installed modules.

•  In the ESET Mail Security

Quote

 

Detection Engine;28226;12/11/2023
Rapid Response module;23285;12/11/2023
Update module;1036;31/07/2023
Antivirus and antispyware scanner module;1604.2;8/11/2023
Advanced heuristics module;1226;5/09/2023
Archive support module;1344;16/10/2023
Cleaner module;1244;28/09/2023
Anti-Stealth support module;1187;28/08/2023
Firewall module;1439.1;16/08/2023
Mail server protection module;1017;20/02/2019
Translation support module;1988;25/10/2023
HIPS support module;1466;19/09/2023
Internet protection module;1457;4/09/2023
Advanced antispam module;7963.1;23/10/2023
Database module;1124;12/09/2023
Configuration module;2092.2;29/09/2023
Direct Cloud communication module;1134;5/10/2023
Rootkit detection and cleaning module;1033;16/09/2022
Network protection module;1692;15/07/2022
Script scanner module;1167;5/11/2023
Network Inspector module;1048;20/01/2022
Cryptographic protocol support module;1081B;5/09/2023
Databases for advanced antispam module;9967;11/11/2023
Advanced Machine Learning module;1144;25/09/2023
Security Center integration module;1038;28/07/2022

 

 

•  In the ESET server security

Quote

Detection Engine;28226;12/11/2023
Rapid Response module;23285;12/11/2023
Update module;1036;31/07/2023
Antivirus and antispyware scanner module;1604.2;8/11/2023
Advanced heuristics module;1226;5/09/2023
Archive support module;1344;16/10/2023
Cleaner module;1244;28/09/2023
Anti-Stealth support module;1187;28/08/2023
Firewall module;1439.1;16/08/2023
Translation support module;1988;25/10/2023
HIPS support module;1466;19/09/2023
Internet protection module;1457;4/09/2023
Database module;1124;12/09/2023
Configuration module;2092.2;29/09/2023
Direct Cloud communication module;1134;5/10/2023
Rootkit detection and cleaning module;1033;16/09/2022
Network protection module;1692;15/07/2022
Script scanner module;1167;5/11/2023
Cryptographic protocol support module;1081B;5/09/2023
Advanced Machine Learning module;1144;25/09/2023
Security Center integration module;1038;28/07/2022

 

 

I would appreciate it if anyone could answer the following:

1. What caused the issue?

2. When or how can we restore the module update?

Edited November 13, 2023 by Yafu Ji

[jwit 0]

We are getting the same error with our last remaining Server 2012 R2 servers. All of our 2019 servers are fine.

[Peter Randziak 1,168]

Hello guys,

the fixed modules are available on the Update servers since ~13:00 CET (November 14, 2023).

Users affected by this issue do not need to take any steps, the module will be updated automatically and the issue will be resolved by it.

We apologize for the inconvenience caused,

Peter on behalf of the teams involved

[Peter Randziak 1,168]

Hello guys,

Can you please try to verify the fix on pre-release update channel in environments, where you reproduced the issue?

In our internal tests it works well, but we would like to have it confirmed before we deploy the change on the release update channel.
Thank you in advance.

Peter on behalf of the teams involved

[Yafu Ji 3]

On 11/14/2023 at 11:57 PM, Peter Randziak said:

Hello guys,

the fixed modules are available on the Update servers since ~13:00 CET (November 14, 2023).

Users affected by this issue do not need to take any steps, the module will be updated automatically and the issue will be resolved by it.

We apologize for the inconvenience caused,

Peter on behalf of the teams involved

Thanks, Peter! Appreciate it! 

1 hour ago, Peter Randziak said:

Hello guys,

Can you please try to verify the fix on pre-release update channel in environments, where you reproduced the issue?

In our internal tests it works well, but we would like to have it confirmed before we deploy the change on the release update channel.
Thank you in advance.

Peter on behalf of the teams involved

No problems! I can confirm that 

- I restored the update

- Upgraded with the latest modules

As a result, both ESET Server Security and ESET Mail security worked as expected!

[Peter Randziak 1,168]

Hello @Yafu Ji,glad to hear that it works without issues for you now, but we would like to verify the fix which we prepared.
It is available on so called pre-release update channel, updating from it can be easily enabled via the policy / in the settings 

https://support.eset.com/hu/kb7957-enable-pre-release-updates-in-eset-endpoint-products-in-eset-protect

On the screenshot you have the Detection engine of version 28246, the pre-release updates are marked with "P" i.e. it would be 28246P

Can you please try to switch to the pre-release update channel and confirm that it works fine in your environment?

Thank you, Peter

[Yafu Ji 3]

Hi Peter,

I will give a go when we are in the off peak time, estimated in 8~10 hours.

[Yafu Ji 3]

Hi Peter, 

It looks good!