Component Update 1.0.508 issue

[AnotherConcernedCitizen]

No specific mention of issues on the Avast forum, but the original announcement said "... The microfix is provided by the Avast Emergency Updater which is run automatically from task scheduler every 12 hours and a few minutes after system boot. "  Considering the number of reboots I've had since this MBAM update, had there been anything outstanding...

[dcollins]

Thanks for the information you've provided. We've been unable to replicate this issue so far, but we're still trying. The logs you've provided so far will help us in narrowing this down. For now, you should be able to disable just Web Protection inside of Malwarebytes rather than all of Malwarebytes so you can keep benefiting from the other levels of protection.

[exile360]

Just to add, you can at least somewhat supplement the protection provided by Web Protection by installing the Malwarebytes browser extension beta which is currently available for Chrome/Chromium browsers as well as Firefox:

Chrome
Firefox

Unlike Web Protection it only shields the browser from connecting to bad sites, not the entire system, so it's not quite as defensive, however it does have some advantages including the fact that it blocks ads, tracking servers as well as behaviorally blocking some threats like clickbait links/ads as well as tech support scam sites (in addition to the normal blacklisted sites that would be blocked by Web Protection).  It is also fully compatible with Web Protection, so once the issue is resolved you may keep the browser extension installed and continue to use it alongside Malwarebytes 3's Web Protection for additional security/safer browsing and it can even speed things up when Web Protection blocks sites since it works within the browser to make the blocks/redirects happen more quickly.

[AnotherConcernedCitizen]

Sorry. Had to keep 'the disruptive child' in time-out long enough to determine there were no other stability issues. Did I mention my continued health & well-being are contingent on this system's health & well-being? MBAM back in play, sans Web Protection ... with Process Explorer active just in case.

[Angelus]

I don't have Avast installed but I wonder if this has to do my issue I mentioned in my previous post  hmm

[AnotherConcernedCitizen]

39 minutes ago, Angelus said:

I don't have Avast installed but I wonder if this has to do my issue I mentioned in my previous post  hmm

AVG, perhaps? Avast bought them & by now, I suspect their code-bases may have a lot in common.

[dcollins]

Avast and AVG do have a lot in common. We are still working through both of your cases, and trying to see what we can reproduce.

Out of curiosity, when the system hard locks, can you clarify a few things please:

1. Does the mouse freeze as well?
2. Does the screen turn black?
3. If you let the system sit for awhile, does it unfreeze?

[Angelus]

Nope  was running MS essentials for a time but no longer just Malwarebytes by itself at the moment

[Angelus]

1 minute ago, dcollins said:

Avast and AVG do have a lot in common. We are still working through both of your cases, and trying to see what we can reproduce.

Out of curiosity, when the system hard locks, can you clarify a few things please:

1. Does the mouse freeze as well?
2. Does the screen turn black?
3. If you let the system sit for awhile, does it unfreeze?

 Yes the mouse freezes as well

No to the other two questions

 

I was going to install the application update just now and  disable web protection before it had a chance to freeze

see if it still froze. But it did not find the update 

 

I assume the update has been pulled while you solve this case. Since downgrading to the version without the update .. no freezes or lock ups

 

[dcollins]

Nope, the update has not been pulled. So far, we've only had three reports of this issue, which is why it's very strange. Note that if you downloaded the latest installer from the website, it already has this latest update bundled inside of it, so that could be why it's not finding anything. You can check your version under Settings -> About

[AnotherConcernedCitizen]

15 minutes ago, dcollins said:

Avast and AVG do have a lot in common. We are still working through both of your cases, and trying to see what we can reproduce.

Out of curiosity, when the system hard locks, can you clarify a few things please:

1. Does the mouse freeze as well?
2. Does the screen turn black?
3. If you let the system sit for awhile, does it unfreeze?

1. Does the mouse freeze as well?

Depends on the scenario.

- The initial lock-ups (both apps full ON), explorer.exe gradually became unresponsive... couldn't launch new apps, access Start Menu, etc. but mouse was still active.

- When I disabled all Avast 'shields', the lock-up  was HARD. No mouse/kbd. Screen froze. Audio was either a buzz, or 1-2 sec. of recorded TV audio looping.

2. Does the screen turn black?

Never.

3. If you let the system sit for awhile, does it unfreeze?

Never.

[AnotherConcernedCitizen]

As noted earlier, with Process Explorer active, I've observed the onset of the condition. AvastSVC suddenly jumps from ~1% CPU usage to 25%. If I leave things alone, the % creeps up until the network finally dies & the system locks up. Stop the MBAM SVC & the condition immediately clears.

[Angelus]

the version i'm currently running Version 3.6.1.2711 Component Package 1.0.482 Update package 1.0.8235 with no update available

The version that had the issues : Component Package 1.0.508  Update Package 1.0.8203

[AnotherConcernedCitizen]

I'm @ Version 3.6.1.2711 Component Package 1.0.508 Update package 1.0.8235

[exile360]

Yes, it's the Component Update/Component Package 1.0.508 that's having this issue.  The Update Package version (databases/signatures) shouldn't have any effect on the issue.

[dcollins]

Just spoke with our product teams and it looks like we did temporarily disable the 1.0.508 update. You can still download it from https://downloads.malwarebytes.com/file/mb3 though

[dcollins]

If you are not @AnotherConcernedCitizen and you're experiencing this issue, please make a new thread with logs instead of replying in here. It helps to keep track of how many users are experiencing issues and be able to track similarities and differences between machines

[dcollins]

If possible, would you be willing to remove Avast temporarily to see if that removes the deadlock issue? We've been unable to replicate so far, just want to rule out what we can.

[AnotherConcernedCitizen]

I COULD. Just trying to imagine how to test. Lock-up SEEMS to involve  the AvastSVC & I've only seen a couple of ~similar reports without Avast installed. If nothing untoward happens w/out Avast installed, then what?

[dcollins]

This is more for data that our teams can use to try and replicate in house so we can understand what's going on. If removing Avast solves the issue, then we have a better idea that it is for sure something in Avast causing the issue and it lets our internal teams focus their testing on Avast

[AnotherConcernedCitizen]

Sincerely not trying to be difficult, but how long would I need to run without Avast to yield useful data?

[AnotherConcernedCitizen]

I've just uninstalled Avast via their 'avastclean.exe' utility, so it ought to be entirely gone. MBAM is fully active.

[AnotherConcernedCitizen]

Just had the HARD lock-up. Gdrive invite for log sent. Web protection disabled again.

Generated same ~HEAVY I tested while MBAM was disabled & encountered NO lock-ups over the course of several hours.

[dcollins]

Thanks for the update. So even with Avast removed, the lockup still happened, and fairly quickly (within 20 minutes based on post times?). Were you doing anything specific during the time the system locked up?

[AnotherConcernedCitizen]

Had just performed an MBAM repair & kicked off similar activity... and was never able to complete this response before it locked-up again.

Running when the lock-up happened:

5 - WMC recordings, 1 - LiveTV

several open Firefox browser tab including a radio stream

This is roughly the same 'stress' test I ran yesterday before restarting the MBAM service (w/ Avast enabled) for several hours.

This morning, before uninstalling Avast I had:

several active recordings,  while I was watching one

a VBox VM running w/ active VPN & ~heavy downloads

an active handbrake encode

other stuff

& experienced no issues. I'm DEFINITELY NOT overtaxing the HW when the lock-ups happen & the same load that's OK without web protection active, locks-up within minutes after re-enabling it.

 

What now?