Fabian Wosar

Wednesday's Emsisoft Anti-Malware update

Recommended Posts

On Wednesday we received reports that one of the updates we shipped as part of the Emsisoft Anti-Malware 8.1 release was causing unexpected problems on some of our users' PCs. Users affected reported frequent system freezes while running Emsisoft Anti-Malware with the File Guard enabled.

 

After further investigation of the issue it turns out that the problem has been caused by a bug inside the Emsisoft Anti-Malware service component. Only systems that had certain malware items quarantined were affected. On those systems, during the quarantine rescan that is performed after an online update, the service application crashes with a memory corruption error. Whenever a process crashes on a Windows system, Windows will try to create a bug report that is being submitted to Microsoft. To do so, most recent Windows versions will start a dedicated crash reporting process called WerFault.exe. That usually isn't a big deal, but in this particular situation causes a deadlock situation to occur. Essentially the service component won't be terminated by Windows until WerFault.exe finished its execution. But in order to do that, WerFault.exe needs permission by the crashing, non-functional service component.

 

The problem has already been fixed yesterday, roughly 20 hours after we received the first reports. According to our telemetry the majority of all users have already received the updated service application automatically. You can make sure that you have the bug-fixed version of the service by performing a manual update.

 

We are deeply sorry for any inconvenience this particular bug may have caused you or your customers. Rest assured that we are doing our best to prevent this or a similar bug in the future.

Share this post


Link to post
Share on other sites

  • Recently Browsing   0 members

    No registered users viewing this page.