"Malfunction"

Simon

For two days running now, from a cold boot, I have received a popup flyer saying that FS Protection has 'malfunctioned', and I need to restart my computer. The first time, which was yesterday, I did restart my PC, as everything seemed to be grinding to a halt, and FS then started successfully. Today, I received the flyer again, and have not restarted my PC this time, but instead, did an FSDIAG to try to 'capture' the malfunction. In the time the support tool took to complete (about 3-4 minutes), the error message went away, and on checking the UI, FS reports to be functioning correctly.

So, it seems something may be delaying FS from starting correctly from a cold boot, but then it may be rectifying itself after a period of time. This seems to have started happening since a new version of MalwareBytes Anti-Malware was installed (23/3/16), but I'm not sure of the issue is connected.

 

Has anyone else had a similar problem?  I have filed a bug report, but thought I'd post on here as well.

Ukko

Hello,

 

Maybe your experience indeed based on MBAM as trigger/reason for FS Protection flyer.

My experience with FS Protection same with days before (did not trigger notification-flyer) - and I do not use MBAM.

 

Maybe you able to check... if MBAM possible to "turn off" from autorun/autocheck updates?

Previously MBAM have hard design about network "connections" and as result can be too-usage and double-hook by MBAM/FS Protection. For example, if MBAM goes to create network connection for "re-check" license status or check updates.

Or simply.. if MBAM prevent FS Protection "services" to be loaded briefly (as result - time out or delay with common time).

 

Spoiler

With my previous experience about MBAM (outdated) and outdated machines time to time (or stable) comes with thngs, which close to your experience. Hard delay with work, temporary notification about troubles with FS Protection and other.

 

How can I to remember/thought/understand... there can be potential "reasons by MBAM": network usage or CPU usage. Such as... FS Protection triggered notification (which will be as temporary flyer), when there can be "time out" or "hard response". Possible to get this when system have overload for CPU/Disk/Memory usage.

 

Or... when Network connection prevented by something (hard usage) and FS Protection can to think that there something wrong (most likely.. can be during load system).

 

 

Ville

Hi @Simon

 

We have seen this before but haven't found the root cause. Sometimes the scanning module starts very slowly after Windows restart. This causes the GUI to timeout when querying the status and showing the malfunction dialog. It usually is enough to just wait 5-10 minutes and it will reconnect and status is OK. The problem is most likely in some of our very old components and we are not spending that much effort on fixing them any more. We plan to replace those components quite soon.

 

Ville

(F-Secure R&D)

 

yeoldfart

it's a good option

Simon

---

@Ville wrote:

Hi @Simon

 

We have seen this before but haven't found the root cause. Sometimes the scanning module starts very slowly after Windows restart. This causes the GUI to timeout when querying the status and showing the malfunction dialog. It usually is enough to just wait 5-10 minutes and it will reconnect and status is OK. The problem is most likely in some of our very old components and we are not spending that much effort on fixing them any more. We plan to replace those components quite soon.

 

Ville

(F-Secure R&D)

 

---

Hi @Ville

 

So, when this happens, has the protection actually activated, even with the 'malfunction' issue, or would the machine be unprotected until the GUI catches up with itself?

Ville

@Simon

 

In your report we saw again this slowness of scanning modules; a module that should start in less than 2 seconds took 2.5 minutes to start. This caused the malfunction. GUI is working just fine. Due to the problem being on the scanning module side it's likely that the protection is at least partially compromised.

 

We also still have no idea of the root cause. We can never reproduce the problem ourself. If you could check for example by uninstalling Malware Bytes if that has any effect, at least we could rule that out.

 

Ville

(F-Secure R&D)

 

Simon

@Ville

Curiously, it did it on my Windows 10 laptop as well last night, but it doesn't happen all of the time, which makes testing a little more challenging. I will uninstall Malwarebytes to see if this has any effect, and repost an FSDIAG via the beta portal.

yeoldfart

do you have mbam resident ?

Simon

On the Windows 10 machine?  Yes.  But, as Ville said, this issue has been present before, so I'm not convinced it can be attributable to MBAM.

Simon

Well, having uninstalled Malwarebytes earlier today and restarted the mahcine just now, the problem only seems to have got worse, as FS now doesn't want to launch at all.

 

 

Going to leave it a few minutes, while the FSDIAG is running, then will reboot as instructed.

 

I should add, both the Desktop and System Tray icons are present, but buth produce the above when clicked.  Rather worrying, as had I not been testing it, I might not have realised that FS wasn't running.