ESET update failed with error 0x1106: modules and detection engine stall

Fix it now

ESET’s own wording for this is “Undocumented serious error (0x1106)”, and that is literal: ESET publishes no meaning for the number. What it does publish is an ordered troubleshooting sequence for a failed module update, and the first step is to upgrade to the current version of the product.

1. Open Help and support, then About, note the version, and install the current build of your ESET product over the top if you are behind.
2. Check free space. ESET asks for at least 1 GB free on the drive the product is installed on.
3. Confirm the subscription is valid and not expired. An update will fail if the product is not activated by an activation key.
4. Clear the update cache: press F5 for Advanced setup, open Updates, choose Clear, then OK, and restart the computer.
5. Remove any previously installed antivirus, and exclude ESET from any third-party firewall that is running.
6. Turn the proxy off for updates: Advanced setup, Updates, Profiles, Updates, Connection options, then Do not use proxy server.
7. Test the path with ping update.eset.com in a Command Prompt, then run Update from the main window and read what it returns.

ESET’s sequence expects you to re-check for a successful update after each step rather than doing all of them and hoping. Stop at the first one that works.

If modules download and the detection engine date moves, you are done. If not, the next section explains what an update actually consists of and where it can stall.

Why it happens

An ESET module update is not one file. The product fetches signed components – the detection engine, scanner modules, the cleaner – and applies them to what is already on disk. The interface reports the outcome as a single line, which is why a transport problem, a disk problem and an expired subscription all arrive looking identical.

0x1106 and 0x101a are the two numbers people see most often against that line, and ESET’s message for both literally says “Undocumented serious error”. That is not a translation quirk. ESET’s published troubleshooting for the modules-update failure does not name either number, so any page that tells you 0x1106 specifically means an end-of-life build, a broken certificate chain or a retired endpoint is inventing a meaning. Work the documented sequence instead, which is short and gets there.

The one companion code with a published meaning is 12038, and it is worth recognising because it changes what you do. Microsoft publishes it as ERROR_INTERNET_SEC_CERT_CN_INVALID: the SSL certificate’s common name does not match the host that was asked for. On a filtered corporate network that is the fingerprint of an appliance re-signing traffic in the middle, and no amount of cache clearing on the client will move it.

Full reference

ESET’s documented order of checks

This is the sequence ESET publishes for the modules-update failure, in its order. The order matters: several of the steps are quick and rule out the expensive ones.

Clearing the update cache without guessing

1. Press F5 in the ESET main window to open Advanced setup.
2. Open Updates.
3. Choose Clear, then OK.
4. Restart the computer.
5. Run a manual update check from the main window and read the result.

ESET publishes the same cache-clear sequence for the General Compiler Error message that can appear after a version upgrade. If you have both messages, you have one cause.

Reading the companion codes

The asymmetry there is the useful part. Three of the four numbers tell you nothing you can act on, and the fourth tells you exactly where to look. If 12038 appears, stop working on ESET and start working on the network path, because the client is being handed a certificate for a host it did not ask for.

What an out-of-date detection engine actually costs you

The product keeps working with the modules it already has, so the interface can look healthy while the engine ages. That is worth being precise about rather than dramatic: existing detections still fire, and anything relying on cloud lookups still works while the machine is online. What stops is the arrival of new local detection. The gap widens every day the update fails, which makes this a job for this week rather than this hour, but it is a job.

A custom update server that no longer exists

Machines set up in an office that once ran a local mirror can still be pointed at it. Check Advanced setup, Updates for a custom update server, and set it back to the automatic choice unless you know the mirror is still running. This is not in ESET’s published sequence because it is not common, but it produces a permanent, repeating failure that survives every other step, and it takes ten seconds to rule out.

Ruling out the cheap causes first

• Confirm the failure survives a reboot. A single failed update after a sleep or a dropped connection is not a fault.
• Confirm it survives a cache clear, because that is the cheapest real fix.
• Try the machine on a different network before blaming the build. Hotel, guest and heavily filtered networks produce this reliably.
• Check the clock and time zone. Certificate validation depends on the time being roughly right, and a machine that has been off for a year will fail every secure connection it attempts.
• Read the subscription date. An expired subscription is the most common cause that looks like a technical fault.

Every code this article covers

Confirm the fix worked

1. Update from the ESET main window reports the modules as updated rather than failing.
2. Help and support, then About shows a current detection engine version and date.
3. The product version shown matches the build you installed.
4. ping update.eset.com returns replies from the machine that was failing.
5. Reboot and run Update once more, so you know it works unattended rather than only after a cache clear.

Questions people ask about this