Component Update 1.0.508 issue

[dcollins]

Our engineers are looking into all the logs you've provided (we really appreciate that by the way). For now, you can disable Web Protection so you can use your computer as normal and we'll hopefully have some news soon

[AnotherConcernedCitizen]

I'm seeing the following in the event log (application), but timestamps indicate it's on reboot following the lock-up:

Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
Faulting module name: CoreAgnt.dll_unloaded, version: 0.0.0.0, time stamp: 0x59f38017
Exception code: 0xc0000005
Fault offset: 0x000007fef6698098
Faulting process id: 0x928
Faulting application start time: 0x01d490acb66d5e3c
Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
Faulting module path: CoreAgnt.dll
Report Id: c3a29ef3-fca0-11e8-9f86-e06995ddf04f

Google says Intel NIC driver-related:

https://www.google.com/search?q=CoreAgnt.dll&ie=utf-8&oe=utf-8&client=firefox-b

but it could just be having trouble accessing a resource corrupted by a lock-up. A user-initiated reboot gives a clean log.

Unsure if this has any bearing...

[AnotherConcernedCitizen]

11 minutes ago, dcollins said:

Our engineers are looking into all the logs you've provided (we really appreciate that by the way). For now, you can disable Web Protection so you can use your computer as normal and we'll hopefully have some news soon

Re-install Avast?

[dcollins]

If you'd like, you can, yes

[Angelus]

My Malwarebytes just updated to what was the problem component update

right now I have Web protection turned off... is it ok to turn web protection back on

are the lock ups and hard freezes fixed?

[AnotherConcernedCitizen]

No updates/fixes that I'm aware of. Not much chatter from others experiencing this, so devs MIGHT appreciate additional input?

[Firefox]

43 minutes ago, Angelus said:

My Malwarebytes just updated to what was the problem component update

right now I have Web protection turned off... is it ok to turn web protection back on

are the lock ups and hard freezes fixed?

Were you having issues?  Was your system also locking up?  Is your computer up to date (windows updates)?

[Angelus]

Yes I'm in page 2 of this very thread

[Firefox]

52 minutes ago, Angelus said:

Yes I'm in page 2 of this very thread

OK, I had not read the whole tread per say... I know @dcollins mentioned to someone else to make sure there windows was fully updated/patched and when that person updated it, all was well, that's why I was asking.

[Angelus]

it's cool.. I didn't mean to come across as rude or anything.. if I did it was unintentional 

[AnotherConcernedCitizen]

IMO, this time it isn't a conflict with any AV. If anything, the AV SEEMS to slow down (mitigate?) the lock-up temporarily.

[exile360]

1 minute ago, AnotherConcernedCitizen said:

IMO, this time it isn't a conflict with any AV. If anything, the AV SEEMS to slow down (mitigate?) the lock-up temporarily.

As I recall, the issue before wasn't a system lockup either, at least not entirely.  I think it was a problem where Web Protection in Malwarebytes would fail to start, but it was with the same AVs (Avast, ESET and maybe AVG as well if I remember right) and would sometimes result in system hangs/lockups or even loss of internet connectivity, but I think the main issue was Web Protection not being able to start or turning off and not being able to turn on again following database updates (the Web Protection always unloads/reloads following updates to refresh the database).  I suspect this issue is similar but may have slightly different symptoms, but the cause in the code is in the same place.

Of course only the Devs would know for sure though when they investigate.

[dcollins]

We are still researching the issue. While a third party AV doesn't seem to be the only cause, we think it can help to trip up the situation. We're trying a few different test scenarios at the moment to see what we can replicate, so for now the best solution is to leave Web Protection disabled

[dcollins]

If you'd be willing, can you please try the steps below. Note that this will cause a blue screen on your computer, so I understand if you don't want to perform the steps.

1. Download and extract CrashDumps.zip
2. Right click on CrashDumps.bat and choose Run as Administrator
3. Choose option 1 and press Enter.
   1. This will enable Complete memory dumps, which contains more information than a normal memory dump
   2. It will also enable the ability to force a system crash, which we will need to do since the system is on the shutdown screen
4. Once the process completes, reboot the computer
5. Reproduce the issue of the system locking up
6. Once the system is hanging during shutdown, hold down the right Ctrl key and press the Scroll Lock button twice. This should force a system crash.
   1. This should create a memory dump, and reboot your machine.
7. Once the machine reboots, find the file C:\Windows\memory.dmp and move it to your desktop.
8. Right click the memory.dmp file on your desktop and choose Send to -> Compressed (zipped) folder
   1. This should create a zip file on your desktop
9. Upload the file to wetransfer.com
10. Near the bottom of the page, click on the three dots and change the Send as option to link.
11. Paste the link here so we can look at the memory dump and see what's getting stuck during shutdown

Note that this may not work due to the nature of the issue where the machine locks up, but if it does, it should give us an idea of what's going on when the system is in this stuck state.

[AnotherConcernedCitizen]

49 minutes ago, dcollins said:

If you'd be willing, can you please try the steps below. Note that this will cause a blue screen on your computer, so I understand if you don't want to perform the steps.

1. Download and extract CrashDumps.zip
2. Right click on CrashDumps.bat and choose Run as Administrator
3. Choose option 1 and press Enter.
   1. This will enable Complete memory dumps, which contains more information than a normal memory dump
   2. It will also enable the ability to force a system crash, which we will need to do since the system is on the shutdown screen
4. Once the process completes, reboot the computer
5. Reproduce the issue of the system locking up
6. Once the system is hanging during shutdown, hold down the right Ctrl key and press the Scroll Lock button twice. This should force a system crash.
   1. This should create a memory dump, and reboot your machine.
7. Once the machine reboots, find the file C:\Windows\memory.dmp and move it to your desktop.
8. Right click the memory.dmp file on your desktop and choose Send to -> Compressed (zipped) folder
   1. This should create a zip file on your desktop
9. Upload the file to wetransfer.com
10. Near the bottom of the page, click on the three dots and change the Send as option to link.
11. Paste the link here so we can look at the memory dump and see what's getting stuck during shutdown

Note that this may not work due to the nature of the issue where the machine locks up, but if it does, it should give us an idea of what's going on when the system is in this stuck state.

Easy peasy.

~2.5GB too big for wetransfer.com (Oooops!). Currently (& slowly) uploading to gdrive. Will email you the invite when available.

[dcollins]

Thanks! I just got your email invite. Just to be clear, the entire computer had locked up when you did the Ctrl + Scroll/Scroll? Nothing else was working?

[AnotherConcernedCitizen]

This was the condition where AvastSVC resource consumption increased until network died & desktop no longer responded (no available resources). The HARD lock-up, assuming I understood the instructions, would require me to use the CTL-SCRLK-SCRLK sequence to initiate the dump & that lock-up no longer responds to ANY mouse/kbd input. Let me know.

[dcollins]

Sorry, I'm still not clear. Was the system locked up or was AvastSvc just using up more resources than normal but you could still use the system?

This only really helps if the entire system locks up entirely, which is why I said it may not work. However the Ctrl + Scroll/Scroll combination is embedded into windows, so it may be able to bypass whatever hardlock is going on in the system.

[AnotherConcernedCitizen]

I have reported 2 conditions:

- The 1st (initial report) is the one this dump applies to. Machine is active,  cursor sill moves. but machine is otherwise unresponsive & must be power cycled to recover.

- The 2nd, where Avast is either completely disabled, or uninstalled, results in the hard lock-up where the entire machine freezes. Desktop/mouse/kbd are completely frozen  audio is sometimes stuck in a short loop. '3-finger salute' is useless. Only recourse is a power cycle. Are you saying the RCTL-SCRLK-SCRLK would still work?  I could try, but I have serious doubts.

[dcollins]

In the second scenario, I'm not 100% certain that Ctrl + Scroll/Scroll would work, but because of the nature of that keyboard command, it might. That command is lower in the kernel than Ctrl + Alt + Del, and also doesn't try to launch any new processes, it simply halts the kernel. If you could give it a try at the very least, I'd appreciate it

[AnotherConcernedCitizen]

Good news/bad news... I can repro either condition in a matter of minutes, but in the 2nd scenario, there is no response to ANY user input. Sorry.

[AnotherConcernedCitizen]

More people seem to be reporting this issue now, but I see no official responses, or requests for new data. Any status update, Devin? TIA

[Nastajia]

I have had the hard lock up issue on a daily basis for the past 3/4 weeks unsure of the exact time frame. Only way around it was to hard shut down my PC then restart.

Windows 7 64Bit Pro All updated

Avast Premier Core Program and defs up to date

MBAM Premium up to date.

The only way i could fix the issue was to clean uninstall MBAM Premium approximately 1 week ago and it has been smooth sailing ever since. I have set Avast premiers protection to the most aggressive mode for the time being.

This time i just plan to wait this one out while the developers figure out what is going on.

This is not a fault report submission requesting help,  i am simply posting in this thread so the powers that be know there is most definitely an issue at this time.

Thank you.

[JoseM]

1.0.482 works fine  no issues for me

[LiquidTension]

On 1/6/2019 at 2:03 AM, Nastajia said:

I have had the hard lock up issue on a daily basis for the past 3/4 weeks unsure of the exact time frame. Only way around it was to hard shut down my PC then restart.

Windows 7 64Bit Pro All updated

Avast Premier Core Program and defs up to date

MBAM Premium up to date.

The only way i could fix the issue was to clean uninstall MBAM Premium approximately 1 week ago and it has been smooth sailing ever since. I have set Avast premiers protection to the most aggressive mode for the time being.

This time i just plan to wait this one out while the developers figure out what is going on.

This is not a fault report submission requesting help,  i am simply posting in this thread so the powers that be know there is most definitely an issue at this time.

Thank you.

Thank you for the information. The following log file would be helpful (even with Malwarebytes currently uninstalled).

Malwarebytes Support Tool (MBST)

• Please download MBST using the link below:
  → http://downloads.malwarebytes.com/file/mbst
• Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
• Double-click mb-support-#.#.#.###.exe to run the program.
• If prompted, place a checkmark next to Accept License Agreement and click Next.
• Click the Advanced menu on the left. Please do not click Start Repair.
• Click Gather Logs.
• Upon completion, click OK.
• A file named mbst-grab-results.zip will be saved to your Desktop.
• Please attach the file in your next email reply.

As JoseM mentioned above, users have reported that the issue is not experienced with the previous components package version.

You have the option of installing the previous version from here: https://malwarebytes.box.com/s/xq78v2de2k893g1h41upzbtqmsc6t375

Once installed, navigate to Settings -> Application and turn off the, "Automatically download and install application component updates" setting to prevent the program from upgrading to the latest affected version.

Edited January 7, 2019 by LiquidTension