EIS 1st June 2017 update locks up PC

[watsonm 0]

I am a long time user of Emsisoft and this morning I was working on my PC (Lightroom editing an Image)  .  I noticed out of the corner of my eye that Emsisoft updated to a newer version and

carried on. 

Within a minute or two my machine locked up. 

After a reboot it worked for 10 seconds or so and then locked up. 

Booted in safe mode and it worked OK. 

I use CCleaner and checked to see if anything new had appeared in startup menu. 

Disabled a few startup programs and rebooted.   NO change, PC locked up after a short while. 

I have enough time to launch task manager but not time to switch to performance tab before it locks up.

 

After a while I decided to disable EMsisoft as that would appear to be the only thing that had changed.  

Had to reboot to safe mode and changed the Emsisoft directory name (by removing the E from Emsisoft) and rebooted.   

System ran OK.  

Changed directory name back  and rebooted and system locked up.  

So it would appear there is an issue with my/the current version of EMSISOFT.  

 

Was considering clearing out the whole Emsisift directory and re installing but I guess that would lose all my configuration/settings.  Will wait for input from you guys before I do this.

 

System Setup:

Windows 10   64 bit   Version 1607 (OS Build 14393.1198)

Product :  Emsisoft Internet Security.

 

Currently running without ANTI Virus Protection so would be grateful for quick response!.

[pereh 0]

I had a similar effect this morning. ESIS updated yesterday, no other changes to the system. Next boot was this morning and windows stopped starting up at an early stage. I bootet in safe mode and the event log was full of errors about unresponsive network drivers and services. I had no time for a proper analysis and restored an image from 4 days ago. Win started ok and I disabled ESIS automatic update. Since then I had a few warm & cold startups and no problems. So I think ESIS being the culprit. My question before I do some more testing: any logs to switch on or settings to check?

System: Win 7 Pro SP1 64-bit

Best Regards,

Peter.

[Acadia 0]

Same problem here, you can refer to my post in the other thread, I believe these two threads are either related or the same problem: System freezing up during boot, and eventually when it FINALLY boots, EMS not working.

Acadia

[pereh 0]

@Acadia: You are right. After working with the PC for several hours, I had the time to manually update ESIS and made a restart. Win startup gave me a black screen for about 2 minutes, then I got the same error message window as in thread "A Major Problem - EIS Can't Connect to Service". Eventlog entry:

==================================================
Event Time        : 01.06.2017 19:41:07.948
Record ID         : 294147
Event ID          : 7022
Level             : Error
Channel           : System
Provider          : Service Control Manager
Description       : Der Dienst "Emsisoft Protection Service" wurde nicht richtig gestartet.
Opcode            :
Task              :
Keywords          : Klassisch
User              :
==================================================

The service is still in status 'starting'.

I should mention that I still have MBAM v2 on my PC, although it does not start when the system comes up; I only start it manually. I got suspicious, because the eventlog entry just before the one mentioned above is:

==================================================
Event Time        : 01.06.2017 19:39:42.788
Record ID         : 294146
Event ID          : 6
Level             : Information
Channel           : System
Provider          : Microsoft-Windows-FilterManager
Description       : Der Dateisystemfilter "MBAMProtector" (6.1, ‎2015‎-‎08‎-‎11T19:35:19.000000000Z) wurde erfolgreich geladen und im Filter-Manager registriert.
Opcode            :
Task              :
Keywords          : 0x8000000000000000
User              : NT-AUTORITÄT\SYSTEM
==================================================

So the people at Emsisoft should merge these 2 threads and give some advice on how to proceed.

 

 

 

[watsonm 0]

Since  I am an impatient soul and we haven't had an update or comment from Emsisoft I decided to do some work which may or may not help to

isolate where the problem is.  The following is a log of what I did  before the system locked up.

 

Uninstalled the existing EMSISOFT product and rebooted twice.   Removed  Emsisoft directory .  (I have a zipped up copy elsewhere to hopefully put my config back if/when this is resolved)

Installed latest version by executing  EmsisoftInternetSecuritySetup.

• It went through the sequence of downloading signature.  completed at 100%
• Noted that updates where being installed
• Done.

At this point the version number displayed was  11.0.0.5958

• It requested a restart

On logon the overview displayed Partial protection  and a version of 11.10.1.6763

Ran a quick scan

• Update now was prompting so selected that .
• After this had installed it demanded a restart which I accepted.

On logon the system locked after a short while.

 

The only file in the logs directory is hopefully attached

 

 

 

logs.db3

[Acadia 0]

AAAIIIIEE.  Despite being an excellent program overall, if I have to uninstall and then install twice a year is too much.  I have NEVER had to reinstall any of my programs twice a year! ... until now, if that is the fix.

Acadia

[DT-Maniac 0]

Same problems here as mentioned above and in the other thread. Black screen with cursor for about 2 min before the Win login screen appears. EMSISOFT cannot be started and various other programs (e.g. Steam) cannot connect to the internet. I already have removed the old installation and reinstalled the actual EMSISOFT version, the problems are still the same. Please get that fixed somehow.

OS: Win 7 Home Premium 64-bit

[Diveurn 0]

Hi, exactly the same here...

OS: Win 7 Home Premium 64-bit too

 

Quote

 

Same problems here as mentioned above and in the other thread. Black screen with cursor for about 2 min before the Win login screen appears. EMSISOFT cannot be started and various other programs (e.g. Steam) cannot connect to the internet. I already have removed the old installation and reinstalled the actual EMSISOFT version, the problems are still the same. Please get that fixed somehow.

OS: Win 7 Home Premium 64-bit

 

 

[sysadm01 0]

Same here.

I have managed to roll back the update by using windows 7 system restore to previous date. Then disconnected network and rebooted. After that disabled auto updates in emsisoft. Running OK except antivirus database is couple of days outdated. Hope they will fix soon.

[GT500 573]

Is anyone here willing to send us debug logs for this issue? If so, please download the following ZIP archive and open it:
http://cdn.emsisoft.com/Emsisoft_Debug_Tool.zip

Inside the ZIP archive is a batch file. Simply double-click on the batch file, and follow these steps:

1. If a popup asks about the Windows Command Processor please click Yes to allow it.
2. A blue window with white text will appear, and you should see a menu.
3. Click inside the blue window, and then press 1 on your keyboard, and then press Enter.
4. You will be told that debug logs have been turned on, and to restart your computer. Press Enter again to continue.
5. Press Enter a third time to exit the batch file.
6. Restart your computer (if using Windows 8.1 or Windows 10 please right-click on the Start button, go to Shut down or sign out, and select Restart rather than using the normal restart option).
7. After your computer has restarted, wait until you see the error message about not being able to connect to the service, and then close it.
8. After closing the error message, hold down the Windows key on your keyboard (the one with the Windows logo on it, usually found between the Ctrl and Alt keys) and tap R to open the Run dialog.
9. Type (or copy and paste) %AllUsersProfile%\Emsisoft\Logs into the field, and click OK.
10. Click on one of the files in the folder that opens, and then hold down the Ctrl key and tap the A key to highlight all of the files.
11. Right-click on one of the files, go to Send to, and select Compressed (zipped) folder to add the files to a ZIP archive.
12. A new ZIP archive will have been created in that folder (you can move it to your Desktop to make it easier to find). Please attach that ZIP archive to a reply, or send it to me in a Private Message.

The controls for attaching files to messages are right below where you type in your message.

[watsonm 0]

Arthur,

 

The attached rar file is from my setup which just locks up after a short while.  No messages.

I can get it to sort of work if I set the service to manual and then start a2astart.exe  but after a scan it locks..  I'll try and get logs for this situation.

 

Logs.rar

[pereh 0]

@GT500: This is really strange. I did what I have done yesterday: restore an image and disabled auto update  in ESIS. After working for about 1 hour, I manually started the ESIS update. The update ran, I restarted ESIS, then I prepared the log settings as written above. Then I made a restart. This time there was noch black screen or waiting times, no entries in event log, just my True Launch Bar was not initiated correctly (it did not contain any programs...). The log directory contains 6 logs, together about 42 MB in size. Should I really load them up, or is it some special entry I could search for?

Peter.

[pereh 0]

I made a cold startup now, and got no error message from ESIS, the service is running. I stopped the logs as soon as the system was up, but they are still more than 60 MB. However, there is 2 eventlog entries now:

==================================================
Event Time        : 02.06.2017 10:31:57.000
Record ID         : 40287
Event ID          : 1000
Level             : Error
Channel           : Application
Provider          : Application Error
Description       : Name der fehlerhaften Anwendung: a2service.exe, Version: 2017.5.0.7538, Zeitstempel: 0x5925ecc4
Name des fehlerhaften Moduls: api-ms-win-downlevel-ole32-l1-1-0.dll, Version: 6.2.9200.16492, Zeitstempel: 0x50f319ad
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000fd8
ID des fehlerhaften Prozesses: 0x284
Startzeit der fehlerhaften Anwendung: 0x01d2db7a62aba9a0
Pfad der fehlerhaften Anwendung: C:\Program Files\Emsisoft Internet Security\a2service.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
Berichtskennung: f0234c78-476d-11e7-8887-1c872c5e913c
Opcode            :
Task              : Anwendungsabsturzereignisse (100)
Keywords          : Klassisch
User              :
==================================================

==================================================
Event Time        : 02.06.2017 10:32:09.031
Record ID         : 294388
Event ID          : 7031
Level             : Error
Channel           : System
Provider          : Service Control Manager
Description       : Der Dienst "Emsisoft Protection Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Opcode            :
Task              :
Keywords          : Klassisch
User              :
==================================================

ESIS version now running: 2017.5.0.7538.

Because True Launch Bar is still missing, I may need to restore an old backup image again. So please let me know soon if I can help you any further.

Peter.

Edited June 2, 2017 by pereh
2. eventlog message added

[Acadia 0]

Now the bug is affecting my wife's pc, frozen.  Going to try a recovery from a backup I made a couple of days ago, if I can get to the backup program.

Acadia

[T-RHex 2]

For me, if debug logging is enabled the problem does not occur on startup. With debug logging disabled, it takes a few minutes for the Windows logon screen to appear (seems to be frozen, but just wait 2-3 long minutes) and EIS does not start properly. To workaround, I wait for Windows to startup, then kill the a2service.exe process, and then EIS either restarts on its own or I start it manually; after, it seems to function fine. As debug logging shouldn't stay on for long periods of time, I turn it off while working, then turn it back on before shutting down. I've been able to repeat this reliably quite a few times (especially when I forget to turn on logging before shutting down).

I have submitted this information to support.

Edit: to give credit where it's due, I got the idea of killing a2service.exe from this topic. I also see the difference in memory usage (around 44mb when hung, around 260mb when running).

(Win7 Pro x64)

[Acadia 0]

QUESTION to all of you with this problem: how many of you have Malwarebytes PRO on your system?  Not the free version, but the Pro Real-Time program?

I took a clue from Mustafa Serif when he/she mentioned Malwarebytes.  A friend of mine, who has actually helped the software engineers at Emsisoft, told me recently to kill the Real-time and Startup protection of Malwarebytes.  YOU DO NOT NEED TO UNINSTALL MALWAREBYTES.  Just kill the real-time and startup protection, for me that took three untickings, you will still have the scanner at your disposal.

I did this on both mine and my wife's pc.  Both have booted just fine five times in a row, and the EMI shield is now always green.

Hoping that was the problem.  Sorry to Emsisoft if I implied otherwise.  Hopefully this contines and I don't to come back later saying ... err, well ....

Thanks all, Acadia

[sysadm01 0]

When debug log is enabled the problem doesn't occur during start up. When I disable debug logging the problem starts happening again.

I also noticed that Windows Malicious Software Removal Tool x64 - May 2017 (KB890830) was installed almost at the same time with emsisoft update... I have restored my system to restore point created before any updates were installed and disabled KB890830 in windows update to prevent it being installed.

After rebooting couple of times I have enabled emsisoft auto update. And the problem started to happen once emsisoft was updated. Again, once I enable debug log, the problem disappears. Disable debug log - the problem starts happening again.

[GT500 573]

For those having the "unable to connect to service" issue, do any of you want to try a potential fix for this problem? If so, then please contact me via Private Message, and I will reply with instructions.

As for @Acadia, it might be possible to resolve your issue with Windows freezing on startup by excluding Emsisoft Internet Security's folder in Malwarebytes Pro, and excluding Malwarebytes Pro's folder in Emsisoft Internet Security. That being said, Malwarebytes products do use a WFP driver, and we don't consider third-party WFP drivers to be compatible with the WFP driver from Emsisoft Internet Security. There are instructions for excluding programs and folders in Emsisoft Internet Security at this link (I recommend excluding the Malwarebytes folder from both scanning and monitoring). Here are links to instructions for adding exclusions to Malwarebytes 3 and Malwarebytes Anti-Malware 2.

The Emsisoft Internet Security folder is usually as follows:

• C:\Program Files\Emsisoft Internet Security

The Malwarebytes folder should also be in Program Files, but on 64-bit computers it may be in Program Files (x86) instead.

[watsonm 0]

Booted up in safe mode

Renamed the Emsisoft directory name (by removing the E from Emsisoft) and rebooted.   

Started logging

changed directory name back to Emsisoft Internet Security

ran A2ASTART and ran a quick scan which completed OK and system did not lock

Renbooted and system locked staright away.

Booted up in safe mode

Renamed the Emsisoft directory name (by removing the E from Emsisoft) and rebooted.   

collected logs as requested , attached below.

System ran OK.  

Logs.rar

[watsonm 0]

Left system running for a while.  I wanted to see if it did the pop up when running a new bat file so created test.bat

 

When I tried to run it the system locked up. 

Did the safe mode reboot and collected logs  (attached)

 

Logs.rar

[watsonm 0]

Is there a download for the previous version that I can run while this problem is investigated.  (with updates disabled)

[Acadia 0]

My problem may be different from some of you, I don't know.  Ever since killing the real-time function of Malwarebytes, everything has been just fine, same on my wife's pc.  Something started this problem a few days ago when I had been using Malwarebytes Pro for many months, so not sure what is going on.  Anyway, killing real-time in MB for the time being has solved the problem unless it rears its ugly head again.  I am thinking of uninstalling MB altogether and getting rid of that incompatible driver, after all, with a scanner like EMI do I even need a second opinion?  But then again, I am paranoid and sometimes like a second opinion.

Question: is HitmanPro Alert compatible with EMI?

Thanks a ton, Acadia

[m0unds 4]

13 hours ago, Acadia said:

Question: is HitmanPro Alert compatible with EMI?

yea, I run HMP.alert w/EIS and have no issues. the only thing I do is exclude hmpalert.exe from monitoring within EIS.

[ilowe 0]

For several weeks I have noticed that EIS partially jams up the system upon cold reboots. I run a desktop and always shut down at night. It is the cold starts that lead to hangs. For instance, when I try to start My Computer, while EIS says it is still updating, the program does not start, or I get the white screen.  EIS reports "100% "  for over a minute. This morning  I also had most of my my icons moved to the second screen -- not for the first time.

In my case, I wonder if the problem is the updates, not the program itself. Is there a setting somewhere to automatically delay updates till five minutes after booting?

I am tempted to turn off my modem next few times I boot, since hopefully EIS will only try to update if there is a connection.

[Acadia 0]

9 hours ago, m0unds said:

yea, I run HMP.alert w/EIS and have no issues. the only thing I do is exclude hmpalert.exe from monitoring within EIS.

Thank you m0unds,

Acadia

[ilowe 0]

I tried turning off the modem before booting this morning. I noticed that several services in the tray, bottom right, took over two minutes to load once the main booting had taken place. All the time these services were loading, EIS was flashing that it was trying to update, even though there was no internet connection! During this two minutes, if I tried to start a few other programs, they took ages. I sure am glad I no longer have these other programs in startup. Eventually EIS calmed down, and I was able to get my regular programs loaded. Then I turned on the modem, and about 5 minutes later I had the EIS message of update success.

Several times over the last 25 years I have saved a computer by simply delaying the programs. This includes once adding a 10 second delay in the bios settings of a HP laptop. 

I wonder: current EIS problems, many of them could be solved by building in some options for delays. You could start with delaying for five minutes the auto-update. NB NOT just delaying until the CPU reduced to less than 20%.

[GT500 573]

I apologize for those who had to wait for a day or two for the instructions on how to try the fix. I spent most of my Monday trying to come up with a better way to do it, and was never able to.

I think we'll have a beta available soon for those who want to wait for it. Once that's available, I can post some easy instructions here with a link to a batch file that installs the beta for you. 

[GT500 573]

We have a beta fix for the "unable to connect to service" issue that some of you have been experiencing. If anyone would like to try it, then here's how to install it:

1. Open Emsisoft Internet Security.
2. Click on Settings in the menu at the top.
3. Click on Updates in the menu at the top.
4. On the left, under Update Settings, click on the box to the right of Update feed and select Beta from the list.
5. Click on the Update now button on the right side.

If you can't open Emsisoft Internet Security, then you may need to start your computer in Safe Mode With Networking. Here's a link to instructions on how to do that.

[pereh 0]

@GT500:

- starting with version: the latest one before 2017.5 (about 12 days old)

- done as described above

- cold PC startup

- no problems, black screen etc. so far.

Automatic updates still disabled.

I found 2 new info messages in Windows event log which are new to me and did not occur before updating ESIS:

==================================================
Event Time        : 07.06.2017 11:30:43.086
Record ID         : 14434
Event ID          : 100
Level             : Information
Channel           : Microsoft-Windows-Diagnosis-DPS/Operational
Provider          : Microsoft-Windows-Diagnosis-DPS
Description       : Das Diagnosemodul {15FBA3B8-A37A-4F91-BDBA-FBB98FE804BF} (%SystemRoot%\system32\diagperf.dll) hat ein Problem für Szenario {2698178D-FDAD-40AE-9D3C-1371703ADC5B}, Instanz {6008F9E2-00FA-487F-9497-600EEF91CAD2}, ursprüngliche Aktivitäts-ID {2698178D-FDAD-40AE-9D3C-1371703ADC5B} erkannt.
Opcode            : Von einem Diagnosemodul wurde ein Problem festgestellt. (12)
Task              : Szenariozyklus (1)
Keywords          : Zyklusereignis-Szenario
User              : NT-AUTORITÄT\LOKALER DIENST
==================================================

==================================================
Event Time        : 07.06.2017 11:30:43.086
Record ID         : 14435
Event ID          : 105
Level             : Information
Channel           : Microsoft-Windows-Diagnosis-DPS/Operational
Provider          : Microsoft-Windows-Diagnosis-DPS
Description       : Das Diagnosemodul {15FBA3B8-A37A-4F91-BDBA-FBB98FE804BF} (%SystemRoot%\system32\diagperf.dll) hat die Problembehandlung für Szenario {2698178D-FDAD-40AE-9D3C-1371703ADC5B}, Instanz {6008F9E2-00FA-487F-9497-600EEF91CAD2}, ursprüngliche Aktivitäts-ID {2698178D-FDAD-40AE-9D3C-1371703ADC5B} gestartet.
Opcode            : Eine Szenarioinstanz wurde zur Problembehandlung weitergeleitet. (13)
Task              : Szenariozyklus (1)
Keywords          : Zyklusereignis-Szenario
User              : NT-AUTORITÄT\LOKALER DIENST
==================================================

And again a new error message in event log, followed by an info message. The error means that some strange 'Workgroup.1d' wanted to register on my router (...1), but the PC (...30) denied this. This is ok because the router is configured to deny any new automatic insertion of device addresses. Could this be caused by ESIS?

==================================================
Event Time        : 07.06.2017 16:42:02.467
Record ID         : 1568
Event ID          : 1006
Level             : Information
Channel           : Microsoft-Windows-Dhcpv6-Client/Admin
Provider          : Microsoft-Windows-DHCPv6-Client
Description       : Die Routerankündigungseinstellungen wurden für den Netzwerkadapter 13 geändert. Das aktuelle Kennzeichen "M - Verwaltete Adresskonfiguration" ist true, und das Kennzeichen "O - Andere statusbehaftete Konfiguration" ist true. Benutzeraktion: Häufiges Auftreten dieses Ereignisses kann auf die häufige Änderung der M- und A-Kennzeicheneinstellungen des Routers im Netzwerk zurückzuführen sein. Wenden Sie sich an den Netzwerkadministrator, um das Problem zu beheben.
Opcode            : Routerankündigung wurde geändert. (13)
Task              : Medienstatusereignis (1)
Keywords          : 0x8000000000000000
User              : NT-AUTORITÄT\LOKALER DIENST
==================================================

==================================================
Event Time        : 07.06.2017 16:42:00.221
Record ID         : 298302
Event ID          : 4321
Level             : Error
Channel           : System
Provider          : NetBT
Description       : Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Opcode            :
Task              :
Keywords          : Klassisch
User              :
==================================================

 

Best Regards,

Peter.

[GT500 573]

Do you have UPnP turned off in your router configuration? If not, then I highly recommend that you do so, as it allows for routers to be hijacked. You may also want to reboot the router, make sure it has the latest firmware, make sure that it has a secure password, make sure that telnet access is turned off, and make sure that remote administration is turned off (assuming you have access to all of those settings).

If you're still seeing these Event Log entries after that, then let me know.

[T-RHex 2]

On 6/2/2017 at 9:51 AM, Acadia said:

QUESTION to all of you with this problem: how many of you have Malwarebytes PRO on your system?  Not the free version, but the Pro Real-Time program?
...
Just kill the real-time and startup protection, for me that took three untickings, you will still have the scanner at your disposal. I did this on both mine and my wife's pc.  Both have booted just fine five times in a row, and the EMI shield is now always green.

Sorry for the delay in responding ... I do have MBAM Pro 2.2 installed but not running; I do not have the Real-Time protection enabled.  I think you may just have been lucky.   But it looks like Emsisoft has a patch deployed now and so far after a few reboots it appears to be working okay for me.

On 6/5/2017 at 2:57 AM, ilowe said:

I am tempted to turn off my modem next few times I boot, since hopefully EIS will only try to update if there is a connection.
...
I tried turning off the modem before booting this morning. ... EIS was flashing that it was trying to update, even though there was no internet connection!

Most programs cannot detect whether or not there is a connection, they rely on timeouts: if there is no response from the server in a set time, then they assume there is no connection. But, they don't know that until they try to connect...

[GT500 573]

1 hour ago, T-RHex said:

Most programs cannot detect whether or not there is a connection, they rely on timeouts: if there is no response from the server in a set time, then they assume there is no connection. But, they don't know that until they try to connect...

Actually, they'll probably run into an error before even opening a connection, as they most likely won't be able to resolve the addresses of whatever domain names they use.

[ilowe 0]

One piece of anecdotal evidence that may help. In my case, turning off the modem then cold booting then waiting until there were no more programs to load, avoided all the problems with EIS.

[GT500 573]

If anyone is experiencing a "missing or broken component" error on startup now, then we are working on a fix for that as well. A quick workaround is to check for updates, and if any of the Guards are turned off after that then you can manually turn them back on.

[Acadia 0]

So is this "unable to boot" bug actually now fixed (simple terms please for this simple mind)?  No need to reinstalled like last time?

Thank you, Acadia

[pereh 0]

@Acadia

I updated ESIS (is this the official abbreviation?) from pre-2017.5 to 2017.5.1.7567 on early morning 09.06.2017 and auto-updates every 2 hours.

All is quiet since then, no problems with cold or warm startups, everything seems to be well again...

 

Best Regards and thanks to Emsisoft,

Peter.

[GT500 573]

On 6/10/2017 at 2:11 PM, Acadia said:

So is this "unable to boot" bug actually now fixed (simple terms please for this simple mind)?  No need to reinstalled like last time?

I am not aware of any such issues with the currant stable version of Emsisoft Internet Security. If you haven't given it a try yet to confirm the issue is resolved, then I recommend doing so, as the only real issue that people are experiencing is the error about a component being "missing or broken".

[GT500 573]

For convenience, here's a download link (so you don't have to go hunting for it):
http://dl.emsisoft.com/EmsisoftInternetSecuritySetup.exe

The above download will always be the latest version of EIS, and is rebundled every 24 hours with the latest database version to help reduce the amount of time you spend checking for updates after install.