From time to time Windows Action Center (Windows 7) tells me Shavlik Protect definitions are out of date and prompts me to click the prompt to initiate an update. Clicking the prompt brings up a dialog:

Title: Action Center

Heading: This program will not run

Message: Windows did not trust this program because its identity can't be verified

Around the 'net there are others reporting similar issues with security software, and the solution is usually to manually uninstall the software and reinstall it, but this isn't working with Shavlik Protect.tes

I can still run the updates from inside the Shavlik interface, and the policy actions still appear to be working properly, so this isn't a really serious problem, but it's an annoyance, and something I'd like to understand the reason behind and hopefully a solution for.

I am running Shavlik Protect 9 update 1, though I've seen this issue for a couple months now.

Symptoms

• Scheduled Scan or Deployments fail.
• The following error may be seen in an event or within the scheduler.log from C:\Windows\Propatches\Scheduler on a target system:
  Error 10038: An operation was attempted on something that is not a socket.
• Within the ST.Protect.native log you may see an error such as the following:
  The service STSchedEx did not reach status Running within the specified time interval.
• You may see the following error message:
  The ST Remote Scheduler Service service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.

Cause

StSchedEx.exe is attempting to listen on something other than the port specified in Protect Tools > Options > Scheduling. This is related to a known issue in Protect 9.1.4334.0.

Resolution

This is a known issue that can occur in Protect 9.1.4334.0. This issue should be resolved in Protect 9.1, Patch 1 (9.1.4446.0).

Bug fix description from version history log/release notes of Patch 1:
Resolved an issue where STSchedEx would attempt to listen on an additional legacy port that is no longer being used. Will only attempt to open 5120 (default) and not open 5120 and 5121.

You can get the installer for Protect 9.1, Patch 1, here:

http://www.shavlik.com/downloads/protect/

Alternative Workaround:

Go into Protect, Tools > Options > Scheduling and set the scheduling method to use the Microsoft Scheduler. This alternate method of scheduling will use the Microsoft Task Scheduler as a workaround.

Affected Products

Shavlik Protect 9.1.4334.0

My shavlik database slammed up against it's limit on the sql server (again), so I went to try to clear out some of the results files. I went to results->"archive items" and tried to delete them but instead was greeted by this message which was after the "are you sure you want to delete prompt. I made it so that the shavlik database could grow without restriction to try to clear this out, but that didn't do anything.

The installed version is: Shavlik Protect Standard 9.1.0    Build: 4334

Hi,

I realise this is an old patch, but we've been having long term discussions with our DBAs, about whether the patch should be applied or not, if you don't have SQL reporting services, as it also updates SQLSERV.EXE

Does anyone have a recommendation.

Thanks

Hi

I get an error every time I try to "refresh files" from Shavlik Protect Server that stands in a secure zone.

I assume that this server will contact my other Shavlik Protect Server, that have access to internet!?

This is the error I get:

Error: File not downloaded: scriptcatalog.zip

Error reason: File 'C:\ProgramData\LANDesk\Shavlik Protect\Console\DataFiles\scriptcatalog.zip' failed signature check: http://x.x.x.x/shavlikdatafiles/scriptcatalog.zip

I found an fix for this, and it was to update root certificates, and I have done that, but I still got this error?

Anyone have any idea?

/StigS

Symptoms

When performing the installation of Shavlik Protect 9.1, Patch 1 (9.1.4446.0) you receive the following error:

Windows Installer - The upgrade patch cannot be installed by the Windows Installer service because the program to be upgraded may be missing, or the upgrade patch may update a different version of the program. Verify that the program to be upgraded exists on your computer and that you have the correct upgrade patch.

Cause

The improper installer package is being run on the system. Most likely you are attempting to use the patch installer (intended when you already have version 9.1 installed) on a system with Protect 9.0 installed.

Resolution

Use the correct installer package to update your current version of Protect. Below is a listing of the installer for Protect 9.1.4446.0 that should be used for the corresponding version of Protect:

Currently on 9.0.x - Use full 9.1.4446.0 Installer package (84MB), found here.

Currently on 9.1.4334.0 - Use 9.1.4446.0 Patch Installer (17MB), found here.

Affected Product(s)

Shavlik Protect 9.x

Purpose

The purpose of this document is to show how to perform a patch uninstall on multiple systems via the Shavlik Protect console.

Description

Below is an example of how to set up the uninstall of one patch for multiple machines when using Shavlik Protect. This example is using agentless scan and deployment features.

1) Scan any systems you wish to remove a patch from.

Generally it's best to ensure you run a new scan so you have the most current assessment result available.

2) View the scan result.

You can also get to a scan result if you already have one by clicking the left drop down menu, and choose 'Results'.

3) In the scan result:

    1. Choose the machines you want to uninstall a patch from in the upper (Machines) pane. You can use CTRL + click or CTRL+Shift to select highlight multiple machines.

    2. In the lower pane (Patches), select any patch you wish to uninstall. Patches with an orange U and 'Yes' in the 'Uninstallable' column can be uninstalled via Protect. You can see      how many machines currently have the patch installed viewing the 'Affected Machine Count' column.

    3. Right click on the highlighted patch, and choose 'Uninstall Select'.

    Note: Only one patch can be uninstalled from each system on a single deployment, and a reboot is required to complete the uninstall process.

4) You'll be prompted with the 'Deployment Configuration' window.

You can use an existing deployment template, or create a new one. For patch uninstall it's recommended to use a deployment template that has a post-deployment reboot enabled since the uninstall process will require a reboot to complete. You can also change the time of the deployment to take place immediately (default), scheduled at a certain date/time, or perform the uninstall at the target system's next reboot.

Under 'Patches to be deployed by machine' you can see a list of which machines will have the uninstall performed and whatever patch will be uninstalled from each system.

Additional Information

More information about uninstalling patches can be found here:

Protect Help - How to Uninstall Patches

Microsoft Documentation - Removing Patches

Affected Product(s)

Shavlik Protect, All Versions

I'm having this error on one 2008R2 server. I can install the agent but they won't communicate.  I've done the "full agent reinstallation" process and this didn't fix my problem.  I tried the MS fixit tools but they won't run on my machine..Anything else I can try?  attached are my log files.

Purpose

The purpose of this article is provide customers a method to uninstall MS14-045 (2982791) before installing 2993651.  Guidance on whether you need to uninstall 2982791 before installing 2993651 can be found in the Update FAQ on the Microsoft website.

Resolution

The Custom Action feature will allow you to uninstall 2982791 on your target machines.  A restart is required to fully uninstall the patch therefore we suggest allowing a restart before installing 2993651.

Follow this guide:Custom Action - How to perform a custom action complete tutorial and use the following uninstall batch files.  You will need to create 4 separate Custom Action Deployment Templates if you have to uninstall the patch from all supported OSs.

Windows 2003:

Use W2003.zip attached to this document.

Vista and Windows 2008:

Use Vista200864bit.zip or Vista200832bit.zip attached to this document.

Windows 7 - Windows 8 - Windows 8.1 - Windows 2008R2 - Server 2012 - Server 2012R2:

Use the W7W8W12.zip attached to this document.

Additional Information:

Included is a screenshot with a typical Deployment Template configuration:

Hi,

I'm trying to upgrade to Protect 9.1.4334 (Windows 8.1) from Protect 9.0.0 Build 1182 (MS Server 2003 R2)

I installed ProtectBackup 9.0.1280 and successfully backed up the Console and the User data.

On the new Windows 8.1 install I installed Protect 9.1.4334 and then tried to install ProtectBackup on this system.

It failed to install with the message "WARNING: You must have Protect 9.0.1182 or later installed to use this tool" - I have already installed 9.1.4334!

I edited the install script to work with the installed version and it appeared to install but the ST.Backup.Protect.UI.exe doesn't run.

Can you help?

Regards,

Steve

Symptoms

You may see a pop-up error:

Protect Setup:

Error 1603: A fatal error occurred during installation

Error 1605: This action is only valid for products that are currently installed.

Error 1612: The installation source for this product is not available. Verify that the source exists and that you can access it.

You may see a message that says "protectinstaller.msi was not found".

Purpose

This article provides information on manually un-installing Shavlik Protect. This document is generally meant for the purpose of cleaning up a bad or broken installation of the Protect application.

Cause

Occasionally, the application may not be removed completely due corruption to the Windows Installer, Installer folder or other corruption to the automated uninstall process. When this occurs a manual un-install of the application is necessary.

Resolution

You may need to use the steps below to perform a manual uninstall of the application, and then re-install as necessary.

Microsoft provides assistance with the manual uninstall process by providing a Fix it tool.  The link to the tool is:  http://support.microsoft.com/mats/Program_Install_and_Uninstall

Here are instructions on how to use the Fix it tool

1. Use the link above to navigate to the Fix it main page.
2. Click on ‘Run Now’ and choose ‘Save File’.
3. Run the EXE that is downloaded and choose ‘Accept’ on the first page.
4. Choose the second option ‘Detect problems and let me select the fixes to apply’.
5. Choose the ‘Uninstalling’ option
6. You will see a list of the installed products on the server.  Choose the product if you see it on the list for instance. ‘Shavlik Protect’.  If you do not see the product on the list then select ‘Not listed’.

If Shavlik Protect, vCenter Protect, or Netchk Protect is listed:

1. Choose the corresponding name and click ‘Next’.
2. Choose ‘Yes, try uninstall’
3. Verify both options are check-marked and click ‘Next’.
4. You should see a screen that indicates whether Protect was uninstalled or not.
5. Click ‘Next’ and the close out of the screen.

If Shavlik Protect, vCenter Protect, or Netchk Protect is Not Listed:

1. Choose ‘Not Listed’ and click ‘Next’.
2. Enter the product code for the version of the Product installed and click ‘Next’. (Include the brackets)

     Product codes for Protect are listed below.

1. Verify both options are check-marked and click ‘Next’.
2. You should see a screen where it indicates whether the product was uninstalled or not.
3. Click ‘Next’ and the close out of the screen.

Product GUID codes:

Make sure to use the corresponding GUID for the version of Protect you are attempting to uninstall.

Protect 7.0.832.0: {C6D1AE7C-DE93-4E93-A916-C4144525C82C}

Protect 7.0.841.0: {C6D1AE7C-DE93-4E93-A916-C4144525C82C}

Protect 7.1.410.0: {90047C28-0B1B-4B30-8177-50729907EBF2}

Protect 7.2.155.0: {9B7F1E45-4C47-4E25-9EAB-098923E4171C}

Protect 7.5.2716.0: {CEA2D643-08C0-422E-9B27-B58ED9D38D07}

Protect 7.6.1482.0: {661A3308-5BE2-4E0F-A752-BDDB247DD2DB}

Protect 7.8.1340.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 7.8.1388.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 7.8.1392.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 8.0.3756.0: {F77AFB04-D13F-48DA-BB99-A5B31B6AAE0B}

Protect 8.0.3965.1: {5A696B05-9F06-4B3D-83A0-69E848EFAC4A}

Protect 8.0.4027.2: {5A696B05-9F06-4B3D-83A0-69E848EFAC4A}

Protect 9.0.1106.0: {8045AD29-C6A4-43F5-9F1F-9560EB09F99A}

Protect 9.0.1182.0: {070964CB-00B0-4E36-A3F6-A09F76FBD197}

Protect 9.1.4334.0: {83593D3F-ADD7-491B-82EC-1A2E6D08C385}

ScriptLogic Patch Authority Ultimate 8.0.3756: {A8210996-CD25-4C8C-A2D7-207635DEDC28}

ScriptLogic Patch Authority Ultimate 8.0.4027: {86DE6110-3F1C-40EE-98D9-05CD7A4B212F}

ScriptLogic Patch Authority Ultimate 9.0.1182: {0EAD1B8A-6F58-2304-A817-34C1724CE04C}

At this point, install the latest version of Protect.

If you continue to encounter any install errors, contact Shavlik support. (http://www.shavlik.com/support/contact/)

If the Fixit tool fails to correct the error, you may need to manually delete an upgrade key located under HKEY_CLASSES_ROOT\Installer\UpgradeCodes in the registry. Then try reinstalling Protect with the latest installer.

Notes

Latest versions of Protect can be downloaded from: http://www.shavlik.com/downloads/

It is highly recommended to perform a backup of the registry before performing any modifications.

How to backup Windows Registry:  http://windows.microsoft.com/en-US/windows-vista/Back-up-the-registry

Impact / Risks

The Fixit utility is provided by Microsoft. Make sure you read any known issues or guidelines for this tool on Microsoft's site prior to use.

Affected Product(s)

Shavlik NetChk Protect 7.x
VMware vCenter Protect 8.x

Shavlik Protect 9.x

The purpose of this document is to help to prepare a current Protect console and database for upgrade to a newer version of Protect, and also to provide some information about how to resolve common upgrade issues.

Preparing for Upgrade of Protect

Most issues with upgrading Protect can be avoided by ensuring that you are meeting system requirements and that proper database maintenance has been performed prior to upgrade. The list below can be used as a guide to ensure you have a successful upgrade:

• Review the System Requirements for the version of Protect you plan to install.
  Refer to the document - Shavlik Protect Requirements Guide
• Review the Shavlik Protect Upgrade Guide.
• Prior to upgrade, it is recommended that you clean out as much old results as possible and perform database maintenance.
  This document covers the full steps for database maintenance: DOC-23430
• The user who will perform the upgrade of the database should either be the SA for the database in SQL, or the user should at least have the following privileges for the Protect database:
  Privileges required for upgrade purposes: db_securityadmin, db_ddladmin
  Privileges required for all Protect users: STExec, DB_DataReader, DB_DataWriter
• If your Protect database is hosted on SQL 2005, review the document; Authentication Limitation with Protect 9.0+ and SQL 2005.
• If you plan to move/migrate your console to a different system, review the document; Migrate Shavlik Protect Console.
  • There is a Migration Tool that can be used in some scenarios to move the console. Make sure to closely follow the Guide for this.

Resolving Common Upgrade or Post-Upgrade Issues

If you do have an issue during the upgrade process, it's possible the issue can be resolved based on some common issues listed below:

Upgrade/Install Failure

• Error: "Installation Failed.  A data conversion error has been detected during the database upgrade process."
• Resolving database upgrade timeout failures for Shavlik Protect
• Upgrading Protect fails with the error: Cannot create a new Service Broker in a mirrored database
• Upgrade to v9.x fails with error "Protect bootstrapper has stopped working"
• Upgrade\Installation Error, Background Intelligent Transfer Service (BITS) is disabled
• Failed to commit or save the database installation. Invalid License
• Upgrade - Error - Data Conversion Error - EventSubscription
• Shavlik Protect Install/Uninstall Issues
• Upgrade to version 9 Fails with error 'This installation package could not be opened.'
• How to clean up broken installs of Shavlik Protect with the Microsoft Fixit Tool
  • Applies when seeing installer errors 1603, 1605, and 1612.

  Post-Upgrade 

• Scheduled Jobs Missing from Scheduled Task Manager in Protect Console
• Scheduled Task Manager pops Error: -2080374779 - Upgrade scheduler now
• It is worth noting that the Agent Manager has been removed in version 9. All functionality is available from within Machine View.
  • You can see the full list of changes in each build, here.

What to do if you face an upgrade failure you cannot resolve

If you receive an upgrade or installation failure, and you are not able to use the above resources to resolve the issue it's time to open a support case.

• Contact Support with one of the following methods:
  • Support Portal: https://support.shavlik.com/
  • Other contact methods: http://www.shavlik.com/support/contact/
• If possible please provide the following information:
  • Console Logs
  • Installation Logs
  • Any applicable screenshots
  • Operating system of the console system and version of SQL used to host Protect database

Shavlik Protect 9.x

vCenter Protect 8.x

This is a list of highly recommended documents for improving general knowledge of the Shavlik Protect product. This article is not a comprehensive list of documents.

For the Shavik Protect 9.1 specific landing page, please see document DOC-23514.

• Download Site
• Protect 9.1 Installation Guide
• Protect 9.1 Upgrade Guide
• Protect 9.1 Online Help
• Shavlik Protect Requirements Guide
• Firewall & Proxy Exception White-List
• Installing Prerequisite Software

• How to Activate Shavlik Protect
• Managing License Seat Usage
• Offline Activation Process
• Sales/Licensing Contact Information

• Best Practices Guide (9.1)
• Best Practices: Java Deployment
• Best Practices: Software Distribution
• Best Practices: Agentless Scanning & Deployment of Service Packs
• Best Practices: Using Security Tools
• Best Practices and FAQ on using Threat protection with Shavlik Protect agents
• How To Configure Windows Firewall for Protect
• How to Create a Custom Patch
• How to manage Shavlik in an Offline network
  • Offline Environment: How To Manually Update patch data files
  • Offline Environment: How to Manually Update threat definitions

Installation & Upgrade

• Preparing for Upgrade of Protect and Resolving Common Upgrade Issues
• Data Conversion error during Upgrade
• Cleaning up broken installs of Protect
• Resolving database upgrade timeout failures

Obtaining Trace Logs

• Console, Client Side (agentless), and Agent log files
• Console Install and Setup Logs
• DPD Trace (for scan detection issues)
• Listing & Purpose of All Log Files

Scanning & Detection

• Troubleshooting Patch Scan Error Codes
• Scans running slow or taking long time to complete
• Scan Results fail to import (Incomplete results)
• Why Shavlik Protect scan results may differ from Windows Update
• Java patches not shown missing or installed
• How to include or exclude specific patches in scan
• Adobe & Mozilla Incremental Updating process
• Patch install/uninstall loops (patches that always show missing)

Patch Deployment & Shavlik Scheduler

• Deployed patches appear as missing
• Deployment Tracker Status Message Values
• How to Troubleshoot A Failed Patch Install
• Service Pack Deployment Guidelines
• Reinstalling the Shavlik Remote Scheduler Service

Database Related

• SQL Database Maintenance Recommendations for Protect
• Cleaning up (purging) a Protect Database
• Increasing database timeout period
• Moving/migrating Protect database

Agents

• Agent Diagnosis Commands
• Agent Install failing at 67% (registration failure)
• How to fully uninstall and reinstall an agent

Other

• Issues adding machines to a group via Active Directory/OU
• Verifying Proxy Settings for Download Issues
• Role Based Administration Lockout Fix
• Understanding the Machine Groups and the Machines View

• XML (Patch Definitions) Update Information
• List of Currently Supported Products
• Feature or Change Requests

Dear Shavlik,

I got an email a month or so ago about an update of Shavlik Protect 9.1--so I recall! Sadly, I misplaced the email. I have spent the last 30 minutes looking for the dang download file for the Shavlik update.

Where is it? I could find no reference to it on the Support page or in my Shavlik console. It should not be this hard!

BTW, the "Check for Program Updates" option on my Shavlik Protect does not find updates. It says there are none available.

Did I misread the email?

Thanks for listening.

Dharmatma

Hello, I am evaluating Shavlik Protect 9.1 for patch management purpose.Can distributed console and distribution server be hosted on one workstation ?

Scenario

I have two sites, Site A and Site B. On Site A Central Console  will be hosted and patches will be deployed on10 client machines.

Similarly on Site B Distributed Console and Distribution server will be hosted on one work station and patches will be deployed on 10 client machines.

Is there any document on how to install  and configure Distributed Console and Distribution Server ?

Is license seprate for Console and workstations ??

Thanks & Regards

Suhas

For Chrome that is pushed out to machines, the Asset Scan list values that are 65.x or 66.x and yes this is the value listed in the Control Panel  Programs listing.

Is there anyway to have the version reported in the Asset Scan to be the version that you use for checking in the Patch Scan?  Here is what the Patch Information tells me:

File version is less than expected:

C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\CHROME.DLL

37.0.2062.103 < 37.0.2062.120

I ask this because it is confusing to try to figure out how to convert the 65.x or 66.x back to the 36.x or 37.x to assure management that the machine has been patched.

support.microsoft.com/kb/2775511 says that the hotfix rollup has three regressions.  What I'm seeing is that after applying the rollup, I have to re-apply windows6.1-kb2878378-v[2,3,4]-x64.msu before Protect says I'm up to date (Windows 7, 64-bit).  Problem is, Protect sees these regressions one at a time and wants a reboot after each one.  Is there any way you could detect all 3 regressions in a single scan?

(please excuse if this is a double post, it appears my first post disappeared)

We run shavlik on several hundred servers.  We've noticed on a small handful that scans are coming back saying no missing patches, but on closer examiniation, there have been no patches installed for over a year on windows 2008r2.  the process is automated, so this issue didnt come up until we audited the machines.  These servers can be in the same scan group as servers which are being patched correctly - same result if i create an ad hoc group or change from security scan to WU scan.  Could there be some sort of per-server exlusion that someone set up a long time ago?  No agents being used.

Any help is appreciated, i'm not even sure how to search for this issue in the KB.

Thanks,

Matt

I have recently replaced the my old laptop with a new laptop (different name, same IP) and getting this error.

Thank you,
Joe

Symptoms

You add exceptions via the agent policy, but when viewing the Agent UI on one of the client systems you don't see the exception listed in the Always Allow or Never Allow sections.

Example:

Policy exception:

Agent UI - Always Allow tab:

Cause & Resolution

This is the expected behavior. The 'Always Allow' or 'Never Allow' tabs in the Agent UI are currently intended to only show exceptions for each individual agent that have been set via the agent using the 'Add..." function on each tab.

If you would like to see this behavior changed in any way, please submit a feature/change request at our Feature Request Site.

Affected Product(s)

Shavlik Protect, All Versions