Antivirus protection is disabled

[hobbit666]

I've deployed Nod32 V3.0.621.0 on all my client machine via the lan server and console.

All seems to be fine apart from every week and get on or two machine that come up with the following error:-


Protection status: Antivirus protection is disabled

Virus scanner initialization failed. Most of the ESET NOD32 Antivirus modules will not function properly.



There is no reason for it to stop working as it's been working fine for weeks then all of a sudden it doesn't. The only way i've found to fix this is to redeploy the software to the client. But i'm doing this 3-4 times during the week to different machines.

[csedgbeer]

just to add to that, i've got the same on a few 2000 machines, no idea what the solution is, but it's only the v3 clients that have the problem

i've gone back to 2.7 on a lot of non xp machines, think v3 has some issues yet, especially with DC's

[hobbit666]

Two more have gone offline today.

They are Windows 2000 machines

[csedgbeer]

ta, that confirms it to me then, nod v3 is coming off the 2000 machines as well!

just hope the XP machines still keep working well, otherwise they are going back to 2.7 as well!

ta

Chris

[Marcos]

When the problem occurs, could you please save all dat files from the ESET installation folder and deliver them to our Customer Care? The package will be quite large, therefore it's better to upload it to an ftp server and provide the customer care just a link to it.

[techie007]

I've been seeing the same problem, and it only seems to affect Windows 2000 machines, Pro or Server, but not all of them, and not all at once, and hardware is immensely different between machines I've seen it on.

If I reboot the system it comes back as Enabled, but with Definition Version "N/A", and then if I push an update to it, it fixes it (without another reboot).

I'll try and collect info if/when it happens again, glad to see I'm not the only one seeing this. :)

[hobbit666]

Message sent to support with link to this thread and a zip file of the dat files.

[Andrew Carey]

Presently I have 274 MS Windows 2000 v5.0.2195 SP4 workstations on my network. I have a total of 415 WinXP Pro workstations, on the same network.

Running ESET NOD32 AntiVirus Business Edition v3.0621 through ESET Remote Admin Console v2.0.33

Every morning I have 5 to 8 Win2000 machines with Last Event Warning - Virus scanner initialization failed. Antivirus protection will not function properly and Protection Status Text - Antivirus protection is disabled.

Virus Signature DB varies. No issue with WinXP Pro or the few Vista machines we are testing.

Support requested through the VAR.

[hobbit666]

I still have not recieved any reply from Eset as of yet. Apart from the we got the mwssage and someone will look at it reply.

[Andrew Carey]

I have 10 Win2000 machines disabled this morning.

[hobbit666]

just asked for an update on this issue.

[Darth AkSarBen]

Could there be a relationship to this thread and this one? New version 3.0.621 available (http://www.wilderssecurity.com/showthread.php?p=1180921#post1180921)

[Andrew Carey]

Here's the solution being offered, although I'm not sure how long this would take (x274 machines), it surely is a pain in the A##.

This is from my VAR (name withheld).


"After having investigated as much as I can in regards to resolving the issues of the NOD32 AV systems disabling themselves without having to perform the removals and re-installations I have re-contacted ESET tech support, in hopes they would have an alternate solution, and was explained that the solution; remove the NOD32 3.0, reboot, re-install NOD32 2.7, reboot, remove NOD32 2.7, reboot and re-install NOD32 3.0, is the only known fix for this issue. :blink:

I apologize for the inconvenience of the solution. I was unable to find any confirmed shortcuts that would correct the issue otherwise."

[Andrew Carey]

8 machines disabled today......

[techie007]

Reinstall?

All I have to do is reboot the offending Windows 2000 machine and then send an Update Now task via the RA and they're good to go.

That's lame and everything, but it's waay better than uninstalling, installing, uninstalling and installing again!?

[mayt]

Hello,

anyone willing to help with this issue can PM me for further instructions. Thank you.

[dbdoug]

-{ Quote: "Reinstall?

All I have to do is reboot the offending Windows 2000 machine and then send an Update Now task via the RA and they're good to go.

That's lame and everything, but it's waay better than uninstalling, installing, uninstalling and installing again!?" }-
Ran into this problem with a Windows 2000 PC, and I can confirm that rebooting and sending it an Update Now via the RA worked for me too. It's a PITA but it works to solve the problem (until it happens again), and much easier than the reinstall nightmare listed earlier.

[hobbit666]

-{ Quote: "Ran into this problem with a Windows 2000 PC, and I can confirm that rebooting and sending it an Update Now via the RA worked for me too. It's a PITA but it works to solve the problem (until it happens again), and much easier than the reinstall nightmare listed earlier." }-

Will try that method today and see what happens.

[mayt]

Hello,

I'd like to ask everybody who encounter this problem to have a look at the file:

%ProgramFiles%\ESET\ESET NOD32 Antivirus\em002_32.dat

It usually has zero length when the problem occurs. We'd appreciate if you could provide us with that information when the problem occurs.

Also, please make sure your w2k systems are fully updated with latest service packs.

Thank you all.

[hobbit666]

-{ Quote: "Hello,

I'd like to ask everybody who encounter this problem to have a look at the file:

%ProgramFiles%\ESET\ESET NOD32 Antivirus\em002_32.dat

It usually has zero length when the problem occurs. We'd appreciate if you could provide us with that information when the problem occurs.

Also, please make sure your w2k systems are fully updated with latest service packs.

Thank you all." }-

How would you like us to contact you with the files?

[osoblaha]

Yes, I can confirm the file is zero. On other W2k machines its about 8,4MB.
Please advise what to do next. Is it possible to copy this file over from a "healthy" machine?

[SoCal_Sparrow]

I am also suffering from this problem on 20-30 W2k Pro/Server machines. Eset support told me to reinstall .621 but that had no effect. I'll do anything I can to assist in finding a solution.

I can confirm that %ProgramFiles%\ESET\ESET NOD32 Antivirus\em002_32.dat is at zero length once the AV failure report occurs.

I've also found that by copying %ProgramFiles%\ESET\ESET NOD32 Antivirus\*.dat from a working NOD32 installation to %ProgramFiles%\ESET\ESET NOD32 Antivirus\ on the problem computer, and then performing Update Now will resolve the issue without a reboot.

[techie007]

The two DAT sets I captured from failing W2K's both show that symptom -- the em002_32.dat's are 0KB.

Another one happened today (to my boss, who pays for this), and he said he rebooted and it fixed itself (I was out of the office all day), but not right away. So it seems like if it gets rebooted it will correct itself at the next scheduled Def. file check.

[hobbit666]

Still waiting for an answer from support

[Andrew Carey]

ESET has sent me dll's to test. In process now.

[aieie]

Please, let us know how it went where tests are finished.

Best Regards

[hobbit666]

Got some new DLLs from support to help with this problem. Hopefully should see some resaults soon

[grichards]

I had a long discussion with eset support about this yesterday.
I have 1200 clients, and I was having this problem with about a quarter of them.

The issue is that there are 2 places a mirror can be created. One is in the client installed on the RA server, and the other place is in the RA Administrator itself, under Tools, Server Options, then Updates. So, with both mirrors enabled, one or the other is going to grab port 2221 and cause problems with updates. The recommendation from support is to enable the mirror in the RA Administrator and disable the one in the client. The server will need to be bounced (I noticed the eset http server and the eset ra http server service were both trying to start when the server started, so I disabled the eset http service). On the client side, I cleared the update cache, and rebooted the client. Then I issued an update task from the ra server. Updates are working correctly now, but it hasn't been long enough to tell if this is the permanent fix. I think it is, based on the background information I was given, and the symptoms I saw.

Thanks to everyone who has posted on this issue. It's a great help to know others experiences with the product. Good luck to all!

George

[techie007]

I'm not using a mirror for my clients. I get my updates directly from Eset through their own auto-server-selection.

Where are other's, who are experiencing it, getting their updates from?

[hobbit666]

-{ Quote: "I'm not using a mirror for my clients. I get my updates directly from Eset through their own auto-server-selection.

Where are other's, who are experiencing it, getting their updates from?" }-

I only use the Mirror Server from the Remote Server Application.

But i have now just started to deploy 3.0.624 to see if this fixes the problem

[Andrew Carey]

I'm only using the http mirror from the RA Server. Oddly enough, no logfiles yet from any machine with the new updater.dll installed.

Watching and still rebooting 10-12 machines a day at this point.

[NJ917]

Any new information for this problem? I'm experiencing the same thing, have about 60% of the Win2k boxes are getting this problem. Luckily the XP and Vista boxes are safe (knock on wood!).

[hobbit666]

for me the latest version (3.0.642) seems to have fixed this for me.

[mufi]

My ESET 3.0.551.0 at the protection status writes that antivirus protection is disabled, but the firewall, at.spyw.modul and the other is written with green letters.
This is after when i update the virus database. When i clicked on automatic, the database is 200701..., but when i choose a link it updates, 10mb files, and after that i got that message in the program-how can i put herte a screenshot?
im using xp hone edition, sp2. oh. i find how to upload pics. here is the situation...

[johnpd]

I have the same issue (Antivirus protection is disabled) with a Vista SP1 machine when I boot it up. I have NOD32 v3.0.657.0 and the latest signature update.

[edwin3333]

I had a Windows 2000 server have this problem with Nod 2.70 yesterday. I had to get someone to go out to that location, put the nod32 password in, and click the enable amon to get it running.

Not sure if related.

[johnpd]

-{ Quote: "I have the same issue (Antivirus protection is disabled) with a Vista SP1 machine when I boot it up. I have NOD32 v3.0.657.0 and the latest signature update." }-

I found the problem. I had "Automatic real-time file system protection startup" set to off. I assumed this was a setting to allow a virus scan when the system boots. Apparently it also prevents NOD32 from starting period.

[dsi-ap]

Is there a resolution to this..??

I have the same problem on 10 servers runnign windows 2000/2003 server.
The config for each server running nod eset v3 clearly shows av/aw protections is enabled but the servers still show them un protected with everything disabled.

This is proving to be a big problem and we dont want to go back to v2.7 with Sality.NAR virus able to disable any older A/V client.

[darrenjamesw]

Add me to the list. Server 2003 with same issue. Reboot corrects it but re-booting a server is not convenient. Version 3.0.672.0

[jprudente]

279 clients for me here, and like others, I have a few machines per day that experience this problem. Usually they are W2K SP4 machines, but I have seen this happen on XP SP3 as well. The one PC I have now with AV protection disabled does NOT show the aforementioned file as zero-length.

Between this and the intermittent 100% CPU issue, I'm more than a bit frustrated.

[Supersnake]

-{ Quote: "I have the same issue (Antivirus protection is disabled) with a Vista SP1 machine when I boot it up. I have NOD32 v3.0.657.0 and the latest signature update." }-

Yesterday while operating my computer I looked down to the task bar and saw that NODs protection was disabled. I reenabled the protection, worked a bit more on my computer and shut it down for the night.

Today I come home from work to find my wife doing her school work on the computer and I looked down in the task bar to see you know what - a red icon - again the antivirus was disabled. I then did a manual full system scan, luckily NOD found no threats.

NOD AV 3.0.672.0
VISTA SP1
--------------------------------------------------------------------------------------------------------------------
Updated October 1
I followed the advice given to Andrew Carey by his VAR and performed a cycle of uninstall, reboot, install, reboot, uninstall, reboot, install reboot - and for good measure repeated the cycle. Admittedly this was overkill on my part. Anyway this appears to have resolved the problem because I have since shutdown and restarted my computer twice without the problem showing itself again. This is in contrast to my previously seeing the AV become disabled upon every restart prior to employing the fix.
Thanks Andrew!

[redfive]

I saw this today on my machine and to fix it I deleted all of the .dat files in the %ProgramFiles%\ESET\ESET NOD32 Antivirus folder.

I first killed the egui process in Task Manager and then deleted the .dats. I then restarted the egui and then did another manual update. After the update was done I was back to a green eye.

[layman]

-{ Quote: "I saw this today on my machine and to fix it I deleted all of the .dat files in the %ProgramFiles%\ESET\ESET NOD32 Antivirus folder.

I first killed the egui process in Task Manager and then deleted the .dats. I then restarted the egui and then did another manual update. After the update was done I was back to a green eye." }-

I just encountered this same problem in XP SP3. It occurred on reboot following a test of a Macrium Reflect recovery disk (Linux) -- hmmmm -- may just be coincidence. Your solution worked for me, but I had to reboot and try the update a second time. On the first attempt, NOD32 reported that no update was needed.

EDIT: I should clarify that the recovery disk test was merely a bootup check to see if I could map network drives with it.