Endpoint Antivirus 5.0.2126.3 fails to update

Discussion in 'ESET Endpoint Products' started by DragonSlayer, Nov 12, 2012.

Thread Status:
Not open for further replies.
  1. DragonSlayer

    DragonSlayer Registered Member

    Joined:
    Apr 15, 2009
    Posts:
    8
    Location:
    Br?sarp / Sweden
    about half of my clients fail to update
    when hitting the update link within the client it instantly get an update failed message
    this started last week.. i then cleared the cache on the ERA server and initiated a new update and the problem was gone, till this weekend

    i tryed the same thing now, but it did not help this time
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Please create a package containing the following stuff, upload it to a safe location and PM me the download link:
    - the content of the mirror
    - dat files from the ESET folder on a client
    - the content of the "C:\ProgramData\ESET\%ProductName%\updfiles" folder on the client
     
  3. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Also please check the HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Remote Administrator\Server\CurrentVersion\Settings registry key and make sure the update server urls have the "http://" prefix.
     
  4. chmiller

    chmiller Registered Member

    Joined:
    Feb 7, 2007
    Posts:
    41
    I'm having a similar issue where about half of my machines are not updating; with the last successful update being 7672 or 7678. All my machines have the same settings, and all are running 5.0.2126.0. They are all set to "choose automatically" under the update server. On the machines that are failing, they are able to ping update.eset.com. I have tried to clear the cache and restart the machines, but that did not help. Anything else to try short of uninstall/reinstall on the effected machines?
     
  5. chmiller

    chmiller Registered Member

    Joined:
    Feb 7, 2007
    Posts:
    41
    Well, I needed to get this fixed now, so I am working through the process of uninstalling/reinstalling on all the affected clients. Probably an overkill way of fixing the problem, but at least it is getting it fixed.
     
  6. no_idea

    no_idea Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    83
    I'm seeing the exact same thing on some of the 5.0.2126 Endpoint Antivirus clients. Interestingly enough the clients update from our internal ERA-server but fail to do so on the public "automatic" servers.

    The failing clients stopped updating with the very same symptoms but on different signature updates. I see stops ranging from 7672 to 7677 so i think it has nothing to do with a specific signature update.

    As the failing clients are notebooks out of our main offices setting them to permanently updating from the ERA-server is no option. Interestingly enough not all notebooks are affected and I too have yet to figure out, how to fix them.
     
  7. captainfish

    captainfish Registered Member

    Joined:
    Aug 17, 2012
    Posts:
    35
    Location:
    USA
    From what we are seeing, it appears that an update set the first default update server to um24.eset.com. However, it is supposed to be htt://um24.eset .... And for whatever reason, the update gets stuck on that first incorrect server and fails to go to the next in the list.

    For whatever reason, some machines got a different update that did not contain this altered update server list, or managed to "skip" over the affected update (or two). Explains why re-installing works as it grabs the newest updates and definitions that have been posted since last thursday (when this began).

    However, doing a district or domain wide reinstallation should not be necessary. Have not heard back from ESET other than, "change registry settings".
     
  8. no_idea

    no_idea Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    83
    I have finally figured out what the problem is and how to fix it:

    The entry for DefaultServer0 in this registry key is malformed:
    HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000400\Settings

    it says: um11.eset.com/eset_upd/v5 instead of http://um11.eset...

    In order to fix this it is necessary to temporarily disable self-protection in HIPS, reboot the system, edit the registry setting, reenable HIPS and do another reboot.

    This is still bothersome but a lot easier to do than reinstalling the systems...
     
  9. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    This would have been fixed simply by pushing the supplied cfg xml to affected clients with no hassle ;)
     
Thread Status:
Not open for further replies.