AV Definition update caused error

Discussion in 'ESET NOD32 Antivirus' started by ThomasAdams, Sep 2, 2010.

Thread Status:
Not open for further replies.
  1. Furbykiller

    Furbykiller Registered Member

    Joined:
    Sep 2, 2010
    Posts:
    3
    Just send us Pizza.....www.dominos.co.uk

    Least you can do

    Servers running at 12% dead after reboots.


    Cinders says" Who's going to pay for all the overtime......":'(
     
  2. jprudente

    jprudente Registered Member

    Joined:
    Sep 11, 2008
    Posts:
    29
    In my case two were, but they each required two reboots and I had to pull the plug a few times. Not pretty, but they are at least running.

    James
     
  3. Damon85

    Damon85 Registered Member

    Joined:
    Dec 11, 2007
    Posts:
    33
    Thanks... looks like I'll be here late tonight. Nothing says 'after-hours' like having to pull the plug on the phone/voicemail system :doubt:
     
  4. knockknock

    knockknock Registered Member

    Joined:
    Oct 27, 2008
    Posts:
    5
    We have managed to get by at least for the moment on these issues, most of our environment runs virtually in our server network so for now our downtime has been extremely minimal.

    We have had a few issues related to certain software applications to do down on us durning this time, whether it is realted to the ESET issue Im not sure.

    I am quite aware of the Q/A involved in AV testing, it would appear then by description that this was in a way was a domino effect with multiple updates that caused today's problem.

    I can live with this (barring the dreaded McAfee blue screen) we are up and running and stable at this time.
     
  5. jimwillsher

    jimwillsher Registered Member

    Joined:
    Mar 4, 2009
    Posts:
    667
    We seem to be relatively unscathed too, by luck. Though I feel for Furbykiller with 12% of 700 servers gone pop. I'll happily contribute to his pizza since's he's clearly a UK user like myself :)


    Jim
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Update: we have a tool for restarting ekrn in v4 ready. Using the tool, no computer restart will be required after update to v. 5419. We'll update the appropriate KB article accordingly shortly.
    We are truly sorry for the inconvenience caused. As I wrote before, the problem was in update 4517 but exhibited just after update to a newer version. I can assure you that each update is tested completely before it's released. This time it was a combination of several factors that led to the issues. Appropriate measures will be taken to prevent such issues from occurring again.
     
    Last edited: Sep 2, 2010
  7. TobyG

    TobyG Registered Member

    Joined:
    Jun 25, 2010
    Posts:
    5
    Which, given there are an average of two to three updates a day, is a full time job and pretty much impossible.
     
  8. 8bit

    8bit Registered Member

    Joined:
    Jun 18, 2008
    Posts:
    9
    I posted a support ticket but my issue is that I can't install the 5419 update using the Update functionality with NOD32. I get either "no updates needed" or "virus signature database could not be updated". I'm afraid to reboot due to some users here reporting that their boxes did not boot back up! Most of my servers are remote to us.
     
  9. jeremyf

    jeremyf Registered Member

    Joined:
    Jul 14, 2008
    Posts:
    61
    Thank you for at least addressing the issue relatively quickly; and your apology goes a LONG way! :)
     
  10. red_jack

    red_jack Registered Member

    Joined:
    Aug 11, 2005
    Posts:
    56
    sigh waiting to get this update. a bunch of machines locked up. XP and Win7 x86 and x64 versions all locked up.
     
  11. 8bit

    8bit Registered Member

    Joined:
    Jun 18, 2008
    Posts:
    9
    True, and this update issue was not nearly as bad as the last bad update that locked machines up completely! I had to physically touch about 85% to 90% of those machines.
     
  12. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    If those machines have EAV already updated to v. 5419, just restart them. If you cannot afford restarting the affected computer, you can run the ESET Update Fix tool described in this KB article.
     
  13. Banger696

    Banger696 Registered Member

    Joined:
    Sep 6, 2006
    Posts:
    274
    I experienced this Blank Gui Window the other day see https://www.wilderssecurity.com/showthread.php?t=280603 is it related?

    I tried to repair Nod32 but I think ekern had failed and after reboot into safe mode and using the uninstaller everything went back to normal. Is there a bug underlying this? One has to ask how can a Virus signature update bring the OS to a total standstill, program module update I would understand but not Signature.
     
  14. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    The KB article has been updated and instructions for fixing the issue without a system restart added.
    PS: Going to catch the last bus home now but will stay online and monitor the situation.
     
  15. gmiest

    gmiest Registered Member

    Joined:
    Feb 2, 2010
    Posts:
    43
    Granted this situation sucks and it's a ~Phrase removed~ situation for all but if your servers are so fragile they can't survive a reboot perhaps you have larger issues than your AV vendor.
     
    Last edited by a moderator: Sep 2, 2010
  16. 8bit

    8bit Registered Member

    Joined:
    Jun 18, 2008
    Posts:
    9
    So if our server won't update from 5418 to 5419, do we just reboot?
     
  17. henktiggelaar

    henktiggelaar Registered Member

    Joined:
    Apr 19, 2010
    Posts:
    8
    If I wasn't such a nice person I would write a lot of bad words here. Instead I'll just say: Never again.

    NOD32 went from good to mediocre to crap in the last couple of years. This latest issue is inexcusable and is certainly the last drop for me. A lot of people lost a significant amount of work today or are still busy cleaning up the mess caused by ESET's employees.

    Congratulations ESET, NOD32 has become the new Norton.

    :thumbd: :thumbd: :thumbd: :thumbd: :thumbd: :thumbd: :thumbd: :thumbd: :thumbd: :thumbd:
     
  18. 0verlord

    0verlord Registered Member

    Joined:
    Dec 18, 2008
    Posts:
    17
    Has anyone gotten the new published tool to work? (eset_update_fix.exe) I got a few 2003 servers that currently have 5418, and haven't checked in with the ERA server in a few hours, the servers are up thankfully. When I run the published tool I get a command style box with ESET copyrights etc, and nothing else. The ESET GUI on the server is unresponsive, pushing the update via RA tool doesn't seem to do anything. Anyone else on the same boat?, dont' want to reboot servers I don't have too.
     
  19. Banger696

    Banger696 Registered Member

    Joined:
    Sep 6, 2006
    Posts:
    274
    I tried the tool on a workstation and after the copywright it says fix applied but haven't used on servers.
     
  20. 0verlord

    0verlord Registered Member

    Joined:
    Dec 18, 2008
    Posts:
    17
    Well my first experience with the tool on 2003 was like everything else on this day, not good news.

    After I ran the tool then the server became unresponsive (similar to what the workstations did after they updated) Rebooting once forced the ESET to update to 5419 but soon after the shell became unresponsive again, Rebooting a second time finally made the server go back to normal. So if you're server is stuck with 5417 or 5418 be ready to reboot twice.

    I am lucky I only dealing with a dozen servers here, I feel for those guys with hundreds of them.
     
  21. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    I'd suggest that you:
    - check if em002_32.dat in the ESET install folder exist or not
    - try killing ekrn.exe via the task manager
    Do you use a 32 or 64 bit Windows Server 2003?
     
  22. Damon85

    Damon85 Registered Member

    Joined:
    Dec 11, 2007
    Posts:
    33
    Just rebooting servers twice here regardless... I've seen enough inconsistencies in the DB numbers between the RA console and the EAV splash screen today to do otherwise. Fortunately we don't have very many servers so I'm just doing them one at a time... only a few more to go. So far so good.

    All the while, I'm hoping that 5420 that will inevitably come ten minutes after I leave doesn't create another catastrophe.
     
  23. 0verlord

    0verlord Registered Member

    Joined:
    Dec 18, 2008
    Posts:
    17
    *em002_32.dat does exist
    *ekrn.exe cannot be killed on 2003 via task manager.
    *Win2003 on 32bit.

    Tried the tool on two other servers and this time it worked, they updated to 5419 right away. The ERA server is reporting them with virus db of N/A, hopefully this this will change in the next 15 min when they check in.
     
  24. no_idea

    no_idea Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    83
    Thank you Marcos (and all the people at ESET in the background) for your efforts on this tool!
    This *really* made my day - I mean night, as it is past midnight in central europe. The tool works like a charm on XP, Vista64, Server 2000, Server 2008R2, you name it.

    Earlier on you wrote about 13 hours without food - well, maybe it's time to eat for you now ;)
     
  25. no_idea

    no_idea Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    83
    Give it some time - it will! :D (I'm so happy because all my servers are back in business without reboot!)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.