Author Topic: Avast! using memory flagged by DEP (Windows and Hardware)  (Read 3544 times)

0 Members and 1 Guest are viewing this topic.

Offline briton

  • Jr. Member
  • **
  • Posts: 43
  • Good 'ere innit!
Avast! using memory flagged by DEP (Windows and Hardware)
« on: May 30, 2011, 10:21:21 PM »
I have been using avast! for many years and I am a fan - always recommending it to others (I would upgrade if I had the money).

I solved my problem but I am submitting this so that the avast! developers can test to see why avast! is behaving this way as the solution involved disabling avast! or parts of avast!

I am using Windows Vista Ultimate 64 bit SP2 with all current updates on a AMD 64 bit CPU (so I get Data Execution Prevention by Vista using Hardware DEP in the CPU).
I am using avast! free anti-virus. I did an avast! program/engine/definitions update prior to trying this: Program 6.1125 Definitions 110530-0

I was trying to download The Lord of the Rings Online - a MMO - which uses Pando Game Downloader via their Media Booster (a secure downloader which uses P2P via the Pando servers rather than direct P2P). Pando installs without any problem and commences the download by creating files in the chosen directory with the suffix .download to create the diskspace required. Shortly after the download starts, Pando crashes.

The cause is that DEP is closing the program without warning. Having run through an extensive  troubleshooting procedure with the Devs at Turbine (the developers/support for LOTRO in the U.S.) including checking that my ISP wasn't throttling my P2P bandwidth, the devs told me that they had received similar reports that DEP was shutting Pando down when Avast! was running.

Note that Avast! is not giving any indication of any mal-ware or other trouble.

The advice was to complete the download with Avast! disabled/shut down. Not wanting to leave a PC exposed to the internet (and the LAN for that matter) for 10 hours or more, I used the following procedure:
  • Right click Avast! icon in notification area
  • Select avast! shields control
  • Select Disable for 1 hour

It is obvious from the other troubleshooting that avast! is the source of the problem. Users using other AV programs are not reporting this problem. Others using Pando are not reporting this problem.

It appears that when Pando starts a download, avast! is doing something that DEP doesn't like - the most common thing that DEP doesn't like of course is an attempt to run executable code from memory locations which DEP (hardware and OS) are not expecting in which case they shut down the program. Unfortunately in this case, they are shutting down Pando and avast! is keeping quiet and continuing to run. If it IS a Pando problem, it must be somewhere in its relationship with avast! - probably something to do with P2P protection.

When the download finishes, I would run some tests with different functions of avast! disabled starting with P2P protection, but having spent a lot of time troubleshooting this as well as trying to report it to your telephone support team who could neither speak clear English (which meant everything had to be repeated) nor act convincingly that they knew enough to "take over your computer, sir", I think I have devoted enough time. If avast! devs want me to run tests, I would be happy to provided the tests are specified so that I am not just wandering around shutting down irrelevant parts of avast!

My recommendation would be that avast! developers contact LOTRO devs and maybe Pando devs to find out what users are reporting and re-create the conditions themselves.

Anyway, for others attempting the full hi-res download of LOTRO, I recommend you try the same trick (see above for procedure) or use another AV program during the download (or at least the first part of it.)

Hope this helps someone especially avast! devs who I know are constantly seeking to improve this great AV program!
a problem is a solution in disguise....

Fendorn

  • Guest
Re: Avast! using memory flagged by DEP (Windows and Hardware)
« Reply #1 on: May 30, 2011, 10:27:52 PM »
I have a question for you.  Is it giving you a blue screen and making you reboot the computer all together?  I've started having issues with blue screens since getting the newest version as well(also play LOTRO, WoW, STO(star trek online)).  Curious if it's the same problem as all three use P2P for updates.  I don't mean to hijack, but think it's the same issue.

Offline briton

  • Jr. Member
  • **
  • Posts: 43
  • Good 'ere innit!
Re: Avast! using memory flagged by DEP (Windows and Hardware)
« Reply #2 on: May 31, 2011, 07:05:22 PM »
I have a question for you.  Is it giving you a blue screen and making you reboot the computer all together?  I've started having issues with blue screens since getting the newest version as well(also play LOTRO, WoW, STO(star trek online)).  Curious if it's the same problem as all three use P2P for updates.  I don't mean to hijack, but think it's the same issue.
Fendom, you didn't hijack - I am sure avast! devs need as much info as possible. Blue Screen of Death? No BSOD - sorry. (Well, I'm not sorry but you see what I mean.)

Just a passing DEP message in the Notification Area. If I wasn't watching, I would miss it. No avast! message. I am guessing that avast! is using DEP which means it won't flag the message. The particular program doesn't allow DEP disabling.

I solved the problem using the "Right click->avast! shields control->Disable for 10 minutes" each time I started/restarted the Pando download - not good! Disabling P2P protection alone might have done the job - not good either! Despite LOTRO support saying it's an avast! problem, I have a feeling it's a P2P problem. It would be REALLY useful if avast! devs could include a standard dialog box pop-up explaining that it passed the problem to DEP but as it's hardware DEP, I am not sure. Hoping some dev here tests it out or asks for more technical detail.

You might want to list which P2P downloader WoW and STO uses if it isn't Pando. (I haven't downloaded WoW for a long time and STO not yet.
a problem is a solution in disguise....