EAM extremely problematic since 10/8 update.

[exindust]

Whatever was done in the last major update has caused so many issues for me across so many platforms I feel like I have spent the last two weeks troubleshooting issues caused by the last update. I have almost 300 licenses of EAM and I'm starting to think about dumping all of them because of all of the numerous issues.

1.) EAM causing websites to be blocked in IE... Chrome, Firefox, and Edge were unaffected. Confirmed issues that was resolved by having users us beta updates. 

2.) EAM possible causing occasional disconnected from Office 365 exchange. Not fully confirmed but multiple clients across multiple platforms in different locations have had to have their Outlook profiles re-created since Monday's (10/8) update.

3.) EAM causing Abacus (Legal Software) to not open/crash ... added to exclusions and the program opened but remains unstable.

4.) EAM causing intermittent disconnects for an entire dental office from their SQL based software (Eaglesoft), even after exclusions. Uninstalled on 4 out of 15 computers and those 4 stopped having issues, uninstalled on the rest of them and it seems to have stabilized and the disconnects have stopped.

 

What the heck happened in the last update ... I'm not looking forward to hearing from my other 250 people on Emsisoft after every update?

 

[Frank H]

Hi Exindust,

Did you open a support ticket with us ?

The 2018.9.1 hotfix release fixed the IE and blocked websites issue and fixed an issue where some apps were blocked because of an issue with DirectX,

https://blog.emsisoft.com/en/32162/emsisoft-anti-malware-2018-9-1/

We currently have released a hotfix2 to the beta update feed that fixes network related issues and rare instabilites on Windows x86 systems.

https://blog.emsisoft.com/en/32182/emsisoft-anti-malware-2018-9-2-beta/
 

it would be great if you could switch a few clients to the beta update feed, and feedback. if it resolves all issues we can release the hotfix to stable asap.

Thanks

 

 

[Alejandro]

On 10/10/2018 at 7:55 PM, GT500 said:

... We currently have released a hotfix2 to the beta update feed that fixes network related issues and rare instabilites on Windows x86 systems ...

I think the same issue happens on Windows 64 bits also:

2 instances of Emsisoft protection service "suspended", network disconnected and Windows frozen.

 

[GT500]

6 hours ago, Alejandro said:

2 instances of Emsisoft protection service "suspended", network disconnected and Windows frozen.

Let's try getting a log from FRST, and see if it shows the cause of the issue. You can find instructions for downloading and running FRST at the following link:
https://helpdesk.emsisoft.com/en-us/article/274-running-a-scan-with-frst

[Alejandro]

Sorry, I changed my mind.

 

 

[jedsiem]

 

vor 21 Stunden schrieb Alejandro:

I think the same issue happens on Windows 64 bits also:

2 instances of Emsisoft protection service "suspended", network disconnected and Windows frozen.

Since 2018.9 I see network-related issues around applications under Windows 7x64. No frozen EAM or Malware. Just disconnection of SQL connections or other network-connection between different applications. Still investigating if it really is EAM causing these issue or a different installation which replaced runtimes.
 

One application is a little LAN messenger called Squiggle. https://github.com/hasankhan/Squiggle
This began having issues after 2018.9. Crashes from time to time with errors around System.Net.Sockets.Socket and NetMQ.zqm.
I still cannot rule-out a change in the NET runtimes causing this issues, but the 2018.9 is on the list too 😉

Thanks for the forum and the discussion-style of the EMSI support team. It is very nice that issues are openly discussed.

@exindustI haven't seen issues around Office365 installations under Windows 10. Are you using Office 365 under Windows 7 or 10?

 

[Frank H]

it's always important to feedback on latest stable only, which is 2018.9.2 since yesterday night. 

Network related issues should have been fixed.
If you still experience network related issues, please open a support ticket at [email protected], so we can help you, get debug logs and eventually offer remote support to get them resolved asap.

Thanks

 

 

[Raynor]

On 10/19/2018 at 1:59 PM, jedsiem said:

 

Since 2018.9 I see network-related issues around applications under Windows 7x64. No frozen EAM or Malware. Just disconnection of SQL connections or other network-connection between different applications. Still investigating if it really is EAM causing these issue or a different installation which replaced runtimes.

There are more reports of SQL disconnection issues in the German forum even with v2018.9.2.8988 .
The delayed feed version 2018.6 is reported to work fine.

https://support.emsisoft.com/topic/30051-sql-verbindungsabbrüche-über-odbc/

Please make sure that all these issues are fully and thoroughly fixed before even considering
switching the delayed feed to anything newer than 2018.6!

SQL server connections are mission-critical in our company, and we depend on software reliability.
This is why we are useing the delayed feed.

If the delayed feed was switched to version that causes SQL connection issues, my bosses would
pretty much kill me leading to me probably having to ditch EAM as a security solution altogether.

I put my reputation on the line by telling everybody how great EAM was and that we should
therefore switch to EAM as our security suite.  Please do not let me down 😥

Quote

Network related issues should have been fixed.

This does not seem to be the case unfortunately...

 

 

[jedsiem]

vor 10 Minuten schrieb Raynor:

Please make sure that all these issues are fully and thoroughly fixed before even considering
switching the delayed feed to anything newer than 2018.6!

Do you run a test installation? Do me it looks like the surf protection is causing the connection issues with MS SQL. When runnning 2018.9.2.8988 with disabled surf protection I don't get any network-related issues either. Would be interesting to see if that is the case on other systems too.

[Raynor]

Unfortunately I don't have a test environment up and running at the moment, sorry.

But thanks for the heads-up about the surf protection. I might disable it using the
enterprise console as an extra security measure. But the issue of the surf protection interfering
with SQL connections must really be thouroughly solved before switching the delayed
feed to a newer version (see above).

 

[Frank H]

thanks for your feedback guys.

We're working on this issue.

Please note that the delayed feed only contains releases that are stable.

it contains 2018.6 currently and we will release 2018.8 to delayed in a week.

 

[Raynor]

Thanks for the info. According to the reports 2018.8
should still be fine

[Javier Lopez]

Frank H. are we sure we want to take that risk regarding upgrading the delayed feed from 2018.6 to 2018.8

I like exindust have hundreds of clients on EAM. I can't go through another round of clients calling regarding disconnections.

 

 

[Javier Lopez]

Can someone explain what is the difference between running EMSIsoft in delayed vs Stable. Is it the detection engine that is not up to date?

[jedsiem]

vor 3 Stunden schrieb Javier Lopez:

Can someone explain what is the difference between running EMSIsoft in delayed vs Stable. Is it the detection engine that is not up to date?

Difference is in program code. So detection engine can be different. Signature updates are done in beta,stable and delayed.

Older versions of EAM offering direct infos about the version used. I'm still not getting this kind of details infos with the newer EAM versions.
Not sure why the developers start to hide or move these infos.

The problematic disconnection issue was introduced with 2018.9.  The 2018.8 didn't show that issue.

 

[jedsiem]

What parts of EAM are still active when all four protection systems are disabled?

After running hours of tests, I was able to get crashes from Squiggle (OpenSource LAN Messenger) with all four protection systems disabled under 2018.9.2.8988. Under 2018.6.0.8750 I didn't get the crashes from Squiggle (6 days running without a crash). My first idea with Surf protection causing the issues seems to be wrong.

[Frank H]

4 minutes ago, jedsiem said:

What parts of EAM are still active when all four protection systems are disabled?

there sits an issue in one of our drivers related to network traffic and we tying to fix that atm.

In some cases, switching off surf protection fixes the issues, in some cases it doesn't.

[Frank H]

8 hours ago, jedsiem said:

. I'm still not getting this kind of details infos with the newer EAM versions.

you can find the program version and license information under the About link in the right bottom of the overview panel 

[jedsiem]

vor 3 Minuten schrieb Frank H:

you can find the program version and license information under the About link in the right bottom of the overview panel 

I don't see the exact versions of the EMSI and Bitdefender versions there. Only the EAM version.

 

[Frank H]

12 hours ago, Javier Lopez said:

Frank H. are we sure we want to take that risk regarding upgrading the delayed feed from 2018.6 to 2018.8

There is no risk with 2018.8, this version is stable.
Version 2018.9 includes a new Surf Protection module, which unfortunately causes rare network related issues.

[jedsiem]

vor 6 Minuten schrieb Frank H:

there sits an issue in one of our drivers related to network traffic and we tying to fix that atm.

Can you provide the driver file name?

[Frank H]

3 minutes ago, jedsiem said:

I don't see the exact versions of the EMSI and Bitdefender versions there. Only the EAM version.

Those versions provide no additional information for end users, that is why they were removed.

[Frank H]

7 minutes ago, jedsiem said:

Can you provide the driver file name?

makes no sense, as we are analyzing the issue atm

[jedsiem]

vor 36 Minuten schrieb Frank H:

Those versions provide no additional information for end users, that is why they were removed.

It that the case? Interesting kind of thinking.

vor 36 Minuten schrieb Frank H:

makes no sense, as we are analyzing the issue atm

I'm not sure, how you  come to the conclusion that it don't make sense to answer my question.

[GT500]

4 hours ago, jedsiem said:

Can you provide the driver file name?

I would believe he is referring to eppwfp.sys, which was added with the 2018.9 release. 2018.8 should not have this driver, and should not have any of the issues you experienced after the 2018.9 release.

Builds pushed to the Delayed update feed are specially chosen after they have demonstrated better than average stability over a reasonable period of time (usually at least 30 days).

[jedsiem]

Am 25.10.2018 um 22:04 schrieb GT500:

I would believe he is referring to eppwfp.sys, which was added with the 2018.9 release. 2018.8 should not have this driver, and should not have any of

I don't know, that's why I'm asking 😉 I don't like the concept "We know what the enduser needs to know". You might hide things to not confuse users when interacting with support or others. But being able to see changes in engines via version number can help a lot. At least if you run testinstallations of beta,stable and delayed sidebyside.

After hours of testing with different scenarios, even the deactivation of the surfprotection in 2018.9 is not always working. The status is deactivated, but the surfprotection looks still on. Only the holistic deactivation ("Pause protection") via the 10min etc. menu is showing an impact when reproducing issue via e.g firefox downloads. When the indication of what is active or not, is buggy, the process of narrowing the issue is very difficult.

When most of the customerbase is "driven" onto delayed feed, you will get less information about issues in the future. So you rely on customers which run additional test-installations for beta and stable.

[GT500]

7 hours ago, jedsiem said:

I don't like the concept "We know what the enduser needs to know". You might hide things to not confuse users when interacting with support or others. But being able to see changes in engines via version number can help a lot. At least if you run testinstallations of beta,stable and delayed sidebyside.

I think what Frank was trying to say was that, due to the fact that we don't publicly document engine changes, the version number are essentially meaningless to anyone beyond our developers and QA team. The product version number is usually more useful to end users, as they can check our blog to see a list of the most significant changes for that version.

 

7 hours ago, jedsiem said:

So you rely on customers which run additional test-installations for beta and stable.

Almost every company that sells software relies on part of their user base to try betas and provide feedback. Different users tend to have different computer hardware and software, and many times the difference from one user's computer to another's can vary significantly. To be able to test all of the various hardware and software combinations would require more money than even Microsoft makes in a year, so like many software companies we offer public beta versions so that users can optionally try them before they are released for everyone, that way if there are any bugs we are more likely to catch them before a release goes public.

[Quirky]

I also confirm an unusual amount of issues (already reported) with some programs crashing or displaying high CPU usage, all caused by the recent EAM updates. 2018.8 is fine. Excluding/disabling doesn't work (this makes me wonder about the effectiveness of these options), only a full EAM uninstall does, or a switch to 2018.8.

[GT500]

13 hours ago, Quirky said:

I also confirm an unusual amount of issues (already reported) with some programs crashing or displaying high CPU usage, all caused by the recent EAM updates. 2018.8 is fine. Excluding/disabling doesn't work (this makes me wonder about the effectiveness of these options), only a full EAM uninstall does, or a switch to 2018.8.

Does the new beta help?
https://blog.emsisoft.com/en/32332/emsisoft-anti-malware-2018-10-1-beta/

Here's how to install the beta if anyone isn't already familiar with update feeds:

1. Open Emsisoft Anti-Malware.
2. Click on the little gear icon on the left side of the Emsisoft Anti-Malware window (roughly in the middle).
3. Click on Updates in the menu at the top.
4. On the left, in the Updates section, look for Update feed.
5. Click on the box to the right of where it says Update feed, and select Beta from the list.
6. Right-click on the little Emsisoft icon in the lower-right corner of the screen (to the left of the clock).
7. Select Update now from the list.
   

[exindust]

On 11/6/2018 at 3:55 PM, GT500 said:

Does the new beta help?
https://blog.emsisoft.com/en/32332/emsisoft-anti-malware-2018-10-1-beta/

Here's how to install the beta if anyone isn't already familiar with update feeds:

 

1. Open Emsisoft Anti-Malware.
2. Click on the little gear icon on the left side of the Emsisoft Anti-Malware window (roughly in the middle).
3. Click on Updates in the menu at the top.
4. On the left, in the Updates section, look for Update feed.
5. Click on the box to the right of where it says Update feed, and select Beta from the list.
6. Right-click on the little Emsisoft icon in the lower-right corner of the screen (to the left of the clock).
7. Select Update now from the list.

 

After spending an entire week troubleshooting Eaglesoft issues I was able to determine Emsisoft was the issue by removing it from 4/15 computers. I then removed it from the rest of them. THEN, same issue with another company who uses Sage, ALSO SQL based, frequent disconnects, poor performance. Emsisoft has been removed from their systems AS WELL, and the issues have stopped.

Now I'm dealing with issues where multiple clients across different offices, and different internet connections are unable to connect to Office 365 Exchange using Outlook 2013/2016. Computers will hang on "Loading Profile". Then prompt for credentials, then the correct credentials are entered and it asks over and over again for credentials.

I have spent hours trying to troubleshoot this with multiple clients over the past few weeks. With some a reboot fixes the issue, then it will return the next day, or the day after. I've tried re-creating profiles, I've tried full re installs of Office, the issue comes back after a day or two.

Why do I think this is an Emsisoft issue? Because this started when all of the other issues started.

I don't like being a BETA tester, especially when I am supposed to be a professional for these clients. They look to me for answers and solutions. If I sold them antivirus with the stipulation that they were going to be BETA testers for their own AV I'd look like a moron. Somehow I've been able to shift blame for these issues so that I don't look like a moron but were talking about 50+ users I've had to come into contact with over this stupid update. That has costed me HOURS AND HOURS of unbillable time because I sold this product to them.

 

I believe all of the clients that are having Outlook/Office 365 issues are running Windows 7 Pro x64 + Office 2013/2016 with EAM

[Quirky]

On 11/7/2018 at 1:55 AM, GT500 said:

Does the new beta help?

For the moment only Delayed helps, but I can't complain about your support which remains excellent.

[GT500]

23 hours ago, exindust said:

After spending an entire week troubleshooting Eaglesoft issues I was able to determine Emsisoft was the issue by removing it from 4/15 computers. I then removed it from the rest of them. THEN, same issue with another company who uses Sage, ALSO SQL based, frequent disconnects, poor performance. Emsisoft has been removed from their systems AS WELL, and the issues have stopped.

Now I'm dealing with issues where multiple clients across different offices, and different internet connections are unable to connect to Office 365 Exchange using Outlook 2013/2016. Computers will hang on "Loading Profile". Then prompt for credentials, then the correct credentials are entered and it asks over and over again for credentials.

Did yesterday's program update have any effect on these issues?
https://blog.emsisoft.com/en/32343/emsisoft-anti-malware-2018-10-1/

 

23 hours ago, exindust said:

I don't like being a BETA tester...

That's understandable, however please keep in mind that its best to have confirmation from those who are effected by an issue that a fix is working as expected before it's released in a stable update, so even if the beta could be tried on one or two systems then that would help with validating that the fix is ready.

 

23 hours ago, exindust said:

That has costed me HOURS AND HOURS of unbillable time because I sold this product to them.

Ask them to switch to the Delayed update feed. This feed exists primarily for corporate clients that can't afford downtime in case of a problem with an update. We only publish builds to this feed that have demonstrated better than average stability, so they shouldn't cause any problems with systems that need to have 100% uptime.