Endpoint offline with agent version 1.2.0.1089 in Nebula

Issue

Endpoints running Agent version 1.2.0.1089 may appear offline in the console. 

Environments

• Windows
• Nebula

Cause

On January 23, 2024, we released Agent version 1.2.0.1089. This version prevented our software from launching when a specific file was missing on the endpoint.

Verify affected endpoints

Confirm which endpoints are affected by this issue with one of the following methods:

• Check Nebula for offline endpoints running Agent version 1.2.0.1089.
  1. In Nebula, go to Manage > Endpoints.
  2. Filter the Agent version column for version 1.2.0.1089
     Note: If you cannot locate the column, click Add / Remove Columns on the top-right and check the checkbox for Agent version. 
  3. Look for endpoints that display offline with the gray dot indicator even though you know they are online.
• Check the endpoint agent logs on the local machine for an error.
  1. On the affected machine, open C:\ProgramData\Malwarebytes Endpoint Agent\Logs\EndpointAgent.txt
  2. Search for the string Version=3.0.7.0
  3. If you locate the following message, the endpoint is affected by the issue.

     • ERROR EAEngine Error in Initialize 
       System.IO.FileLoadException: Could not load file or assembly 'Quartz, Version=3.0.7.0, Culture=neutral, PublicKeyToken=f6b8c98a402cc8a4' or one of its dependencies. Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Exception from HRESULT: 0x80070241) 
       File name: 'Quartz, Version=3.0.7.0, Culture=neutral, PublicKeyToken=f6b8c98a402cc8a4'

Resolution

We released a hotfix on February 13, 2024. To install this hotfix, you must delete a file with PowerShell and reboot the affected machines. These steps can be scripted to easily fix multiple machines at once.

1. On the affected machine, go to the start menu and search for Windows PowerShell.
2. Click on it to launch Windows PowerShell.
3. Copy and enter each command individually:

   • [System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a") 

   • $publish = New-Object System.EnterpriseServices.Internal.Publish

   • $publish.GacRemove("C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Quartz\v4.0_3.0.7.0__f6b8c98a402cc8a4\Quartz.dll")

4. Reboot the endpoint.

After the reboot, the endpoint will automatically update to Agent version 1.2.0.1096. If the endpoint continues to remain offline or won't update, contact Support.