Virus scanner initialization failed.

Hi Guys,

We have an ongoing issue with one of our users whereby they intermittently get the following error messages which can often be resolved by rebooting the machine:

“Virus scanner initialization failed. Antivirus protection will not function properly.”

What we’ve tried:
* Manual uninstall and reinstall of NOD as per KB article.
* Wiped the PC and re-installed all apps only to have to issue re-occur
* Deleted and recreated the user’s Windows profile only to have the issue re-occur
* Setup the user on a different workstation with a new installation of NOD only to have the issue re-occur again!

This has us scratching our heads a lot and we can't understand how the issue could follow this user around to a new PC.

Currently as it stands the PC will successfully update its definitions about half the time. When it does, it works for a while before erroring again a few hours later.

Some details about the setup in question:

O/S: Windows XP SP3 (for both PCs which were tried)
NOD32 AV Client version: 4.2.64
NOD32 Server version: 4.0.138

The PCs are running in a Server 2003 AD environment without roaming profiles.


I also want to mention that we've tried going through the official NOD32 support channels and simply aren't getting a response. We created a support case the official website only to get an automated response to try our local support in Australia.

The only issue with that is we've sent multiple e-mails to support@eset.com.au and have never gotten a response. It seems like nobody even reads that e-mail address?

Hopefully you guys can help..

 

Could you please generate a Procmon log (with boot logging enabled) from a moment when the problem occurs and convey it to ESET?

 

Hi Marcos,

Thanks for you reply! I'm not familar with Procmon but I assume it's this utility? http://technet.microsoft.com/en-us/sysinternals/bb896645

Also, how would I go about sending it to eset? As mentioned in my first post I'm not having any luck getting them to respond to me. Is there a particular e-mail address I should send it to?

Cheers

 

Do the following:
- run Process Monitor
- enable boot logging
- restart the computer
- run Process Monitor and save the log (discard it if the issues didn't occur during the system startup)

When you manage to reproduce the issue and save the log, compress it log, upload it to an ftp server or a file sharing service and PM me the link.

 

Hi Marcos,

I've created some logs and have them sitting on a private FTP but I'm unable to send you a PM as apparently the 'Private Messaging Service is Unavailable'?

In any case, the best I was able to do was generate a log of the failure after logging off then logging back on the PC. I did create a log of the reboot as well, however rebooting fixes the issue that particular log may not be of any use to you.

What's the next thing I can try?

Cheers

 

Hello,

I have the same or similar problem with one client.
For several computers will not load roaming profile, and yet it lends itself damage the server so it is necessary to do restore from backup.

On these computers are then not let eset gui

computers have Windows XP and the ERA server is a server operating system 2003r2


you have any idea what stim.

thanks
reco

 

Hi Marcos,

We have since changed the user to a new PC again only to have the issue re-occur after 5 days.

We're at our wits end as to figure out how this problem is following the user around.

Do you still want us to provide you with some Procmon logs? Keep in mind the issue does not occur during boot up. Any help you can provide would be greatly appreciated.

As another clue, I believe the issue may have re-occured directly after an definitions update.

Hope to hear soon

 

I can now confirm this issue only occurs after a definitions update.

Suspecting this, I set the users automatic update schedule to only occur once a week on Wednesday mornings. We then had a week free of errors until the next scheduled update when it happened again.

Given that the update schedule used to be once every hour, and the issue would only occur intermittently once every few days, it would seem that only some definition updates cause the problem and not all.

Can anyone please assist?

 

Please contact customer care and provide them with the following stuff which should suffice for issue replication:
- the *.dat files from the ESET install folder
- the content of ""%ALLUSERSPROFILE%\Application Data\ESET\ESET NOD32 Antivirus\Updfiles" folder