Possible conflict between Malwarebytes and Avast

[exile360]

Thank you for this information.  I will notify the Malwarebytes team and hopefully they will contact you to get this issue resolved on Malwarebytes' end of things.

[1776blues]

48 minutes ago, Zdenal said:

Hallo, 

I'm responsible for Real Site protection in the Avast product. I have tested both products several minutes ago, and problem is only in MalwareBytes Web Protection activation process. It hangs the MB product completely.

If I disable Real Site, enable MB WebProterction and then enable Real Site again, everything works well.

 

Some more technical pieces of information:

Malware Bytes is trying to filter the UDP traffic (probbably DNS). It's same as Real site does. If two products try to capture UDP traffic by Windows WFP technology, a UDP packet loop can occurs if it's not implemented correctly. We found this problem with several other products. It's caused by two WFP drivers, when each capture UDP packet generated by other, drop it and generate new one. But this new one is presented to first driver, captured, dropped, generated again and it can continue indefinitely. 

We discussed the problem with Microsoft WFP developers, to try to find solution for the problem. Avast had some protection against this before, but it doesn't work every time. Then we implemented new solution recommended by Microsoft. I can see from driver debugging, that it works, when both components are active (as described above). Problem is just in WebProtection activation process (not under my control, no time for reverse engineering).
Seems that the MB UDP filtering solution is not compatible with MS recommended solution, but anyway, if you use capture, drop, create and inject new packet scenario for the UDP traffic, it's completely wrong and can cause conflicts with many products.

 

I'll appreciate if an responsible WFP developer contact us. I'll be happy to explain to him how to to solve the problem. 

Best regards

Zdenek

Currently I have Real Time and Web Protection disabled  and just  turned on Do Not Disturb after reading your post. I repaired Avast as well.

I had no issues while all three were disabled Question; I read that old files in Avast were not being removed when the program updated, is this still the case. I posted 4 screenshots on Avast and wonder if the two files dated last year could be the problem? See my post above and click on this title; Avast Blocking Access to Internet After Update 

[Zdenal]

@1776blues Problem what you mention with bad file versions is not a cause of the malwarebytes iterop problems. It's something different. If you are affected by this issue, no internet browsing works with AVAST and WebShield enabled.  It's not this case. Preblem here is just in MalwareBytes  WebProtection and RealSite interop.

 

[Zdenal]

1 hour ago, 1776blues said:

Currently I have Real Time and Web Protection disabled  and just  turned on Do Not Disturb after reading your post. I repaired Avast as well.

I had no issues while all three were disabled Question; I read that old files in Avast were not being removed when the program updated, is this still the case. I posted 4 screenshots on Avast and wonder if the two files dated last year could be the problem? See my post above and click on this title; Avast Blocking Access to Internet After Update 

@1776blues Problem what you mention with bad file versions is not a cause of the malwarebytes iterop problems. It's something different. If you are affected by this issue, no internet browsing works with AVAST and WebShield enabled.  It's not this case. Preblem here is just in MalwareBytes  WebProtection and RealSite interop.

[Arnak]

Hi,

I finally have my pc running again. :)

I tried disabling some parts of Avast but that only helped part way, the final solution is to go into safe mode and uninstall Avast completely. :'(

So I,m just using Malwarebytes until Avast has a fix for this issue, then I will re-install.

Martin

[GaleStorm]

On 8/27/2018 at 6:12 AM, 1776blues said:

Zdenal: "If I disable Real Site, enable MB WebProtection and then enable Real Site again, everything works well."

Zdenal, by "everything" do you mean, in addition to M'bytes, the problems of frozen/hung computer, inability to access sites, inability to shut down computer correctly.  I have been struggling with this for a week now, following suggestions on Avast thread which have not helped.  I have now turned off MB Web Protection but do not like orange admonition.  I was ready to disable Avast RealSite Protection but will wait to hear from other users - unless my computer continues to freeze up every ten minutes.  It was also suggested to uninstall the Avast "do not disturb" module.  What do users think?  

dcollins:  your wife should forgive you - this is a noble cause.  

Please continue to follow up and keep us informed.  This is quite an awful problem.

Gale

[exile360]

Hello again everyone.  A new version has been released which may fix at least some if not all of these issues.  You can find out more here and you may install it by opening Malwarebytes and navigating to Settings>Application and clicking on the Install Application Updates button.  Once it installs successfully, I'd suggest restarting your system to ensure that the new updated modules are loaded into memory and then test to see if the issues persist or not.

[1776blues]

6 minutes ago, GaleStorm said:

Zdenal, by "everything" do you mean, in addition to M'bytes, the problems of frozen/hung computer, inability to access sites, inability to shut down computer correctly.  I have been struggling with this for a week now, following suggestions on Avast thread which have not helped.  I have now turned off MB Web Protection but do not like orange admonition.  I was ready to disable Avast RealSite Protection but will wait to hear from other users - unless my computer continues to freeze up every ten minutes.  It was also suggested to uninstall the Avast "do not disturb" module.  What do users think?  

dcollins:  your wife should forgive you - this is a noble cause.  

Please continue to follow up and keep us informed.  This is quite an awful problem.

Gale

Currently I have turned off Avast's Do not disturb and Real site as well as MWB's  Web protection, which has stopped the problems mentioned in this and other threads. This is extremely frustrating since I still have a year and 3 months left on my Avast subscription with my MWB renewal coming due in 10 days.

[1776blues]

7 minutes ago, exile360 said:

Hello again everyone.  A new version has been released which may fix at least some if not all of these issues.  You can find out more here and you may install it by opening Malwarebytes and navigating to Settings>Application and clicking on the Install Application Updates button.  Once it installs successfully, I'd suggest restarting your system to ensure that the new updated modules are loaded into memory and then test to see if the issues persist or not.

Thanks, I will as usual have to wait until I'm done doing normal everyday stuff! Once I have updated MWB I will monitor the program and post if it works or doesn't work.

[catscomputer]

On 8/30/2018 at 9:29 AM, 1776blues said:

Thanks, I will as usual have to wait until I'm done doing normal everyday stuff! Once I have updated MWB I will monitor the program and post if it works or doesn't work.

Any feedback about whether the latest MBAM version (1.0.441) fixes the conflict between MBAM & the latest programme update for avast?  I  have update MBAM (via install application updates) but don't wish to update avast until I have confirmation from someone that the issue as described by the original poster on this thread have been resolved. Would rather avoid the described workarounds if possible. Thanks.

Edited September 1, 2018 by catscomputer

[1776blues]

6 hours ago, catscomputer said:

Any feedback about whether the latest MBAM version (1.0.441) fixes the conflict between MBAM & the latest programme update for avast?  I  have update MBAM (via install application updates) but don't wish to update avast until I have confirmation from someone that the issue as described by the original poster on this thread have been resolved. Would rather avoid the described workarounds if possible. Thanks.

Apparently mine updated automatically, but I still have web protection off as well as the two Avast protections. It's late so I'll wait until later after I wake up to turn on at least web protection.

[GlennB]

Is there a list of exclusions to plug into MalwareBytes for Avast?

[AnotherConcernedCitizen]

The 1.0.441 component package update did NOT fix the MWB/Avast conflict for me. Back to disabling 'Real Site' for the time being.

[exile360]

Well that's a bummer, but thank you for letting us know.  I have reported this to Malwarebytes  Developers and QA team so hopefully they will find a fix for it.  I also informed them about what the Developer from Avast had to say regarding a fix for the Web Protection/WFP conflict and I believe they are going to reach out to Avast's Devs to get the info on the fix, so hopefully that will lead to a solution to this.

[bob3160]

Why do these things always seem to happen on a weekend ??? Hopefully, a fix will soon be coming it will make a lot of users of both products happy.

[exile360]

It's actually been going on for the last couple of weeks I believe, at least that's around the time the first reports of this issue started emerging here as I recall.  It started with the most recent Avast update I believe, however it is possible that the problem started before then but that Malwarebytes' role in the problem wasn't discovered yet so I'm not positive about the time frame, however it didn't just start happening with this last Malwarebytes update (at least the last 2 builds of Malwarebytes 3 are affected, and likely most of the builds prior to that).

[bob3160]

Since one of the developers from Avast has already reached out to developers of MWBAM, let's hope together they resolve the conflict quickly.

After all, Avast and Malwarebytes share many of the same customers.

[exile360]

Yep, I think so.  One of the folks from Malwarebytes already reached out to me almost immediately after submitting my report seeking to contact the Dev from Avast so I expect things to move pretty quickly once they get in touch assuming the solution works and isn't too complicated to implement (QA still has to test of course before it can get a release just to make sure there aren't any new bugs introduced by the changes).  I'm hoping this also resolves the seemingly similar conflict that currently exists with AVG but we'll have to wait and see until they have builds to test.

[bdubrow]

We have been working closely with Avast on this problem. They have discovered an issue with their driver implementation and are working on getting a fix released. They were not able to provide specific timing for this update yet. For any further details please reach out to Avast directly.

In the meantime, we continue to recommend disabling Avast's Real Site feature as the best work-around.

[GaleStorm]

Becky - I am monitoring this thread for updates, so thank you for this information.   

I turned off MB Web Protection.  MB Web Protection vs. Avast RealSite:  six of one/half-dozen of other?  or which is better to leave enabled?

Thanks to MB staff & experts for following up on this.  

[exile360]

My personal recommendation, at least if you are using Chrome (or any Chromium based browser such as SRWare Iron or Vivaldi) or Mozilla Firefox would be to install the Malwarebytes browser extension beta which is currently available for free.  It uses the same block database as Malwarebytes 3 and includes additional capabilities such as blocking of many ads and trackers to protect privacy and speed up browsing and also has behavioral blocking for tech support scam sites, phishing sites and clickbait sites/links/ads which Web Protection in Malwarebytes 3 does not have.  The only limitation is that the browser extension will only shield your web browser, not the entire system the way Web Protection in Malwarebytes 3 does.  Even if you keep Web Protection enabled you may still install the browser extension beta if you wish as the two were designed to work in tandem.

You can find more info and download links on the following pages:

Chrome
Firefox

[AnotherConcernedCitizen]

Vague, but Avast time frame is "sometime this week". 

https://forum.avast.com/index.php?topic=221518.msg1475035#msg1475035

[exile360]

Excellent, thanks for the update  

[bob3160]

On the Developers forum, we've been told that the update to fix the problem should be applied tomorrow between 9:00 AM and Noon.

[exile360]

12 minutes ago, bob3160 said:

On the Developers forum, we've been told that the update to fix the problem should be applied tomorrow between 9:00 AM and Noon.

Good, thanks for letting us know