Jump to content

ESET File Security not reporting in to ERA server


Recommended Posts

  • ESET Moderators

Hello,

 

We have released an ESI module v1254 which contains the fix a while ago.

We recommend to update to this module - in order to be able to update, you need to restart the ESET Service (ekrn), either by reboting the system, or by restarting the service itself, in case you have SelfDefense turned off.

In case the restart alone won't help, you need to delete the problematic files before restarting: em009_32.dat and em009_64.dat located in the installation folder. (These are also protected by SelfDefense, so you can either delete them in Safe Mode, or disable SelfDefense first.)

Upon next update, the fixed version of the module will be downloaded.

 

Please provide your feedback.

Thank you.

T.

Link to comment
Share on other sites

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

Edited by erlend_oyen
Link to comment
Share on other sites

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

 

Not conclusive but I have just updated and restarted one of our servers which wasn't rebooted while this situation was going on. Seems to be ok. Looks like anything which is still communicating with an ERAS will be ok as long as the mirror is up to date (12303 or later)

Link to comment
Share on other sites

 

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

 

Not conclusive but I have just updated and restarted one of our servers which wasn't rebooted while this situation was going on. Seems to be ok. Looks like anything which is still communicating with an ERAS will be ok as long as the mirror is up to date (12303 or later)

 

 

ok, but do you have to restart at all, on unnafected systems?

Link to comment
Share on other sites

 

ok, but do you have to restart at all, on unnafected systems?

 

 

Nope, I only restarted it as a test. So currently unaffected systems (i.e. those which haven't been rebooted) will continue to work. Anything that got rebooted and subsequently stopped working will need the fix applying.

Link to comment
Share on other sites

  • ESET Moderators
ok, but do you have to restart at all, on unnafected systems?

 

No, not at all. The restart is needed only to get the updating mechanism to work again, so that the machine can download the newer module. Unaffected systems will download the module as every other, no special attention necessary.

Link to comment
Share on other sites

Confirmed fixed for me without having to manually remove the files - but i did need to reboot. Why isn't the alert article

hxxp://support.eset.com/alert5553/ updated? as my symptoms do not match and neither does the suggested fix on it, but the workaround and final update do fix it.

Link to comment
Share on other sites

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

 

 

I have Self-defense enabled and for me worked ->

 

1) tools / sysinspector -> create snapshot

2) during snapshot creation -> update / update virus signature database

3) setup / enter entire advanced setup tree / miscellaneous / remote administration / interval -> 1min

wait until the database updates to 12303 or newer

4) click on update / update virus signature database again -> you'll get "error opening socket" again

5) tools / sysinspector -> create snapshot again

6) during snapshot creation -> update virus signature database again

7) delete both sysinspector snapshots [wait after they are created]

8) setup / enter entire advanced setup tree / miscellaneous / remote administration / interval -> back to time you had before change

9) update virus signature database again -> all is OK

 

For me this fixed all my clients without the need of restart or turning of self-defense.

 

So basically your workaround triggered two times in a row... Without step 4) this workaround didn't work.

Link to comment
Share on other sites

The fix mentioned by TomasP does resolve the issue. I can confirm that if the server is not currently having the issue no further intervention is required. Any server having the issue needs those two files (em009_32.dat and em009_64.dat) deleted. Then once you run an update it will connect back to the RAC.

Link to comment
Share on other sites

The fix mentioned by TomasP does resolve the issue. I can confirm that if the server is not currently having the issue no further intervention is required. Any server having the issue needs those two files (em009_32.dat and em009_64.dat) deleted. Then once you run an update it will connect back to the RAC.

 

Yeah, but if you have Self-defense enabled, you can't delete those files. When you disable it, you'll need restart. In many cases you simply cannot restart server...

Link to comment
Share on other sites

By creating a sysinspector snapshot you can trigger a update and a connection to ERA. (update during the sysinspector run or right after its completed.)

 

it's not a fix, but it's a workaround to get the updates without rebooting. 

Same issue here. I can confirm the workaround works, but it's a one-time solution; Afterwards, it stops reporting/updating again and you have to do the workaround again to have it updated.

Link to comment
Share on other sites

  • ESET Moderators

Hello Keynan,

When the update works, you need to make sure the SysInspector module updated to version 1254. Then, upon the next initialization of our antivirus, the problem will be gone.

Link to comment
Share on other sites

-Rename or delete the Updfiles folder (C:\ProgramData\ESET\ESET File Security\)

-Sysinspector Workaround (erlend_oyen: By creating a sysinspector snapshot you can trigger a update and a connection to ERA. (update during the sysinspector run or right after its completed.))

-New updfiles folder and problem solved

Link to comment
Share on other sites

below a link to a executable (it restarts the ESET service while ESET is running) and script provided by ESET which will allow you to fix you update issues without having to reboot the servers. I have also included the KB article which has the steps on what to do if you can reboot the server.

 

hxxp://download.eset.com/special/eset_update_fix.exe

 

@ECHO OFF

 

set “updFix=\\server_name_here\eset\eset_update_fix.exe

%updFix%

 

del "C:\Program Files\ESET\ESET File Security\em009_32.dat"

del "C:\Program Files\ESET\ESET File Security\em009_64.dat"

 

echo %time%

timeout 5 > NUL

echo %time%

 

%updFix%

 

Exit

 

hxxp://support.eset.com/alert5553/

 

A number of customers have run the above and it has rectified their update issues. Please let me know if you require any further information.

Link to comment
Share on other sites

  • Administrators

Has there been a permanent fix for this?

 

Yes. SysInspector module 1254 with the fix was released on September 24.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...