Issues with Avast v18.6.2349 in Windows

[German]Users of Avast antivirus solutions seem to have been experiencing issues on Windows since late August 2018. This is probably due to an update to version 18.6.2349, which was released for Avast on August 28/29, 2018.

Bleeping Computer reports here that Avast and Malwarebytes are conflicting and causing issues in Windows after the last Avast update.

Avast V18.6.2349 is causing issues

Since August 2018, some users have reported issues in the Avast support forum. Here is the text of the thread starter:

latest update causes avast to become unresponsive

update 18.6.2349, since this update avast randomly becomes unresponsive and causes my whole computer to do the same all programs hang and computer has to be force closed. I am not convinced that my computer is being protected whilst this is happening. you guys broke it when are you going to fix it or can I have a link to the previous version which gave me 0 problems.

I am using avast I.S  on windows 7 pro  and runs alongside malwarebytes.

I have done a repair and reinstalled avast to no avail. Been using avast for a number of years now but will most likely by changing when subscription runs out as this is unacceptable.

So this is about the update v18.6.2349 of the Avast Internet Security Suite. Under Windows 7 Pro Avast hangs sporadically after installing this update. The user writes that he is simultaneously using malware bytes as virus protection.

In this Avast forum post a user reports that Avast's v18.6.2349 update blocks access to the Internet. Neither Firefox nor Microsoft Edge could open web pages under Windows 10. Could be eliminated by disabling Avast Web Shield.

Collision with Malwarebytes

Another user has even set up a fresh installation of Windows 7 Ultimate with Avast Internet Security. The scanner already freezes during Smart Scan of the current Avast version. A user then indicates a conflict with malware bytes:

I have been reading numerous posts regarding Avast issues with users that also run Mbam (malwarebytes) along side. It may be worth your while to completely uninstall malwarebytes with their uninstall utility (mb-clean)
Reboot and see if your PC runs smoother.

Although Avast and Malware bytes could be run in parallel until now, problems seem to have occurred since the last Avast update. This thread in the Malwarebytes forum also points to a conflict – although it was already started on August 22, 2018.

Well, it turns out that today there was an update of my Avast antivirus which I did and everything seemed perfect. Until recently I had to disable the "Web Protection" of Malwarebytes and there my problem arose.

When trying to reactivate the "Web Protection" does not work and if that was not enough, the Malwarebytes user interface does not respond. I tried to finish the process through the task manager and it does not work either, and doing it instantly also hangs the latter. Which leads me to do a manual shutdown of my pc.

This happens in my 2 pc. My questions are … Is there a list of exclusions for both Malwarebytes and Avast? o What is the cause of this serious problem? Attaching the respective registers of both Windows 8.1 and Windows 10

There, the user could no longer activate the web protection of malware bytes after the protection was switched off. The thread starter writes that he went back to a previous avast version and fixed the problem. As the thread progresses, it becomes apparent that the Real Site Protection avast function collides with Web Protection malware bytes. Avast developer Asyn tries a technical explanation and writes the following in Avast forum:

Dev-Info: Hallo, I'm responsible for Real Site protection in the Avast product. I have tested both products several minutes ago, and problem is only in MalwareBytes Web Protection activation process. It hangs the MB product completely.

If I disable Real Site, enable MB WebProtection and then enable Real Site again, everything works well.

Some more technical pieces of information:
Malware Bytes is trying to filter the UDP traffic (probably DNS). It's same as Real site does. If two products try to capture UDP traffic by Windows WFP technology, a UDP packet loop can occurs if it's not implemented correctly. We found this problem with several other products. It's caused by two WFP drivers, when each capture UDP packet generated by other, drop it and generate new one. But this new one is presented to first driver, captured, dropped, generated again and it can continue indefinitely.

We discussed the problem with Microsoft WFP developers, to try to find solution for the problem. Avast had some protection against this before, but it doesn't work every time. Then we implemented new solution recommended by Microsoft.

I can see from driver debugging, that it works, when both components are active (as described above). Problem is just in WebProtection activation process (not under my control, no time for reverse engineering). Seems that the MB UDP filtering solution is not compatible with MS recommended solution, but anyway, if you use capture, drop, create and inject new packet scenario for the UDP traffic, it's completely wrong and can cause conflicts with many products.

Disable real-time protection or remove Malwarebytes

The solution is to disable the Real Site Protection avast function or to disable real-time protection of malware bytes. In this post, a user suspects that the update results in an incorrect registration entry. He then listed the exceptions he defined in Avast in terms of malware bytes for the story to run again.

The other option would be to completely do without malware bytes. In the Avast forum thread linked above, someone posted a link to the Malwarebyte Clean Tool. This allows malware bytes to be removed in the hope that Avast will be able to fix this.

The Bleeping Computer article contains some hints to deactivate options. The case shows once again how unstable the whole topic of foreign virus scanners and Internet protection solutions, especially under Windows 10, have become. Under Windows 8.1 to Windows 10, Windows Defender virus protection is usually sufficient. Final question: Anyone affected by this problem?