Author Topic: Endpoint Protection Suite shutdown server without permission  (Read 4720 times)

0 Members and 1 Guest are viewing this topic.

Masejoer

  • Guest
We had an incident where EPS shut down the server after a scan. Reviewing the settings, the scan is NOT setup to shutdown on scan completion. I have submitted logs to a ticket as requested but I have not heard back. I don't see anything useful in any of the logs.

Has anyone ever experienced something like this? This is about as bad as an application can do - shutting down a critical server. It is NOT setup to shutdown after a quick or full scan, yet it did it anyway.

Ideas?



Log Name:      System
Source:        USER32
Date:          5/31/2013 4:09:10 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      SERVERNAME
Description:
The process C:\Program Files\AVAST Software\Avast Business\AvastSvc.exe (DP-SQL01) has initiated the shutdown of computer SERVERNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: Legacy API shutdown
 Reason Code: 0x80070000
 Shutdown Type: shutdown
 Comment: avast! Antivirus - scan complete

Masejoer

  • Guest
Re: Endpoint Protection Suite shutdown server without permission
« Reply #1 on: June 01, 2013, 09:15:20 AM »
We are having more incidents now. 4 more servers are experiencing this same behavior. The only change has been the nightly updates. Has a broken update been released?!

Masejoer

  • Guest
Re: Endpoint Protection Suite shutdown server without permission
« Reply #2 on: June 02, 2013, 11:19:09 PM »
Avast is no longer following the scheduled update rules. I removed the quick scan and setup a weekly full scan on Fridays. After the last incident, avast was removed from most servers. Two still had it installed, which scanned at 12AM on Sunday, and shut the servers down.  On bootup, I verified that these are still setup for a single Friday scan and nothing more.

Avast EPS is BROKEN.

Offline claudiuc

  • avast! Security Expert
  • Avast Reseller
  • Sr. Member
  • *
  • Posts: 282
  • www.avastantivirus.ro
    • www.avastantivirus.ro
Re: Endpoint Protection Suite shutdown server without permission
« Reply #3 on: June 05, 2013, 12:02:09 AM »
Please open a ticket on support.avast.com
Claudiu C. - Easy Media
Avast & AVG Distributor Romania, Moldova, Hungary
https://www.avastantivirus.ro/