ESET File Security not reporting in to ERA server

[TomasP 316]

Hello,

 

We have released an ESI module v1254 which contains the fix a while ago.

We recommend to update to this module - in order to be able to update, you need to restart the ESET Service (ekrn), either by reboting the system, or by restarting the service itself, in case you have SelfDefense turned off.

In case the restart alone won't help, you need to delete the problematic files before restarting: em009_32.dat and em009_64.dat located in the installation folder. (These are also protected by SelfDefense, so you can either delete them in Safe Mode, or disable SelfDefense first.)

Upon next update, the fixed version of the module will be downloaded.

 

Please provide your feedback.

Thank you.

T.

[erlend_oyen 2]

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

Edited September 24, 2015 by erlend_oyen

[Dan.Gurney 0]

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

 

Not conclusive but I have just updated and restarted one of our servers which wasn't rebooted while this situation was going on. Seems to be ok. Looks like anything which is still communicating with an ERAS will be ok as long as the mirror is up to date (12303 or later)

[erlend_oyen 2]

 

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

 

Not conclusive but I have just updated and restarted one of our servers which wasn't rebooted while this situation was going on. Seems to be ok. Looks like anything which is still communicating with an ERAS will be ok as long as the mirror is up to date (12303 or later)

 

 

ok, but do you have to restart at all, on unnafected systems?

[Dan.Gurney 0]

 

ok, but do you have to restart at all, on unnafected systems?

 

 

Nope, I only restarted it as a test. So currently unaffected systems (i.e. those which haven't been rebooted) will continue to work. Anything that got rebooted and subsequently stopped working will need the fix applying.

[TomasP 316]

ok, but do you have to restart at all, on unnafected systems?

 

No, not at all. The restart is needed only to get the updating mechanism to work again, so that the machine can download the newer module. Unaffected systems will download the module as every other, no special attention necessary.

[ruidc 0]

Confirmed fixed for me without having to manually remove the files - but i did need to reboot. Why isn't the alert article

hxxp://support.eset.com/alert5553/ updated? as my symptoms do not match and neither does the suggested fix on it, but the workaround and final update do fix it.

[TomasP 316]

Thank you for the feedback, we are glad the fix is successful.

We will update the mentioned article as well.

[PiT 0]

Hi

 

Do you have to do the manual update/fix only on affected systems?

 

And all others with receive the update without the need to reboot?

 

900+ servers, reboot times 2?.

 

 

I have Self-defense enabled and for me worked ->

 

1) tools / sysinspector -> create snapshot

2) during snapshot creation -> update / update virus signature database

3) setup / enter entire advanced setup tree / miscellaneous / remote administration / interval -> 1min

wait until the database updates to 12303 or newer

4) click on update / update virus signature database again -> you'll get "error opening socket" again

5) tools / sysinspector -> create snapshot again

6) during snapshot creation -> update virus signature database again

7) delete both sysinspector snapshots [wait after they are created]

8) setup / enter entire advanced setup tree / miscellaneous / remote administration / interval -> back to time you had before change

9) update virus signature database again -> all is OK

 

For me this fixed all my clients without the need of restart or turning of self-defense.

 

So basically your workaround triggered two times in a row... Without step 4) this workaround didn't work.

[erlend_oyen 2]

i received a fix from ESET witch kills ekrn.exe, and allows the files to be deleted

Edited September 24, 2015 by erlend_oyen

[PatrickHoban 1]

The fix mentioned by TomasP does resolve the issue. I can confirm that if the server is not currently having the issue no further intervention is required. Any server having the issue needs those two files (em009_32.dat and em009_64.dat) deleted. Then once you run an update it will connect back to the RAC.

[PiT 0]

The fix mentioned by TomasP does resolve the issue. I can confirm that if the server is not currently having the issue no further intervention is required. Any server having the issue needs those two files (em009_32.dat and em009_64.dat) deleted. Then once you run an update it will connect back to the RAC.

 

Yeah, but if you have Self-defense enabled, you can't delete those files. When you disable it, you'll need restart. In many cases you simply cannot restart server...

[Keynan 0]

By creating a sysinspector snapshot you can trigger a update and a connection to ERA. (update during the sysinspector run or right after its completed.)

 

it's not a fix, but it's a workaround to get the updates without rebooting. 

Same issue here. I can confirm the workaround works, but it's a one-time solution; Afterwards, it stops reporting/updating again and you have to do the workaround again to have it updated.

[erlend_oyen 2]

if you contact ESET support they can provide a "fix" that terminates ESET and enabels you to delete the files without rebooting.

worked, tested on about 50 servers with a script and psexec.

[TomasP 316]

Hello Keynan,

When the update works, you need to make sure the SysInspector module updated to version 1254. Then, upon the next initialization of our antivirus, the problem will be gone.

[eset_sf 0]

-Rename or delete the Updfiles folder (C:\ProgramData\ESET\ESET File Security\)

-Sysinspector Workaround (erlend_oyen: By creating a sysinspector snapshot you can trigger a update and a connection to ERA. (update during the sysinspector run or right after its completed.))

-New updfiles folder and problem solved

[trixsta 0]

below a link to a executable (it restarts the ESET service while ESET is running) and script provided by ESET which will allow you to fix you update issues without having to reboot the servers. I have also included the KB article which has the steps on what to do if you can reboot the server.

 

hxxp://download.eset.com/special/eset_update_fix.exe

 

@ECHO OFF

 

set “updFix=\\server_name_here\eset\eset_update_fix.exe”

%updFix%

 

del "C:\Program Files\ESET\ESET File Security\em009_32.dat"

del "C:\Program Files\ESET\ESET File Security\em009_64.dat"

 

echo %time%

timeout 5 > NUL

echo %time%

 

%updFix%

 

Exit

 

hxxp://support.eset.com/alert5553/

 

A number of customers have run the above and it has rectified their update issues. Please let me know if you require any further information.

[ttjohns 0]

Has there been a permanent fix for this?

[Marcos 5,070]

Has there been a permanent fix for this?

 

Yes. SysInspector module 1254 with the fix was released on September 24.