Virtual Machine killed by updating Avast Free to 20.4

[O A]

(Trying here as Avast folks do not seem to be responsive to my other message in the forum...)

I updated Avast program from the menu last week, it all went ok until it wanted to reboot. But my Windows 10.0.18363.900 did not boot any more. It's on VMware ESXi 6.7u3 and I figured out that the VM crashes due to some unsupported instruction. It took me a few days (booting into safe mode each time and playing with the settings of each Avast driver - there's a lot!) to figure out which Avast drivers have the problem - aswSnx and aswSP. So I disabled both and Windows can start but Avast UI cannot, it now says "UI Failed to load".

What is the quickest way to get Avast fully running again? At least my machine is usable again but not sure to what extent it is protected by Avast now. (And unfortunately, I had no VM snapshot of the machine. Next time I promise I'm going to create one!)

I'd be happy to remove Avast and install back the previous program version from an offline installer - is that available somewhere?

[rocksteady]

I'd be happy to remove Avast and install back the previous program version from an offline installer - is that available somewhere?

FYI back versions are available on filepuma here:
https://www.filepuma.com/download/avast_free_antivirus-2/versions/

[Spec8472]

Hi OA. Avast AV cannot run properly without aswsp.sys loaded. This looks like a virtualization issue, both aswsp.sys and aswsnx.sys are virtualization clients. If your ESXi VM has enabled Virtualize Intel-VTx/EPT or AMD-V/RVI under CPU settings, please try disable it. You can also disable Avast hardware-assisted virtualization under troubleshooting settings in Avast GUI. Each of these methods should help. Can you please specify your CPU?

[O A]

FYI back versions are available on filepuma here:
https://www.filepuma.com/download/avast_free_antivirus-2/versions/

Thanks, will keep this option as a last resort.

[O A]

Hi Spec8472,

Thanks for picking this up.

If your ESXi VM has enabled Virtualize Intel-VTx/EPT or AMD-V/RVI under CPU settings, please try disable it.

I only tried turning off Virtualization Based Security, that did not help. There's an "expose hardware assisted virtualization to the guest OS" setting, I can give that whirl but I believe I need that somewhere else.

You can also disable Avast hardware-assisted virtualization under troubleshooting settings in Avast GUI.

Yeah, this was one of my ideas too, hence I wrote that Avast UI fails to load. I'm sure there's a reason why the UI is so complex that it fails to load unless everything is normal but especially the settings should be available somewhere to fix an issue like this. Can you specify how I can disable this without the UI? (Registry?)

Can you please specify your CPU?

Intel Core i5-2400 @ 3.1GHz

[Spec8472]

Hi OA, thank you for the info. If you need to keep the "expose hardware assisted virtualization to the guest OS" setting of ESXi enabled, try to disable it temporarily just to install Avast and then disable HW assisted virtualization in Avast GUI. Then you can re-enable nested virtualization again in ESXi settings.

[O A]

If you need to keep the "expose hardware assisted virtualization to the guest OS" setting of ESXi enabled, try to disable it temporarily just to install Avast and then disable HW assisted virtualization in Avast GUI. Then you can re-enable nested virtualization again in ESXi settings.

Ok, that seems to have done the trick. Avast UI is working again, definitions were successfully updated.
Two questions:

• What did I lose by turning off virtualization in Avast? Is my system more vulnerable to certain clever malware as a result?
• What can I expect from Avast 20.5+? Will this be fixed so that I can turn on Avast virtualization again?

Thanks.

[Spec8472]

Hi OA,
1) You lose some low level OS filtering capability, nothing crucial
2) It depends on our ability to reproduce the issue, not very successful so far, can you please provide a memory dump or core dump?

Thank you

[O A]

2) It depends on our ability to reproduce the issue, not very successful so far, can you please provide a memory dump or core dump?

There's a virtual machine process core dump available - not sure if there's any public tool to read that, quick googling revealed nothing.
I think this message should give enough clue:
2020-06-21T15:20:09.272Z| vcpu-0| W115: MONITOR PANIC: vcpu-0:NOT_IMPLEMENTED vmcore/vmm/hv/vt/hv-vt.c:3254
because, again based on googling, the line number (i.e. 3254 in this case) seems to be specific to the instruction. Can you talk to VMware folks to understand what is the instruction attempted to beinterpreted on that line?

[Spec8472]

O A: Thank you for the info