Era agent 6.2.11.0 causing computers to freeze

[davidpitt 4]

I've installed 6.2 on a couple of 2008 R2 servers and several on 2012 R2 servers but never experienced the freezing on any servers, only desktops running W7. They were a mixture of upgrades from 6.1 and clean installs of 6.2.

 

I took a bit of strong view on this in the fact that the freezing was completely unacceptable and it couldn't be allowed to continue for obvious reasons. Although I had no freezing events on servers I've seen others here say that they have so I have disabled HIPS on Endpoints and File Security just to be sure and I have had not had a single machine freezing across multiple individual set-ups of Eset.

 

I've got lots more migrations to do and I plan on using 6.1 until further information and/or a fix on this problem surfaces.

[czechoto 0]

We have a problem with freezing servers 2008R2 and 2012. In era agent logs I can see error like this:

 

2015-10-06 19:53:49 Error: CEssConnectorModule [Thread 808]: Set policy failed: CNodcommChannel: Send request failed with 14, Command failed - Make sure that Agent runs with Administrator privileges.

 

 

[foneil 342]

Service Release for ESET Remote Administrator Agent version 6.2.190 was released today (for use with ERA 6.2.11). Can you make sure you're using the latest version and see if this resolves the issue:

 

hxxp://support.eset.com/kb3690/ 

[czechoto 0]

I have ESET Remote Administrator (Server), Version 6.2.171.0

 

could not find this version
 

[jimwillsher 65]

Re-read foniel's message. it's not a new version of ERA, just a new version of the agent. Please run a component upgrade task on your ERA server to upgrade the agent, then run the same task on your clients.

[foneil 342]

yes, sorry, @jimwillsher is correct -- see hxxp://support.eset.com/kb3668/ for instructions to run the component upgrade task. This will upgrade the ERA server and agents.

[nhesetnod32 0]

foneil - the link hxxp://support.eset.com/kb3668/ explains that the Microsoft Hotfix 2664888 is a prerequisite to update to the latest version of 6.x.  Is this still true prior to deploying this latest version of the agent (6.2.190.0)?  I just want to be clear if I still need to deploy that hotfix first.  Thanks!

[foneil 342]

Sorry @nhesetnod32 I'm not sure. I've asked--I don't know if the hotfix still applies with the latest release of ERA Agent. 

[rekun 43]

I have tried to install the agent on 2 computers, and they have both been running for a couple of hours without issues. We will know more in the next couple of days

[rekun 43]

It is still not working with the new update tot he agent.

Both computers have been freezing daily since installing the new agent.

 

It is also not possible to create a memory using the guide provided earlier. It works fine when the computer is running "normal" but when it freezes, the the ctrl + scrlk is not working.

 

Are Eset working to fix this? or is it "working as expected"

 

Can we do anything to help fix the issue?

[inf.k 1]

i have mailed eset suport for few weeks now and they will not do anyting about it.

 

Agent 6.2.190 fixes something else not the freezes.

 

Eset is so blinded and stuborn and only clames that its not ther fault but its a Microsoft bug - case close -end

 

They say the only but not 100% tested solution is a Microsoft KB 2664888.

 

Its insane.... they are making software that they know its making BIG problems and are wating to Microsoft will adjust to eset.

LOL! eset nead to adjust to Microsoft!
If windows is buggy and makes freezes (with eset 6.2.171-190) then change eset code so that it will not utilize this bug! - agent 6.2.144 did not couse this !

[davidpitt 4]

Is anyone else able to comment on whether this new agent version fixes the freezing or as like rekun above still having the same issue?

Edited October 12, 2015 by davidpitt

[Marcos 5,071]

Eset is so blinded and stuborn and only clames that its not ther fault but its a Microsoft bug - case close -end

 

They say the only but not 100% tested solution is a Microsoft KB 2664888.

 

Its insane.... they are making software that they know its making BIG problems and are wating to Microsoft will adjust to eset.

LOL! eset nead to adjust to Microsoft!

If windows is buggy and makes freezes (with eset 6.2.171-190) then change eset code so that it will not utilize this bug! - agent 6.2.144 did not couse this !

 

Also reported on MSDN forum and confirmed by a Microsoft personnel to be a bug in WPF: https://social.msdn.microsoft.com:443/Forums/windowsdesktop/en-US/cac0c957-2b45-4128-a8dd-8cefc5ad3223/fwpsstreaminjectasync0-bring-high-irql?forum=wfp

The issue was reported also by other developers so we don't blindly blame Microsoft without a proof.

[Marcos 5,071]

If there is anyone who is experiencing the issue despite having KB2664888 installed? If the KB is not installed, alternatively you can disable protocol filtering in the v6 ESET product to prevent the bug in WFP from manifesting. Of course, this is not recommended on systems where files are downloaded from the Internet.

[rekun 43]

Hi Marcos

 

We are not saying that issue isn't happening because of a bug in Windows.

What we are saying, is that you will have work around this issue, as you have done in the past (and every other av company still does).

When doing a google search for KB2664888, you will only find topics related to Eset.

Also it only happens with the Agent, and i think it should be possible to build an agent without this feature.

This is a major issue for all companies. It is very hard to deploy, as it does not come through Windows Update /WSUS.

A solution could also be to make Microsoft deploy the update via Windows Update/WSUS, this would work for me as well.

[Marcos 5,071]

Unfortunately, the bug cannot be worked around as Windows Filtering Platform is an essential platform for protocol filtering on modern systems. Returning to obsolete tdi drivers which are not officially supported by Microsoft in modern systems anymore is not a way to go and removing protocol filtering feature completely is a no-go either. We've been trying to reach out to Microsoft and request inclusion of the hotfix to standard Windows updates to no avail but we will try again.

[prz3mazz 0]

Hi! I have a 210 computers with EES v6 in my hospital. I see there is a problems with some computers, user working on machine (word, excel, medic programs) and at equal intervals computers freeze. Computers have installed the KB 2664888 and there others KB. I contacted the Polish technical support Dagma but unfortunately the response time and support is far too long. I should mention that working in a hospital and unfortunately I can not afford a precedent or not running computers (sorry for my english).

 

Regards

 

[davidpitt 4]

Marcos, I'm confused by what you have just said. Does that mean all versions of Eset, 5.x, 6.0 and 6.1 before 6.1.171 that has the freezing issue don't use the new protocol filtering system?

 

So does that mean they are ineffective because they are using obsolete tdi drivers which are no longer officially supported by Microsoft?

 

It sounds like you're saying only the latest builds of 6.1 use the new protocol filtering system and this is causing the problems, yet you also say that disabling protocol filtering is not advised if the machine is on the internet.

 

So how does the previous versions of Eset run without freezing and yet have adequate protocol filtering protection in them?

 

Also you talk about the tdi drivers being not officially supported in modern operating systems, what does that mean as this freezing issue only appears to affect Windows 7. The problem has been fixed by Microsoft in Windows 8/10/2012 it would seem as the patch doesn't relate to these operating systems.

 

So this problem is never going to go away because Windows 7 is no longer on mainstream support by Microsoft, so patches like KB2664888 will never make it into windows 7 update!

Edited October 15, 2015 by davidpitt

[Marcos 5,071]

Marcos, I'm confused by what you have just said. Does that mean all versions of Eset, 5.x, 6.0 and 6.1 before 6.1.171 that has the freezing issue don't use the new protocol filtering system?

All these products utilize Windows Filtering Platform that contained the bug. TDI drivers were used by v3 and v4.

We'd be interested in knowing if excluding the IP address of the server running ERAS from protocol filtering in the v6 Endpoint setup makes a difference. Ideally try it before and after applying the hotfix KB2664888.

[kultec 0]

same here

Win 7 x64

 

Agents/Endpoint Antivirus causes the clients to freeze

 

is there any kind of workaround ?

my customer bought eset becaus of the remote admin and its features

 

and now i can manually deinstall the agent from the computers because the agent update oder uninstall wont work

Era 6.2

 

is there a new agent version in sight ?

[rekun 43]

Hi Macros

 

Any update on this case? have you succeded forcing Microsoft to release the update?

 

The hotfix does seem to fix the issue, but it is not possible to deploy using either GPO or WSUS, which makes it really hard for us to deploy.

 

I Have had the isssue occur at all of the customers i have upgraded, so it should not be so hard to reproduce at your end.

 

I dont have any users that i can use to beta test this anymore, as they are already quite angry about this.

[xyz 0]

Hello,

 

I have the same problem, about 300 workstation and randomly freeze on some of them.

Have You got any idea how to deploy KB2664888 via WSUS, because this KB is not visible on Microsoft Upload Center on WSUS ?

[HSW 9]

Hello,

 

I have the same problem, about 300 workstation and randomly freeze on some of them.

Have You got any idea how to deploy KB2664888 via WSUS, because this KB is not visible on Microsoft Upload Center on WSUS ?

No chance to deploy with WSUS MS must Setup the fix to optional or critical than you can push it with WSUS, actual no chance

[martyz 4]

You can push it from ERAS like 

"C:\Windows\system32\wusa.exe" "\\your\samba\share\kb2664888.msu" /quiet /norestart

[terrum 1]

I don't see this issue on my computers, but out of curiosity I downloaded the hotfix KB2664888 and tried to apply: On Windows 7 SP1 32bit I run Windows6.1-KB2664888-v2-x86.msu and on Windows 7 SP1 64bit I run Windows6.1-KB2664888-v2-x64.msu. In both cases hotfix install exiting with "The update is not applicable to your computer" error. Same story on any Windows 7 computer I tried.

 

Most reasonable explanation I can think of is that my OS patch level is higher than the hotfix was designed for. Another ideas?