Eset GUI does not start

[Radyium 0]

Hi,

We are a small company with around 10 employee. All have Eset Internet security on their device (Surface pro W10/W11 pro).

We all use Windows 10/11 with Office 365 business.

Everything is fine for years.

However this morning, i notice on my laptop (i am the exception), i have a gigabyte Aero 15 W10 pro, Eset does not open on restart computer, i do not have the icon in the systray, i can not open the GUI, at least nothing appear when i try to open the ESET.

Service seems to run.

I tried to uninstall and reinstall, nothing change.

I tried to uninstall in safe mode via Eset uninstaller tool, and reinstall nothing change.

I'm not totally sure that Eset is running properly since i can not open it.

It is an issue for me as i must be sure that i have a minimum of protection on my computer.

I don't know since when i have this issue.

Any idea or help ?

 

Thanks

[Marcos 5,274]

Please provide:
1, Logs collected with ESET Log Collector
2, A Procmon boot log saved unfiltered in the PML format and compressed.

[Radyium 0]

Hi,

Thanks for the quick reply.

The first log if around 81mb ziped, the second one is 10gb unzip...(even zipped it will be big)  how should i attach such big file ? do you have any special service ?

 

Thanks

[Marcos 5,274]

You can upload them to a file sharing services, such as OneDrive, Dropbox, etc. and drop me a private message with a download link.

[itman 1,748]

Did you verify that the Eset GUI icon on lower desktop toolbar is not hidden? Mouse click on up arrow symbol on the toolbar and see if the icon is there.

Also, can you open Eset GUI via Win 10 Start Menu per below screen shot?

Edited February 8 by itman

[Radyium 0]

@itman Hi, i'm sure it is not in the systray, and i try to run the GUI in normal and as admin nothing appear.

I'm going to send logs, but it is a bit big, i need some time to upload it.

thanks

[Marcos 5,274]

Is ESET correctly registered in the Security Center? There are error like these in the system application log

The Windows Security Center Service was unable to load instances of AntiVirusProduct from datastore., 08/02/2024 12:00:24
The Windows Security Center Service was unable to load instances of FirewallProduct from datastore., 08/02/2024 12:00:24

Message, Date
Faulting application name: wmiprvse.exe, version: 10.0.19041.3636, time stamp: 0x71c3372a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0x80131623
Fault offset: 0x00007fff9252200f
Faulting process ID: 0x2f00
Faulting application start time: 0x01da5a88c604f1c1
Faulting application path: C:\WINDOWS\system32\wbem\wmiprvse.exe
Faulting module path: unknown
Report ID: c08a42dc-4259-4926-b81c-e9e550a4252f
Faulting package full name:
Faulting package-relative application ID:, 08/02/2024 12:17:25

Could you try to rebuild the WMI repository to make sure that those errors do not occur and wmiprvse.exe doesn't crash?

https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-rebuilding-the-wmi-repository/ba-p/373846

[Radyium 0]

Hi,

Thanks for the check.
the command `winmgmt /verifyrepository` return "WMI repository is consistent"

Should i still run `winmgmt /salvagerepository` or the `winmgmt /resetrepository` ?

Is it risky in the way, will it break some application config or i will have to reinstall something ?

We are using Office 365 connected to Azur cloud, and i have few virtual machine (vmware) which are important.

Thanks

[itman 1,748]

1 hour ago, Marcos said:

Is ESET correctly registered in the Security Center? There are error like these in the system application log

The Windows Security Center Service was unable to load instances of AntiVirusProduct from datastore., 08/02/2024 12:00:24
The Windows Security Center Service was unable to load instances of FirewallProduct from datastore., 08/02/2024 12:00:24

Err .........

There's a huge forum thread on this issue here: https://forum.eset.com/topic/38760-windows-security-center-service-unable-to-load-instances-of-antivirusproduct-from-datastore/ . Everyone using Eset ver. 17.x has been receiving these Win Event log errors. As such, can't see these errors are related to this Eset AMSI start up issue.

[itman 1,748]

I am going to post a link to an old forum thread: https://forum.eset.com/topic/7971-eset-gui-not-showing-up-anymore-eguiexe-shows-suspended/#comment-42573 where users were also having issues with Eset GUI startup and initialization. In this instance, the users had additional third party security software installed; anti-ransomware software, which interfered with Eset GUI start up processing .

Do you have any additional like security software installed on the devices where the Eset GUI issue manifests?

[itman 1,748]

On 2/8/2024 at 7:18 AM, Radyium said:

gigabyte Aero 15 W10 pro

Here's something else to checkout.

Appears Gigabyte will try to push a 90 day Norton Internet Security trial software on their PC's. You should check if the software or remnants of it is still installed. Assuming that subscription has expired, Norton still might be trying to load at system startup time and interfering with Eset GUI loading and initialization.

Ref.: https://www.reddit.com/r/gigabyte/comments/pl22x0/aorus_app_center_tried_to_install_norton_internet/

[Marcos 5,274]

Could you please at least temporarily uninstall "C:\Program Files\WindowsApps\A-Volute.Nahimic_1.9.22.0_x64__w2gh52qy24etm" which uses the service "Nahimic service" and injects c:\programdata\a-volute\a-volute.nahimic\modules\scheduled\x64\audiodevprops2.dll into running processes?

[itman 1,748]

1 hour ago, Marcos said:

Could you please at least temporarily uninstall "C:\Program Files\WindowsApps\A-Volute.Nahimic_1.9.22.0_x64__w2gh52qy24etm" which uses the service "Nahimic service" and injects c:\programdata\a-volute\a-volute.nahimic\modules\scheduled\x64\audiodevprops2.dll into running processes?

Based on what I saw posted on the web, it will re-install itself.

Here's a guide on how to disable the service and if that does work, to completely uninstall it: https://www.windowsdigitals.com/disable-or-uninstall-nahimic-service-in-windows-11-10/ . The uninstall requires manual registry modification and deletion of its driver.

[Radyium 0]

Hi @itman, @Marcos,

sorry i was on leave for 2 days.

The only software i have which could be related to is NextDns (i tried to disable the service and clear dns cache, it does not change anything).

I never had Norton on my Aero, i have the Gigabyte aero 15 XC.

Nahimic is great for the sound.

However, i tested :

- uninstall Nahimic, disable the service and restart => Eset works again !

- install again Nahimic, start service, restart => Eset stop to work.

- stop the service Nahimic => Eset still not working

- uninstall Nahimic => Eset still not working

- restart, Eset works again.

The issue seems to come from Nahimic, it is strange, i never had any issue with it

note : That explain why, i am the only one at work to have the issue, i have the only one to have Nahimic.

Thanks for the help, and now we know that current version of Nahimic is triggering issue with (at least) Eset.

Edited February 15 by Radyium
add more information

[Killer128 0]

Thank GOD for this post, I just noticed today that my gui was not working at all. Windows Defender shows the my Eset Security Premium as working but no way to check if it was updated or not. After unistalling, restarting, using the removal tool in safemode I finally found this post.

Thank you, thank you.  Now after a restart I need to scan my system and ensure everything is ok, who knows when it went down.  Last time I checked was back in early Jan 2024.

Wish me luck!