Error after upgrade from 2019.4 HF5 to 2020.2 HF1

Question

We've completed the upgrade from 2019.4 HF5 to 2020.2 HF1 but are getting errors on startup, seemingly having to do with the component involved in the vunerability:

ERROR SolarWinds.Orion.Common.SWEventLogging - Unhandled Exception caught in NPM Service Engine startup. Could not load file or assembly 'SolarWinds.Orion.Core.BusinessLayer, Version=2020.2.15300.12766, Culture=neutral, PublicKeyToken=null' or one of its dependencies. The system cannot find the file specified.2020-12-14 17:19:20,229 [14] FATAL SolarWinds.NPM.BusinessLayer.NPMBusinessLayerPlugin - Unhandled Exception caught in plugin startup.System.IO.FileNotFoundException: Could not load file or assembly 'SolarWinds.Orion.Core.BusinessLayer, Version=2020.2.15300.12766, Culture=neutral, PublicKeyToken=null' or one of its dependencies. The system cannot find the file specified.

Is this DLL also part of the unaffected installation?  Could our AV software be removing it incorrectly?  Any other ideas?

We have a support case opened but they are backlogged and telling us to just wait for HF2.

rvandolson · Answer

Thanks.  As an fyi, an uninstall and reinstall seems to have populated the needed components which pass security scans.  With that said, I suspect HF2 will drop any minute now.

ouberlord · Answer

That's what's been said, but it remains to be seen.

Either way, that DLL in question is the one known to be compromised.  I would not advise anyone to try to manually put it in place.  If you've already upgraded, you might be stuck until HF2 is released.

rvandolson · Answer

Update:

We found that C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll is missing and speculate that our AV software nuked it pre-upgrade and the upgrade process doesn't bother to upgrade files that aren't present?  Working theory anyway.

Trying to figure out if we can extract the DLL from the installer MSI and place manually or do a side by side install and copy from there.  Offline installer won't run now (says has already been run).

Other ideas?