Avast WEBforum

Business Products => Archive (Legacy) => Avast Business => Avast Endpoint Protection => Topic started by: REDACTED on November 19, 2014, 10:38:54 PM

Title: MS KB3000850
Post by: REDACTED on November 19, 2014, 10:38:54 PM
We've been able to duplicate this on two machines.

Windows 8.1 Pro
After installing Optional update KB3000850, the machines hang up - they cannot run network scripts, nor run many programs on the system.  Some work, but much doesn't.

You can't even restart or shutdown - it just hangs forever.

We noticed that on both systems, the Avast system tray icon never appeared.  So we thought to remove Avast.

If you get into MSCONFIG and force the system into safe mode - remove Avast using the Clear program - the system starts working perfectly.

Something about that KB messes up Avast.  Please make sure you avoid that KB for now until the Avast team has a chance to check it out.
Title: Re: MS KB3000850
Post by: REDACTED on November 20, 2014, 09:39:18 AM
Same issue here! We are using version 8.0.1603 (Endpoint protection plus) and after updating Windows yesterday we have several issues:

- PC unable to restart
- Internet Explorer does not start anymore
- Not able to debug in Visual Studio (issue with starting builds)

Please look at this ASAP!

EDIT
I've just uninstalled KB3000850 via the Control Panel (safe mode not even required) and after a reboot the system is back to normal. This seems like the preferred way since it does not require you to remove Avast (leaving your system unprotected).
Title: Re: MS KB3000850
Post by: REDACTED on November 20, 2014, 03:34:31 PM
We are having the exact same issues as well.  Lots of machines took that update.  It has not been very fun trying to go around and uninstall that update.  Hopefully this is resolved quickly.
Title: Re: MS KB3000850
Post by: REDACTED on November 20, 2014, 04:08:05 PM
It is going on with all version of Avast.

https://forum.avast.com/index.php?topic=160717.0
Title: Re: MS KB3000850
Post by: REDACTED on November 20, 2014, 10:10:45 PM
Yup, just came here to mention this...  But already found that it is going to be addressed tomorrow morning.

https://forum.avast.com/index.php?topic=160717.msg1153446#msg1153446

We have been able to simulate the problem in our lab and I think we fixed this issue. This Windows updates calls new memory related functions which are not fully compatible with avast. We'll prepare EmUpdate with the patched driver tomorrow morning (it means, all & new avast installations should be patched immediately, that's how it works).

Edit:  And no need to remove avast as someone suggested, just remove the MS patch KB3000850 temporarily until avast can get patched.
Title: Re: MS KB3000850
Post by: RichardEb on November 20, 2014, 11:13:11 PM
Do I have to update soa server if the avast patch is ready?
Title: Re: MS KB3000850
Post by: REDACTED on November 21, 2014, 08:14:21 PM
Do I have to update soa server if the avast patch is ready?

No sign of the patch yet...  I got the impression that this would be a streaming update and/or something the mirror should pickup automatically...  Assuming your SOA server is healthy...
Title: Re: MS KB3000850
Post by: REDACTED on November 21, 2014, 10:40:41 PM
Looks like yet again the business product is lagging behind, hopefully someone from Avast can comment on when the patch will be available for the other versions of their software.
Title: Re: MS KB3000850
Post by: REDACTED on November 21, 2014, 11:01:59 PM
Is there a way to use SOA to remotely uninstall the Avast client?
Title: Re: MS KB3000850
Post by: REDACTED on November 24, 2014, 02:54:08 PM
So this hasn't been updated for the business product?  I have been following the other thread and seems like there is a patch for the personal side but I have not seen an update yet for the business side unless I have missed it?
Title: Re: MS KB3000850
Post by: REDACTED on November 24, 2014, 04:42:20 PM
So this hasn't been updated for the business product?  I have been following the other thread and seems like there is a patch for the personal side but I have not seen an update yet for the business side unless I have missed it?
 

I haven't seen anything either.  :(
Title: Re: MS KB3000850
Post by: REDACTED on November 24, 2014, 05:02:42 PM
I am waiting for a fix for the business client too. 

It sure would be nice if the Avast Team would respond and give an update!!

Title: Re: MS KB3000850
Post by: REDACTED on November 24, 2014, 07:54:15 PM
As am I.  Avast team, can you confirm that the Business products will be getting the same fix coming soon?
Title: Re: MS KB3000850
Post by: Bret Miller on November 24, 2014, 09:43:38 PM
+1 This is affecting us horribly too. Had to remove the update for most people... Please get to updating the business client, avast!
Title: Re: MS KB3000850
Post by: REDACTED on November 24, 2014, 10:21:06 PM
As am I.  Avast team, can you confirm that the Business products will be getting the same fix coming soon?

(http://www.20kgroup.com/wp-content/uploads/2013/02/JiminyCricket.jpg)
Title: Re: MS KB3000850
Post by: REDACTED on November 25, 2014, 10:29:05 AM
How about finally update the business edition to a recent version (10)? I can not understand that the business edition is lagging behind at least two versions! Of course it is a bigger problem to fix this old stuff if such incompatibility issues occur with a modern OS.

Guys: this is urgent!

If this is not resolved quickly, I am forced to switch to another product in our company - whether I like it or not!

BR
Jobdan
Title: Re: MS KB3000850
Post by: Asyn on November 25, 2014, 10:30:08 AM
-> https://forum.avast.com/index.php?topic=160717.msg1155451#msg1155451
Title: Re: MS KB3000850
Post by: REDACTED on November 25, 2014, 10:42:12 AM
Thanks. I saw this already - because of this posting i wrote my comment above.

Another question for me that is unresolved: why is the mentioned posting in the Free/Pro section? Why is no information in the business section of this forum? WHEN will the fix be released? WHEN? Just to remember: the business edition is the one customers are paying for and this edition is rolled out to the whole company - no home users and private computers. Our guys have to work and i have to explain why we switched to avast as AV solution. Not funny.

BR
Jobdan
Title: Re: MS KB3000850
Post by: REDACTED on November 25, 2014, 03:12:42 PM
How about finally update the business edition to a recent version (10)? I can not understand that the business edition is lagging behind at least two versions!

Let me say;  I don't like the answer I'm about to give...  But as a long time personal user of Avast! Free edition who also moved a company to the business protection product my experiences have required me to come to terms with the following fact:

They see way more value in the millions of users acting as remote data collectors with the free edition and probably make more money selling millions of copies of the personal pro edition than they do selling thousands of copies of the business edition.  Most products that have a business edition are priced such that it is the flagship offering and the real bread winner of the lineup.  This is just not the case with the Avast! ecosystem...

It's a shame because this second class citizen stuff is going to drive a happy one time zealous proponent of Avast! over to something like Vipre, ESET, or *shudder* Webroot...  What is unfortunate is that the same thing that makes it great, also limits its success.
Title: Re: MS KB3000850
Post by: drake127 on November 25, 2014, 05:19:33 PM
We just released an Emergency Update fix for the latest business edition (8.0.1603). The fixed version of aswSnx is 8.0.1603.401. To force apply the fix, it should be enough to either log out + log in or to execute avast! Emergency Update scheduled task from Task Scheduler).
Title: Re: MS KB3000850
Post by: REDACTED on November 25, 2014, 09:13:52 PM
For SOA users - The update "141125-1" appears to include the 8.0.1603.401 version of aswSnx.sys, which if your mirror service is working correctly, you should already have...  The clients will need to update at their regular intervals however, unless you click the "update engine and virus definitions" button at the client directly...

On to testing the update vs Microsoft patches...
Title: Re: MS KB3000850
Post by: REDACTED on November 25, 2014, 09:34:25 PM
So far so good.  We are having success with the Avast update.  We have some with the MS KB update on them still and after a reboot Avast has updated and the problems are gone.  We have re-applied the MS update to some that we have removed it from and they are working good as well.
Title: Re: MS KB3000850
Post by: REDACTED on November 25, 2014, 11:59:30 PM
I currently have avast! Endpoint Protection Suite 8.0.163 Virus Definitions Version: 141125-1.  How do I know if the patch has been updated? Do I just need to look at the aswSnx.sys properties and see if it is 8.0.1603.401?
Title: Re: MS KB3000850
Post by: drake127 on November 26, 2014, 02:24:02 AM
Do I just need to look at the aswSnx.sys properties and see if it is 8.0.1603.401?
Yes, that's enough.
Title: Re: MS KB3000850
Post by: REDACTED on December 08, 2014, 11:19:45 PM
I Deployed Avast to another workstation and for some reason the aswSnx.sys does not update.  Still stuck on 8.0.1603.399.  Is there a trick to force the update? Update engine is at 141208-1. How do you force the update? Can I just copy the aswSnx.sys that is 8.0.1603.401 and transfer it over?
Title: Re: MS KB3000850
Post by: REDACTED on December 09, 2014, 11:26:01 PM
I'm the same boat on a few machines.  They're up to date on definitions, but the .SYS file remains the old 399 version and does not upgrade to 401.  A spot check of several other machines showed they upgraded to 401.

Is there a way to force those few machines to 401 version?  Can we copy the 401 SYS file over from another machine?
Title: Re: MS KB3000850
Post by: REDACTED on December 10, 2014, 10:23:47 PM
Same for me.  I updated (SOA/Mirror) on test client and it is .399. 
Title: Re: MS KB3000850
Post by: Theo@IC on December 11, 2014, 01:36:19 PM
I installed Avast on a new Windows 8.1 machine (first one in our company) and ran into this issue. I took some time before I discovered it was the combination of Avast and KB3000850. Uninstalling KB3000850 restored the machine to normal behaviour.

On other machines the aswSnx.sys driver has been updated to the .401 version, but this doesn't happen for a new install. On my Windows 8.1 system it is still version .399.


Title: Re: MS KB3000850
Post by: REDACTED on December 11, 2014, 10:26:47 PM
I can confirm that if you copy the aswsnx.sys from a client that got the 401 update, and overwrite it on a client that doesn't want to upgrade, it works.  You just need to copy in Safe Mode.
Title: Re: MS KB3000850
Post by: drake127 on December 15, 2014, 11:30:01 AM
I'll check it and will let you know.
Title: Re: MS KB3000850
Post by: REDACTED on December 15, 2014, 03:57:48 PM
We are seeing the same thing.  The aswSnx.sys file is no longer auto updating.  As the KB3000850 update is being applied to machines we are seeing the same problem as before.  So we are manually updating the machines by going into safe mode.
Title: Re: MS KB3000850
Post by: drake127 on December 15, 2014, 06:41:37 PM
Hi again, I am happy to inform you that we just released an updated version of the fix (the driver remains the same and so are versions). The original version of the fix has been causing some issues and was suspended for last few days.
Title: Re: MS KB3000850
Post by: Avosec-UK on December 16, 2014, 12:09:20 PM
Hi again, I am happy to inform you that we just released an updated version of the fix (the driver remains the same and so are versions). The original version of the fix has been causing some issues and was suspended for last few days.

Hi Drake.
Does that mean that the updated aswSnx driver version will again be 8.0.1603.401?

Thank you
Title: Re: MS KB3000850
Post by: drake127 on December 16, 2014, 04:12:56 PM
Yes, the updated driver is exactly the same (8.0.1603.401).
Title: Re: MS KB3000850
Post by: Avosec-UK on December 16, 2014, 05:33:12 PM
Yes, the updated driver is exactly the same (8.0.1603.401).

Is this still distributed only via EmUpdate or it is also a part of the normal VPS update packages i.e. would an updated mirror server contain this version of the driver?
Title: Re: MS KB3000850
Post by: drake127 on December 16, 2014, 07:23:32 PM
AFAIK via EmUpdate only.
Title: Re: MS KB3000850
Post by: Avosec-UK on December 17, 2014, 10:18:56 AM
AFAIK via EmUpdate only.

Hi Drake,

Any plans to release it as a normal VPS / Program update?
EmUpdates are not solution for isolated / offline networks.

Cheers
Title: Re: MS KB3000850
Post by: drake127 on December 18, 2014, 11:03:38 AM
It doesn't seem so.
Title: Re: MS KB3000850
Post by: REDACTED on December 18, 2014, 05:19:35 PM
It doesn't seem so.

One problem with this appears to be with new computer setup...  We need to be able to generate a new avast_managed.exe package that can install on a fully patched, new workstation as it is being setup...
Title: Re: MS KB3000850
Post by: REDACTED on December 30, 2014, 08:57:56 PM
I'm nervous about this as well.  I'm about to setup my first new PC since the problem.  The Windows 8.1 Pro system will have that KB installed prior to joining our domain, so when Avast installs, hopefully that emupdate runs immediately so the system doesn't hang up.

Edit:  A fresh install does not seem to update itself.  It installs - runs the memory scan - then runs the standard VPS update.  After that - nothing.  The affected DLL file doesn't change.  If I force the emupdate to run, then the DLL was updated and I could restart.
Title: Re: MS KB3000850
Post by: REDACTED on February 06, 2015, 07:36:48 PM
Hi, I'm trying to figure this out, it seems I have the wrong version of the file : 8.0.1603.399.
Why isn't being update to .401 ?

I'm having all sorts of issues.
Title: Re: MS KB3000850
Post by: REDACTED on March 24, 2015, 03:49:12 PM
I am having the same problem where Avast Endpoint is not updating the .sys to .401.  Recently, I have been revamping out with SCCM and have been testing with a vanilla windows 8.1 x64 image (from iso and no windows updates applied).  I am finding that after I got SCCM to finally deploy Avast's exe to the device collection, I cannot even log on for the first time because the computer is stuck at Loading Personal settings (going on 4 hours now).  Besides my annoyance with no MSI installers, not being able to include this "Emergency" update in a packaged installer is a joke.  So now I am back to having to manually install Avast on each newly imaged computer just so i can run the emupdate and hopeully get .401.  I don't see why this has to be so difficult.
Title: Re: MS KB3000850
Post by: REDACTED on March 25, 2015, 12:18:21 AM
@ jae1378

It would be a good idea if you could open a new topic here https://forum.avast.com/index.php?board=33.0 and making a reference to this thread ( topic ). You will have greater chances to an answer from someone who knows Avast Endpoint.