Endpoint Protection Suite shutdown server without permission

[Masejoer]

We had an incident where EPS shut down the server after a scan. Reviewing the settings, the scan is NOT setup to shutdown on scan completion. I have submitted logs to a ticket as requested but I have not heard back. I don't see anything useful in any of the logs.

Has anyone ever experienced something like this? This is about as bad as an application can do - shutting down a critical server. It is NOT setup to shutdown after a quick or full scan, yet it did it anyway.

Ideas?



Log Name:      System
Source:        USER32
Date:          5/31/2013 4:09:10 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      SERVERNAME
Description:
The process C:\Program Files\AVAST Software\Avast Business\AvastSvc.exe (DP-SQL01) has initiated the shutdown of computer SERVERNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
 Reason Code: 0x80070000
 Shutdown Type: shutdown
 Comment: avast! Antivirus - scan complete

[Masejoer]

We are having more incidents now. 4 more servers are experiencing this same behavior. The only change has been the nightly updates. Has a broken update been released?!

[Masejoer]

Avast is no longer following the scheduled update rules. I removed the quick scan and setup a weekly full scan on Fridays. After the last incident, avast was removed from most servers. Two still had it installed, which scanned at 12AM on Sunday, and shut the servers down.  On bootup, I verified that these are still setup for a single Friday scan and nothing more.

Avast EPS is BROKEN.

[claudiuc]

Please open a ticket on support.avast.com