server connection errors - again!

I have an inbox full of "server connection error" messages again this morning & worried people contacting me bec their NOD a/v is not updating. I've told them to keep persisting, but the result of that is that I get more error messages.
Is there a problem with the servers (dare I say, again)?
I live in an area where the majority of people are on (slow) dial-up connections and these always seem to be the ones who are affected like this.
However, I find it a bit embarrassing after constantly reminding them to make sure they get their updates whenever they go on line, when this happens on a regular basis?
PLEASE don't tell me to check whether they have typed their registrations incorrectly .. these people have been getting their updates for months without a problem, then intermittently they can't.

 

Are they all with the same ISP by chance?

And I gather "choose automatically" is set for the servers.

Cheers

 

yes, but so are about 200 of the others who aren't having a problem ... including "yours truly"

Absolutely

 

There hasn't been any major update which might have theoretically cause an overload of the update servers. We have recently added a new efficient server in the US so that's certainly not the case. What happens if they force a manual update?

 

And I gather this is also happening with a Manuel update as well?

There is a thread here (post number 28 ) where I discovered the same issue by chance, as I don't have my customers machines set up to email me: https://www.wilderssecurity.com/showthread.php?t=48167&page=28

I think Bandicoot will have to get back onto the job...

Cheers

 

Bec I regularly get these warnings (although not in the numbers I have last night and this morning) I have a step-by-step guide on how to manual update which I email out whenever I get the "server connection failure" from their machines.
In once instance, I had about 10 of these warnings from one computer, before I convinced him to give up and later ... and sure enough it updated OK about an hour later

 

yep, it is ... see my reply to Marcus

I started doing this bec my experience has been that people don't usually take enough notice of these things and a lot of time it is one of their kids using the computer at the time, and the next thing I hear is that they have an infection!!!

yes, I think he's had enough time scurrying about of late ... lol

 

I usually end up with a number of errors showing up in my update file as well. It eventually works out so everything is ok I guess.

Neil

 

Is an Internet connection actually established at the time you attempt to update NOD32? Just to make sure, try pinging any of our update servers (e.g. ping u4.eset.com) to see if you get a response.

 

Yes, Marcos, all these computers have been set to attempt an update after internet connection has been established. The error messages on some are repetitive for as long as the users remain on line and keep attempting to update.
I should point out that the majority of these people are just average computer users, who wouldn't know a ping if it bit them on the whatzit!
All they know is they have an antivirus and that when it says there is an update available they have to click OK, if anything different happens, they either contact me, or ignore it & hope it will go away

 

Hi Sagittarius,
if the type of the Internet connection is not set to dial-up and a user has both the regular update task as well as the update after dial-up connection task scheduled, it might still result in suchlike errors in the event log.

 

Hi Marcos, there is a thread here (post number 28 ) where I discovered the same issue by chance on my Uncles computer, it is set correctly for dialup: https://www.wilderssecurity.com/showthread.php?t=48167&page=28

Cheers

 

Sagittarius, can you please post a couple of the error logs...

Cheers

 

HI everyone,
sorry about my delay in posting replies I have been up to my eyeballs in work and this is the first opportunity I've had to get back to the forum.

The settings I use are always identical on every computer I set up, and as I told Blackspear (in a private email yesterday)
<snip>
"I have some additional information, to give him.
I have one of these computers here at work to uninstall & reinstall NOD to stop the "false" incorrect username/password issue.
While I was on line updating - on a perfectly good phone line connection, it just fell asleep and I got this message right at this very minute:
"26/11/04 12:26:33 PM - During execution of Update on the computer HPPAV, the following warning occured: Update attempt failed (Server connection failure)"
So, now I have eliminated the "slow country phone line" option, as this is running at 50666bps, about normal for this part of the world.
And just talking to the other bloke who works here & has ISDN the same as me, he said he's had that message too on the odd occasion, and specifically he got it yesterday, around the same time I was posting to the forum."
<snip>
I will post the error logs separately Blackspear ... I got another delivery of them again this morning, so some users are still experiencing the problem

 

Some error messages as per Blackspear's request:

11/27/2004 6:37:12 AM - During execution of Update on the computer YOUR-VROZPT3ZVX, the following warning occured: Update attempt failed (Server connection failure)
11/27/2004 6:36:05 AM - During execution of Update on the computer YOUR-VROZPT3ZVX, the following warning occured: Update attempt failed (Server connection failure)
11/27/2004 6:35:12 AM - During execution of Update on the computer YOUR-VROZPT3ZVX, the following warning occured: Update attempt failed (Server connection failure)

I also had a similar number from the same computer on 24, 25 & 26.
The reason there are a succession of these is bec I have told these people to keep trying manual update until they succeed.
However I had one user who tried about 10 times unsuccessfully, I have now revised that instruction to "if you don't succeed within a reasonable time, leave it until next time you connect". The person with the above messages, has been failing for 4 days in a row. I have emailed him asking whether he has had a successful update anywhere during that time, so will let you know when I hear.

Here are some more:
11/26/2004 23:21:22 PM - During execution of Update on the computer NONE-KMF96VC2SR, the following warning occured: Update attempt failed (Server connection failure)
11/27/2004 4:44:20 AM - During execution of Update on the computer NONE-KMF96VC2SR, the following warning occured: Update attempt failed (Server connection failure)
he has had a lot more, but I have only kept the last ones.

This is a new one from the one I told you about above, who tried 10 times last week (he finally got an update after reconnecting later in the day) this is a new one since then:
26/11/2004 22:23:03 PM - During execution of Update on the computer DOUGS, the following warning occured: Update attempt failed (Server connection failure)

This one gets an error message every day:
25/11/2004 16:50:32 PM - During execution of Update on the computer D4E9P9, the following warning occured: Update attempt failed (Incorrect username or password.)
I still don't know whether she has had a successful update during that period.

I have plenty more of these from other users, if you want more. And like I said, every one of these computers was set up in precisely the same way by me personally. The only common factor is that they all live in areas with dial-up connections of varying quality. Although I no longer feel that is a mitigating factor after my experience yesterday, as described in my other post.

Some of you may ask why I bother to get these error messages sent to myself ... my response is that, in an area like this, keeping a good reputation is everything. My experience is that if these people were left to their own resources, many of them would have an infection in no time at all. Because most people (despite being repeatedly told it is not) believe that an antivirus is a set-and-forget thing. If they get infected and take their computers elsewhere, there are plenty of computer shops all too ready to pounce on this as evidence of NOD32's inferiority (and I know this to be a fact, as people have told me this many times). But more importantly to order for me to have a thriving business in computer security, I have to make sure the product I install and standby, lives up to it's reputation .. even if that means making a lot more work for myself.

 

I have just had a reply from the man I spoke about in my earlier post. Here is the cut & paste from his email to me:
<snip>
Yes I tried to update twice this morning. I am currently 3 behind latest
update which from memory I think ends in 5.
The last time I updated I got error no connection to server, put this down
to congestion and updated successfully shortly after. I am currently on 1.932
<snip>

 

Hi Sagittarius, Bandicoot is back on the case trying to replicate your problem.

I have read all of the above. Can you walk one of these customers through sending a complete log, it may just give us more of an idea as to what is going on...

Cheers

 

Blackspear, it just occurred to me that you may mean the actual logs from the individual computers?
If so, I doubt that I can comply, as I'm not sure any of these people are able to perform the necessary cut & paste operation which other forum members take for granted

 

Indeed this is what I am after. What about the guy yesterday, or even your own tech, his log will probably do, just trying to see a pattern over a greater time length. I'll try to get hold of my uncle’s log, he is VERY computer illiterate, but I can walk him through it over the phone...

Cheers

 

I'll see what I can do

 

Have just had a NOD32 user bring their computer to my house with another unrelated problem, but coincidentally they have been getting the "server connection error" message for quite some time.
This gets pretty complicated, so I hope I can explain it
The first log I am posting shows what was happening when we first attempted to update (several times as you can see):

Time Module Event User
27/11/2004 11:02:44 AM Update Update attempt failed (Server connection failure) default
27/11/2004 11:00:26 AM Update Update attempt failed (Server connection failure) default
27/11/2004 10:52:43 AM Update Update attempt failed (Server connection failure) default
27/11/2004 10:51:55 AM Update Update attempt failed (Server connection failure) default
27/11/2004 10:50:53 AM Update Update attempt failed (Server connection failure) default
26/11/2004 16:55:09 PM Update Update attempt failed (Server connection failure) default
25/11/2004 7:26:04 AM Update Update attempt failed (Server connection failure) default
25/11/2004 7:25:23 AM Update Update attempt failed (Server connection failure) default
20/11/2004 12:00:22 PM Kernel The virus signature database has been updated successfully to version 1.928 (20041119). default
18/11/2004 14:37:47 PM Kernel The virus signature database has been updated successfully to version 1.925 (20041117). default
17/11/2004 16:21:11 PM Update Update attempt failed (Download interrupted.) default
16/11/2004 16:24:42 PM Update Update attempt failed (Server connection failure) default
15/11/2004 7:06:55 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
15/11/2004 7:06:55 AM Update Update attempt failed (Incorrect username or password.) default
14/11/2004 20:40:42 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
14/11/2004 20:40:42 PM Update Update attempt failed (Incorrect username or password.) default
13/11/2004 14:26:50 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
13/11/2004 14:26:50 PM Update Update attempt failed (Incorrect username or password.) default
12/11/2004 20:41:40 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
12/11/2004 20:41:40 PM Update Update attempt failed (Incorrect username or password.) default
12/11/2004 7:10:38 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
12/11/2004 7:10:38 AM Update Update attempt failed (Incorrect username or password.) default
11/11/2004 17:23:24 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
11/11/2004 17:23:24 PM Update Update attempt failed (Incorrect username or password.) default
10/11/2004 6:41:38 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
10/11/2004 6:41:38 AM Update Update attempt failed (Incorrect username or password.) default
9/11/2004 16:55:26 PM Update Update attempt failed (Server connection failure) default
9/11/2004 6:44:54 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
9/11/2004 6:44:54 AM Update Update attempt failed (Incorrect username or password.) default
8/11/2004 14:13:26 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
8/11/2004 14:13:26 PM Update Update attempt failed (Incorrect username or password.) default
8/11/2004 7:19:34 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
8/11/2004 7:19:34 AM Update Update attempt failed (Incorrect username or password.) default
7/11/2004 8:17:16 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
7/11/2004 8:17:16 AM Update Update attempt failed (Incorrect username or password.) default
6/11/2004 7:21:32 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
6/11/2004 7:21:32 AM Update Update attempt failed (Incorrect username or password.) default
5/11/2004 20:07:40 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
5/11/2004 20:07:40 PM Update Update attempt failed (Incorrect username or password.) default
4/11/2004 13:42:17 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
4/11/2004 13:42:17 PM Update Update attempt failed (Incorrect username or password.) default
2/11/2004 18:17:19 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
2/11/2004 18:17:19 PM Update Update attempt failed (Incorrect username or password.) default
1/11/2004 14:38:17 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
1/11/2004 14:38:17 PM Update Update attempt failed (Incorrect username or password.) default
1/11/2004 7:51:29 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
1/11/2004 7:51:29 AM Update Update attempt failed (Incorrect username or password.) default
30/10/2004 15:31:34 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
30/10/2004 15:31:34 PM Update Update attempt failed (Incorrect username or password.) default
30/10/2004 7:55:01 AM Update Function: DownloadAuthorization, parameters: , return value: 401 default
30/10/2004 7:55:01 AM Update Update attempt failed (Incorrect username or password.) default
29/10/2004 21:19:17 PM Update Update attempt failed (Server connection failure) default
28/10/2004 20:31:23 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
28/10/2004 20:31:23 PM Update Update attempt failed (Incorrect username or password.) default
27/10/2004 17:10:48 PM Update Function: DownloadAuthorization, parameters: , return value: 401 default
27/10/2004 17:10:48 PM Update Update attempt failed (Incorrect username or password.) default
----------
As you will notice, about a month ago, she was getting incorrect username or password errors. I was unaware of this, because I set her computer up a couple of years ago, before I started getting these warnings sent to me.

She contacted me for some reason (I can't recall now) and I talked her through all the settings over the phone, so after that I became aware of the password error issue.
I contacted her about this and everything was fine - for 2 updates as you can see on the 18th & 20th - then it stopped updating again and started giving her "server connection error" messages.
After multiple attempts this morning, I decided just on a whim to try retyping her password again ... and yes, you guess it, it started updating again.

As shown here:
Time Module Event User
27/11/2004 11:06:03 AM Kernel The virus signature database has been updated successfully to version 1.935 (20041126). default
27/11/2004 11:02:44 AM Update Update attempt failed (Server connection failure) default
27/11/2004 11:00:26 AM Update Update attempt failed (Server connection failure) default
27/11/2004 10:52:43 AM Update Update attempt failed (Server connection failure) default
27/11/2004 10:51:55 AM Update Update attempt failed (Server connection failure) default
27/11/2004 10:50:53 AM Update Update attempt failed (Server connection failure) default
26/11/2004 16:55:09 PM Update Update attempt failed (Server connection failure) default
25/11/2004 7:26:04 AM Update Update attempt failed (Server connection failure) default
25/11/2004 7:25:23 AM Update Update attempt failed (Server connection failure) default
20/11/2004 12:00:22 PM Kernel The virus signature database has been updated successfully to version 1.928 (20041119). default
18/11/2004 14:37:47 PM Kernel The virus signature database has been updated successfully to version 1.925 (20041117). default
------

(And before anybody suggests it, no, she didn't change it again herself - after all, why would she She didn't even know it wasn't updating, I was receiving the failure messages?)

But if the password was the issue, how did she manage to get the 2 updates earlier on?

Also, why was it sending "server connection failure" messages and not "incorrect username or password"?

And also, if the password is capable of changing itself at random ... which is what appears to be the case here, how do I know which of these messages indicates a genuine "server connection failure" and which indicate an incorrect password?

P.S. Blackspear (via a private message) has suggested a complete uninstall & reinstall to eliminate any grey areas with this installation. As time did not permit this today, I intend getting the client to bring their computer to me again for this purpose.

 

Howdy peeps,

Well, I thought I'd figured this one out on Saturday...but not quite. However, I think there is a little bug in the NOD32 installer....at least for users with a Dial-up connection to the internet.

I installed NOD32 onto an old laptop running Win98. (NOD tried to update immediately but I wasn't able to receive as I wasn't connected to the internet.....hence there was an initial error in the log.) I then connected the laptop and downloaded the VSD which took 30 minutes (slow dial-up connection!).

I then disconnected and left the machine running.

At 17.03 it tried to connect and there was a "Server connection failure" logged. And again at 18.03 and 19.03 and 20.04 and 21.06.

The reason "Regular automatic update" is automatically checked in the Scheduler/Planner window (along with "Automatic update after dial-up connection has been established" of course) is because it's not always safely possible for NOD to check if internet connection is established, hence it will check every hour for updates to be on the safe side.

The developers at Eset are planning to add a filter to stop error messages like this appearing when there has clearly been no 'user' attempt to connect to the internet. I've added this issue to the 'bug list' so hopefully it will be resolved in the near future.

HOWEVER... this doesn't seem to be directly the issue with Sagittarius and her customers...... and possibly Uncle Blackspear. They seem to be requesting manual updates every few minutes in some cases, with no joy.

I checked 4 of Sagittarius's clients details meticulously...testing them on each of our servers (BTW.... Server u6 was added a few days ago, and u7 will be available very soon) and found no problems with any of them.

So it begs the question: are all these users with the same ISP maybe? Could it be an issue with them rather than with Eset's servers? Sagittarius? And Blackspear... what ISP is your uncle using?

Sagittarius: Is it possible the client you've mentioned above had altered their UN+PW accidentally somehow? You corrected them when the machine was brought to your house. Did you make the updates on 18th and 20th Nov. using your internet connection? When your client connected again at their own place, the errors returned. Or have I got it all wrong?

I know you said earlier

but I just wonder if there's a common denominator here somewhere (apart from NOD32, before you say anything Mr. Spear....!!!!!!!)

Are there any other folks in other parts of the world getting similar, continuous problems?

Bandicoot.

 

Honey them there varmints are back, where’s me shotty, honey come quickly we’re gunna have a rodent on the spit tonight

Ahhhh all that scurrying about produced results, thought you were going to wear a hole in the Wilders carpet

In his case it does update when a connection is made, it just throws up errors until then

Good to see

In Sagittarius case I believe so. I do remember Rod coming across a problem last year with Optus, he did find a work around but I cannot remember what it was, something to do with Oprtus’s proxy servers or something…

Cawwww didn’t even have a chance to say anything before I was shot down… Damn honey them varmints are getting smarter…

Well Mr Coot, glad to see that you are back on the case. As always a pleasure.

Cheers

 

What might even botters more: no update at all up until now since the 26th... That's even slower than F-Secure was

 

Thanks for your tireless research Bandicoot (yet again )
Yes, approximately 220 of my users have the same ISP (I work for my ISP and hence that is the source of most of my customers ... lol)
However I must beg to differ on the ISP being the reason, otherwise, why don't the other 200+ get a similar error
Or at least those who are using W98? and why did I get the error after a clean install, here at work, on a perfectly good dial up connection?
and why does this only come in fits & starts? e.g. since Saturday, I have had no further error messages from any computers?

I think I can state with 100% certainty that this did not happen .. I also think I can state the same for all the other cases, as these people NEVER touch settings in their computers without having someone hold their hands ... lol.
But, in any case, if had inadvertently changed a setting or password, why does it suddenly & inexplicably begin updating again out of the blue?
sooooo many questions
in the meantime, the dust seems to have settled once again, so the heat is off for me until next time