Upgrading EDR 4.1 requires a reboot as part of the install or upgrade process

Technical Articles ID: KB96049
Last Modified: 2023-06-13 07:08:22 Etc/GMT

Environment

Endpoint Detection and Response (EDR) 4.1.x
Endpoint Protection Platform

NOTES:

MVISION Endpoint was rebranded to Endpoint Protection Platform in the 2210 release.
MVISION EDR was rebranded to EDR in version 4.1.

Summary

Recent updates to this article

Date	Update
June 13, 2023	Added KB96542 to the "Related Information" section.

When upgrading the Endpoint Protection Platform or EDR software on a Windows endpoint, the install or upgrade fails with errors simliar to the message below.

MVISION_EDR_<date_time_stamp>_000_mvedr_installer_x64.log

CheckCairoInjection: (2310:24A4)(2023-05-24T15:04:16.992) RunCustomAction: Error 0x80070643: Failed to run custom action: CheckCairoInjection : Fatal error during installation.
MSI (s) (48!A4) [15:04:16:992]: Note: 1: 2205 2: 3: Error
MSI (s) (48!A4) [15:04:16:992]: Note: 1: 2228 2: 3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709
MSI (s) (48!A4) [15:04:16:992]: Product: Trellix Endpoint Detection and Response -- Prerequisites check failure: Check Cairo Injection found a condition whereby hookcore DLL requires patching and requires a reboot.

Prerequisites check failure: Check Cairo Injection found a condition whereby hookcore DLL requires patching and requires a reboot.
CustomAction CheckCairoInjection returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 15:04:16: CheckCairoInjection. Return value 3.
Action ended 15:04:16: INSTALL. Return value 3.

Problem

When you install or upgrade Endpoint Protection Platform, or upgrade the EDR Client on a Windows endpoint, the installation or upgrade fails. The product isn't installed or upgraded.

In this case, the endpoint needs to be rebooted and the install/upgrade needs to be retriggered.

Cause

NOTE: SysCore is also known and referred to as MPT in Trellix products and documentation. SysCore describes a shared technology of drivers and libraries used by Trellix products to interact with the operating system and other applications.

When you upgrade or install the EDR Client, if SysCore versions 22.2 or 22.4 are installed, they must be patched. A reboot is needed to upgrade SysCore before you can continue with the update or installation of a Trellix product that requires a newer SysCore version.

The patching of SysCore 22.02 and 22.04 is needed to prevent the EDR client-injected processes from causing CPU issues during uninjection resulting from a SysCore upgrade. This issue is only seen when EDR is present on the endpoint.

Solution

On install/upgrade, the affected products update the endpoint and close the installation or upgrade. The product then notifies the ePolicy Orchestrator (ePO) administrator through a pending reboot message in ePO. After you reboot the endpoint, you can restart the install or upgrade.

IMPORTANT: On upgrade termination, EDR or Endpoint Protection Platform continue to function as normal. But, we recommend that you reboot the endpoint at the earliest available opportunity.

Related Information

KB96542 - Upgrading from the ENS 10.7 June 2022 release requires a reboot if EDR 4.x is also installed and enabled

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Upgrading EDR 4.1 requires a reboot as part of the install or upgrade process

Environment

Summary

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Upgrading EDR 4.1 requires a reboot as part of the install or upgrade process

Environment

Summary

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title