WSC Integration problems with latest version

[marko 12]

Since 2020.6 was released the other day, I'm been experiencing frequent problems with Windows Security Center not recognising that EAM is installed when I start up my machine (W10 Home 64 v1909).

It doesn't happen every time, but I often get a yellow exclamation mark showing on the Windows Security icon in the system tray and EAM is not shown as turned on in WSC.

On one occasion today, the protection panel in the EAM gui was Red (all protection disabled) with the message 'your computer is NOT protected' - Fix Now ! - when I clicked on Fix Now nothing happened so I had to reboot

On another occasion today, Web Protection was shown as disabled but I was able to turn this back on via the EAM gui.

I wasn't getting these problems before which suggests that they're happening because of the changes you've made to the WSC Integration in the latest version ?.

I have some debug logs if you want them.

[smf6199 4]

I've been seeing something similar as well this week.  EAM would be running, showing in the tray with protection enabled but WSC would show it as OFF (with Defender as ON having re enabled itself).  It also was not consistent and I did not see any exclamation marks (though I expect because Defender had enabled itself).

Reboots did not seem to solve it so as I was running the beta channel at the time I reinstalled and set to stable.  Only been 24hours but has been OK so far.

 

 

[GT500 835]

Try the following, and let me know if it helps:

1. Open Emsisoft Anti-Malware (EAM).
2. Go to Settings.
3. Click on Advanced in the menu at the top.
4. Disable the option for Windows Security Center integration.
5. Close EAM.
6. Right-click on the Windows Start button, go to Shut down or sign out, and select Restart from this menu to bypass Fast Startup.
7. Turn the Windows Security Center integration option in EAM back on.
8. Right-click on the Windows Start button, go to Shut down or sign out, and select Restart from this menu again.

[marko 12]

2 hours ago, GT500 said:

Try the following, and let me know if it helps:

1. Open Emsisoft Anti-Malware (EAM).
2. Go to Settings.
3. Click on Advanced in the menu at the top.
4. Disable the option for Windows Security Center integration.
5. Close EAM.
6. Right-click on the Windows Start button, go to Shut down or sign out, and select Restart from this menu to bypass Fast Startup.
7. Turn the Windows Security Center integration option in EAM back on.
8. Right-click on the Windows Start button, go to Shut down or sign out, and select Restart from this menu again.

ok have just tried that (I also toggled the EAM yesterday as it happens, and Fast Startup is disabled on my machine) and while it worked following a restart, I;ve just turned the machine on again (hard boot) and it's happened again - wsc showed 'getting protection info' and the revolving circle of dots for about 2 minutes

Download Image

then it gave up and now shows the yellow exclamation mark icon again

Download Image

I have debug logs for this if they're of interest

[stapp 150]

What happens when you turn cloud-protection on when this is happening?

https://www.top-password.com/blog/turn-on-off-cloud-based-protection-in-windows-10/ 

[marko 12]

32 minutes ago, stapp said:

What happens when you turn cloud-protection on when this is happening?

https://www.top-password.com/blog/turn-on-off-cloud-based-protection-in-windows-10/

I don't have the options shown at that link - when I click on the settings icon in the wsc, i just get this

Download Image

if I click on Manage Providers on this screen, it says EAM is OFF

Download Image

[stapp 150]

Is Windows trying to download any updates? (just thought I'd ask!)

When you get the 'problem' does EAM show as running in the taskmanager? 

Have you tried opening Taskmanager , going to the services tab,  and right clicking on SecurityHealthService (Windows Security) and selecting restart?

[marko 12]

1 hour ago, stapp said:

Is Windows trying to download any updates? (just thought I'd ask!)

nope, but thanks for asking 😉

1 hour ago, stapp said:

When you get the 'problem' does EAM show as running in the taskmanager?

yes, all 3 processes are running

1 hour ago, stapp said:

Have you tried opening Taskmanager , going to the services tab,  and right clicking on SecurityHealthService (Windows Security) and selecting restart?

Yes but it doesn't do anything when I do

I just restarted my machine again and now I have a green tick on wsc icon and when I open it it shows this (even though EAM is running with all protection enabled

Download Image

 

[GT500 835]

I would believe that @Frank H sent you a private message to ask you to try something. Don't worry about filling me in on how it's going, as Frank should do that himself.

[Raynor 4]

I'm also seeing the WSC tray icon yellow exclamation mark issue
on some of our company PCs with EAM 2020.06.

The message in WSC is the same message marko got (see marco's screenshot above):
"Cloud-delivered protection is off.
Your device may be vulnurable."

This issue is definitely new and connected to the 2020.06 update.

 

[GT500 835]

On 6/13/2020 at 9:52 AM, Raynor said:

This issue is definitely new and connected to the 2020.06 update.

In 2020.6 we added a new service for handling reporting to the Windows Security Center. As for why exactly WSC isn't reading the status of EAM correctly, we're not certain if that's a bug on our side or Microsoft's (WSC has always been flaky).

The only known fix for this issue right now is to uninstall EAM, restart the PC twice, and then reinstall EAM. We recommend downloading from MyEmsisoft if you already have an account, otherwise you can find alternate downloads at the link below:
https://help.emsisoft.com/en/1597/download-installation/

[JeremyNicoll 75]

> We recommend downloading from MyEmsisoft if you already have an account, otherwise you can find alternate downloads at the link below...

Why?   What's so special about MyEmsisoft (which needs one to login), compared with the downloads page (immediately accessible)?

[GT500 835]

On 6/16/2020 at 4:17 AM, JeremyNicoll said:

Why?   What's so special about MyEmsisoft (which needs one to login), compared with the downloads page (immediately accessible)?

If an EAM installation is not already in a workspace, then it can be easily added to one by downloading via the "Add device" button in your workspace's overview in MyEmsisoft.

Downloads from MyEmsisoft should also already be linked to your account, and not require activation.

[JeremyNicoll 75]

OK, ta. I'll try to remember that. 

[eliastz 4]

On 6/16/2020 at 5:04 AM, GT500 said:

In 2020.6 we added a new service for handling reporting to the Windows Security Center. As for why exactly WSC isn't reading the status of EAM correctly, we're not certain if that's a bug on our side or Microsoft's (WSC has always been flaky).

The only known fix for this issue right now is to uninstall EAM, restart the PC twice, and then reinstall EAM. We recommend downloading from MyEmsisoft if you already have an account, otherwise you can find alternate downloads at the link below:
https://help.emsisoft.com/en/1597/download-installation/

My WSC does not recognise EAM either. Recommending that we should "uninstall EAM, restart the PC twice, and then reinstall EAM", on top of having to constantly disable and re-enable  EAM components to deal with the still unfixed issue of excessive CPU usage, is uncceptable for a piece of software that is not exactly cheap. 

[GT500 835]

On 6/20/2020 at 3:37 AM, eliastz said:

Recommending that we should "uninstall EAM, restart the PC twice, and then reinstall EAM" ...

Unfortunately that was the only fix that worked in testing. I'm sure our developers will look in to why it's happening so that it doesn't remain an issue, but for now the only way to fix it is a reinstall.

 

On 6/20/2020 at 3:37 AM, eliastz said:

... for a piece of software that is not exactly cheap.

I thought $30 for a 1-year 1-PC license was about $10 to $20 less than what more recognizable companies tend to sell their products for. Does anyone sell licenses for full Anti-Virus software for less than us (overlooking "free" Anti-Virus of course).

[eliastz 4]

With all due respect, disabling/re-enabling, unistalling/re-installing are fob-offs not fixes. I wonder how many people will be rushing to renew their EAM licenses following the disastrous updates that have been pushed out since around February. Most reputable companies seem to have good offers right now; e.g., $30 for Bitdefender antivirus, whose engine EAM uses (3 devices), $28 for Kaspersky Internet Security (3 devices). I do like EAM and have been using it for many years on multiple computers, but some of us have neither the time nor the inclination to be constantly fiddling with it in order to make it work.

[GT500 835]

3 hours ago, eliastz said:

With all due respect, disabling/re-enabling, unistalling/re-installing are fob-offs not fixes. I wonder how many people will be rushing to renew their EAM licenses following the disastrous updates that have been pushed out since around February. Most reputable companies seem to have good offers right now; e.g., $30 for Bitdefender antivirus, whose engine EAM uses (3 devices), $28 for Kaspersky Internet Security (3 devices). I do like EAM and have been using it for many years on multiple computers, but some of us have neither the time nor the inclination to be constantly fiddling with it in order to make it work.

Every software company goes through occasional periods where their software has bugs. We understand it's frustrating, but we had to make a lot of changes to Windows Security Center integration to meet Microsoft requirements going forward, and with changes like that it's not abnormal for there to be at least a few bugs.

Keep in mind as well that problems with Anti-Virus registration with the Windows Security Center aren't uncommon regardless of whose Anti-Virus you're talking about. Microsoft API's aren't always bug-free either.

[Quirky 6]

Same problem here, most probably since 2020.6. None of your suggestions work. EAM 2020.7.2.10280

 

Download Image

[stapp 150]

@Quirky

Only had this problem once, however it did not say I was unprotected in the Windows Security Center.

 https://support.emsisoft.com/topic/33768-defender-notification/

 

[marko 12]

2 hours ago, Quirky said:

Same problem here, most probably since 2020.6. None of your suggestions work. EAM 2020.7.2.10280
Download Image

it's odd that windows defender isn't shown either - what does it show if you click on 'Manage Providers' at the right of the Virus and Threat Protection screen ?

[Quirky 6]

I've permanently disabled Defender so even if EAM is uninstalled, Defender will not kick in automatically. On Manage Providers, both EAM and Defender are reported as 'turned off'.

 

[marko 12]

5 minutes ago, Quirky said:

I've permanently disabled Defender so even if EAM is uninstalled, Defender will not kick in automatically. On Manage Providers, both EAM and Defender are reported as 'turned off'.

 

if you click on where it says Eam is turned off, a button should appear where you can turn it on - might be worth seeing if this helps ?

[GT500 835]

20 hours ago, Quirky said:

Same problem here, most probably since 2020.6. None of your suggestions work. EAM 2020.7.2.10280

You uninstalled EAM, restarted your computer twice, and then reinstalled EAM?

Can you let me know if a program called eppwsc.exe is running?

[Quirky 6]

Admittedly, I had not tried the second restart. I wonder why this extra restart makes a difference. Isn't one restart enough to unload drivers etc.? Anyway I did try it and for now, the issue has not reappeared. As marko mentioned though, the issue does not happen always. If it reappears, I will post again.

Eppwsc.exe is running now but as mentioned, at the moment everything is working fine. I do not know if it was running when the problem was occurring.

[GT500 835]

15 hours ago, Quirky said:

I wonder why this extra restart makes a difference. Isn't one restart enough to unload drivers etc.?

If for any reason Windows isn't able to remove files scheduled for delete on reboot on the first restart, then it needs a second one to complete the process. Unfortunately it's not something we have control over.

 

15 hours ago, Quirky said:

Eppwsc.exe is running now but as mentioned, at the moment everything is working fine. I do not know if it was running when the problem was occurring.

If it happens again and that process isn't running, then that would explain why the issue is happening. It's what handles reporting to the Security Center.

[Quirky 6]

1 hour ago, GT500 said:

If it happens again and that process isn't running, then that would explain why the issue is happening. It's what handles reporting to the Security Center.

Problem just reappeared and eppwsc.exe is running.

[marko 12]

9 minutes ago, Quirky said:

Problem just reappeared and eppwsc.exe is running.

it might be because you didn't reboot twice after uninstalling EAM and before reinstalling it ?

I found this old thread which, assuming it's correct, explains why two reboots are required https://support.emsisoft.com/topic/9885-why-reboot-twice-to-uninstall/

[Quirky 6]

I said on my previous post that I did perform the complete uninstall/reinstall 2x restart procedure, after having already tried several other suggestions (clean uninstall with single restart, sfc /scannow etc.).

[marko 12]

2 minutes ago, Quirky said:

I said on my previous post that I did perform the complete uninstall/reinstall 2x restart procedure, after having already tried several other suggestions (clean uninstall with single restart, sfc /scannow etc.).

so you did - my apologies - I read the first sentence but not the second

[Quirky 6]

Some more info. The problem does not go away from Windows' own controls i.e. trying to re-enable protection from within WSC. Nothing happens.

The problem does go away if I shut down EAM (right-click/shut down protection) and relaunch it. This session will keep working fine. This is not permanent though, since on a future PC restart the problem will eventually reappear.

[GT500 835]

20 hours ago, Quirky said:

This session will keep working fine. This is not permanent though, since on a future PC restart the problem will eventually reappear.

So it only happens on startup then, and not just after the system has been running for some time?

[Quirky 6]

Exactly, although in general WSC does seem slow in getting the system "status", so the issue will appear 1-2 minutes after startup has fully concluded. I have a slow PC anyway.

[GT500 835]

4 hours ago, Quirky said:

Exactly, although in general WSC does seem slow in getting the system "status", so the issue will appear 1-2 minutes after startup has fully concluded. I have a slow PC anyway.

Could you attach logs from FRST to a reply? You can find instructions for downloading and running FRST at the following link:
https://help.emsisoft.com/en/1738/how-do-i-run-a-scan-with-frst/

Note: When FRST checks the Windows Firewall settings, Emsisoft Anti-Malware's Behavior Blocker will quarantine it automatically. This can be avoided by clicking "Wait, I think this is safe" in the notification that is displayed while FRST is scanning.

[GT500 835]

We'll also need debug logs if that's not too much to ask.

1. Open Emsisoft Anti-Malware.
2. Click on the little gear icon on the left side of the Emsisoft Anti-Malware window (roughly in the middle).
3. Click Advanced in the menu at the top.
4. Scroll to the bottom of the Advanced section, and change the option for Debug logging to Enabled for 1 day.
5. After that, close the Emsisoft Anti-Malware window.
6. Reproduce the issue you are having (restart the computer so that the Security Center fails to read Emsisoft Anti-Malware's status).
7. Once you have reproduced the issue, open Emsisoft Anti-Malware again.
8. Click on the little icon in the lower-left (right above the question mark) that looks like little chat bubbles.
9. Click on the button that says Send an email.
10. Select the logs on the right that show today's dates (if you try to send too many logs, then we may not receive them).
11. Fill in the e-mail contact form with your name, your e-mail address, and a description of what the logs are for (if possible please leave a link to the topic on the forums that the logs are related to in your message).
12. If you have any screenshots or another file that you need to send with the logs, then you can click the Attach file button at the bottom (only one file can be attached at a time).
13. Click on Send now at the bottom once you are ready to send the logs.
    

Important: Please be sure to turn debug logging back off after sending us the logs. There are some negative effects to having debug logging turned on, such as reduced performance and wasting hard drive space, and it is not recommended to leave debug logging turned on for a long period of time unless it is necessary to collect debug logs.

[Quirky 6]

I will attach those, but not here. I'll send you a PM (or email if you prefer). You'll also have to wait until I see the issue again, it works fine at the moment.

[GT500 835]

Sure, you can send logs in a private message.

Technically the FRST logs can be sent at any time, but if you want to wait until the issue happens then run FRST after collecting and sending debug logs. FRST will add the last 10 errors from the Windows Event Logs to its Addition log file, so if it's been too long since the last time the issue has happened then we may not see it in the FRST logs.

[Quirky 6]

I'm a bit confused with the EAM logs procedure. I thought it'd just collect them right AFTER the issue occurs (or while it is occurring), but your instructions seem to indicate that I should first enable logging (when the issue is NOT occurring), and then wait for the issue to appear. Remember that I cannot trigger it reliably. Restarting the PC will not always initiate the problem.

[JeremyNicoll 75]

EAM's debug logging (which is completely different from the Forensic log) creates a lot of extra log data.  It's a continual trace of what EAM is doing internally.  It has to be on before the problem happens so that those logs show the logic of what EAM was doing when it hit the problem, and what it did next.   Some people (me, for example) almost always have debug logging on... but I stop and start it every three or four days and throw away the accumulated log files.  However whenever I have a problem I already have the logs to send to Emsisoft. 

Debug logging will slow your machine down though, especially if your disks are spinning rust; it's not so bad with SSDs.  And, if you turn the logs on and forget about it, they could fill up your disk.

FRST's logs are quite different.  They're a snapshot of the machine state (critical registry keys, DLLs, eventlog records etc) at the time that FRST is run.

[GT500 835]

@JeremyNicoll is correct. The logging is left off by default due to the drawbacks he mentioned, and needs to be turned on before an issue occurs in order to capture it in the logs when it happens. If necessary you can set logging to remain on for several days, or even indefinitely if necessary, and then just turn it off once you get the logs for us.

[Quirky 6]

Logs sent. The EAM logs were sent while the issue was occurring. Rather unusually, the issue sorted itself out this time so when FRST logs were being collected WSC was working normally.

I was in the middle of rebooting my router during the log collections, but it should be irrelevant.

[GT500 835]

I can see the following entries from the event logs related to EAM. Do these correspond to times you powered on/restart your computer and had this issue?

Error: (07/25/2020 05:52:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: a2service.exe, version: 2020.7.2.10280, time stamp: 0x5f031bef
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000001f0fd8
Faulting process id: 0x708
Faulting application start time: 0x01d66291490423e9
Faulting application path: C:\Program Files\Emsisoft Anti-Malware\a2service.exe
Faulting module path: unknown
Report Id: 0aca9096-9738-4163-815c-30b4bf1622dd
Faulting package full name: 
Faulting package-relative application ID:

Error: (07/24/2020 02:34:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: a2service.exe, version: 2020.7.2.10280, time stamp: 0x5f031bef
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000001f0fd8
Faulting process id: 0x6f4
Faulting application start time: 0x01d6619cd3231f0a
Faulting application path: C:\Program Files\Emsisoft Anti-Malware\a2service.exe
Faulting module path: unknown
Report Id: 2765a22c-4860-40b7-a6f2-adb3f2ce26f2
Faulting package full name: 
Faulting package-relative application ID:

Error: (07/25/2020 05:53:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Emsisoft Protection Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (07/24/2020 02:34:42 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Emsisoft Protection Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.

 

[GT500 835]

I've forwarded all of your logs to QA as well so that they can look into this further.

[Quirky 6]

3 hours ago, GT500 said:

I can see the following entries from the event logs related to EAM. Do these correspond to times you powered on/restart your computer and had this issue?

I'm not sure. The issue appeared yesterday (07/25) when the logs were collected and sent but perhaps it starts occurring during the shutdown process (previous day, 07/24) and the consequences appear on the next startup? Can't say.

[marko 12]

I'm wondering whether the a2service crash was caused by disabling debug logging as this happens on my machine, without fail, shortly after I disable debug logging and has been for at least two years.

I know we've discussed this at length in the past GT500 so I don't want to sidetrack Quirky's issue, but maybe Quicky's crashes are caused by turning debug logging off rather than being related to wsc integration ?

I've never understood why EAM doesn't log the times when debug logging is enabled or disabled and show them in the Forensic Log - surely it should do, like for every other changed to Settings.

[GT500 835]

20 hours ago, Quirky said:

I'm not sure. The issue appeared yesterday (07/25) when the logs were collected and sent but perhaps it starts occurring during the shutdown process (previous day, 07/24) and the consequences appear on the next startup? Can't say.

It's possible that a2service is crashing during shutdown. Hopefully the debug logs will give us an idea of whether or not that happened.

 

19 hours ago, marko said:

I'm wondering whether the a2service crash was caused by disabling debug logging ...

I don't think that's the case here, however it would be relatively easy for @Quirky to check. All he'd have to do is turn debug logging on and off, and see what happens.

[Quirky 6]

I have a second PC (a laptop) with Windows 1909 which I think never displayed the EAM integration issue. Yesterday, I clean installed W10 2004 on it. Today, I'm getting the same EAM integration issue. I'll try to log this as well.

[marko 12]

2 hours ago, GT500 said:

I don't think that's the case here, however it would be relatively easy for @Quirky to check. All he'd have to do is turn debug logging on and off, and see what happens.

well, that's supposition, but all I'm saying is that the a2service crashes may have nothing to do with the wsc problem (I wasn't getting crashes when I had the wsc problem).  It strikes me that if Quirky has only had two a2service crashes recently, and if he has enabled debug logging twice recently, then it may be that the crashes were caused by debug logging being turned off, either manually or via the inbuilt timer.  For info, trying to test this by turning debug logging on and off again isn't as simple as it sounds as the crash sometimes won't happen for a few hours.

[GT500 835]

19 hours ago, Quirky said:

I have a second PC (a laptop) with Windows 1909 which I think never displayed the EAM integration issue. Yesterday, I clean installed W10 2004 on it. Today, I'm getting the same EAM integration issue. I'll try to log this as well.

We believe this issue is fixed in the latest beta:
https://blog.emsisoft.com/en/36723/emsisoft-anti-malware-2020-8-beta/

Here's how to install it:

1. Open Emsisoft Anti-Malware.
2. Click on the little gear icon on the left side of the Emsisoft Anti-Malware window (roughly in the middle).
3. Click on Updates in the menu at the top.
4. On the left, in the Updates section, look for Update feed.
5. Click on the box to the right of where it says Update feed, and select Beta from the list.
6. Right-click on the little Emsisoft icon in the lower-right corner of the screen (to the left of the clock).
7. Select Update now from the list.
   

[Quirky 6]

On 7/28/2020 at 4:58 AM, GT500 said:

We believe this issue is fixed in the latest beta.

Good news, thank you. Perhaps I'll try it on my laptop.

As for the main PC, I reverted to 1909. Another good lesson learned: never install Microsoft's first W10 release of each year (around March). If you have to update, go for the second one (around September) which is more like a service pack. Way more reliable (but still buggy, make no mistake)

In any case, I will report back if this problem re-appears whether in the beta, or the next stable EAM release.