[Fixed] VSSERV service keeps stopping/crashing

1 hour ago, maseren said:

/index.php?/profile/209053-dawgtanion/&do=hovercard" data-mentionid="209053" href="<___base_url___>/index.php?/profile/209053-dawgtanion/" rel="">@DawgtanionThats very strange. Considering i just tested 2016 and 2015 and the issue happened on all of them. 

hmmm perhaps its due to a specific plex setting or something with Windows, maybe i made a change that activated the bitdefender bug.

/index.php?/profile/209058-mascooby/&do=hovercard" data-mentionid="209058" href="<___base_url___>/index.php?/profile/209058-mascooby/" rel="">@MAscoobyNice suggestion, thanks, but it'd be a pain to have to go to the pc and reactive every single time

Just now, MAscooby said:

Indeed, but you can also trigger a PowerShell ****** to sleep 5 seconds and restart. ;-)

That's a bit beyond my knowledge sadly

/index.php?/profile/34114-georgia/&do=hovercard" data-mentionid="34114" href="<___base_url___>/index.php?/profile/34114-georgia/" rel="">@GeorgiaI need to know if i should go back to bitdefender 2017? i'm still on trial of 2015. 

If anyone wants to tackle this, it's been working well for me over the past few days...

I've got my system set up to monitor for the VSSERV service crashes in Task Scheduler using an "On an event" custom event filter trigger with the following XML:

<QueryList>

  <Query Id="0" Path="System">

    <Select Path="System">

    *[System[(Level=2) and (EventID=7034)]] 

    and 

    *[EventData[Data[@Name='param1'] and (Data='Bitdefender Virus Shield')]]

    </Select>

  </Query>

</QueryList>

Basically, it watches the System event log for a specific VSSERV "Error" (level 2) event ID (7034). When it triggers, it kicks off a PowerShell ****** that starts the service if it hasn't restarted itself.

I run powershell.exe via the task's "Start a program" action (and it runs as the user that I have logged in 24x7) with the following parameters:

powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File "C:\Scripts\Restart_VSSERV.ps1"

Here's the PowerShell ****** itself, which also updates the Application event log when it runs.

# PowerShell cmdlet to restart Bitdefender virus scan service (VSSERV)

$Service = Get-Service -ComputerName "Localhost" -Name VSSERV

# Check to see whether "VSSERV Restart" source exists in Application event log; if not, create it

$logSourceExists = [System.Diagnostics.EventLog]::SourceExists("VSSERV Restart");

if (! $logSourceExists) {

    New-EventLog –LogName Application –Source “VSSERV Restart”

}

# Check whether service is running; if yes do nothing, else start service.

if ($Service.status -eq "Running") 

{ 

    Write-EventLog -LogName Application -Source “VSSERV Restart” -EntryType Information –EventID 1 –Message "Service is running and no action has been taken."

    } else 

{ 

    Start-Service $Service

    Write-EventLog –LogName Application –Source “VSSERV Restart” –EntryType Information –EventID 1 –Message "Started the service because it was not running."

}

Pretty sure the user executing the Task Scheduler action has to be an admin & the task has to be set to run with highest privileges as well, but I haven't tinkered with that to know for sure how it'd run under an admin user that isn't logged in.

Having the exact same problem when I am using Plex sending to my Roku or other devices.  After using Plex Bitdefender will be disabled.

Windows 10 Creators Update and latest version of Bitdefender.  Usually don't even notice it is offline until I start a game or something that suddenly pops up MS Firewall and I realize Bitdefender has shutdown again.  Really annoying and no way around it so far.  Restarting the service sort of works as the tools don't fully startup again.  They simply keep saying to wait a few moments.

/index.php?/profile/209058-mascooby/&do=hovercard" data-mentionid="209058" href="<___base_url___>/index.php?/profile/209058-mascooby/" rel="">@MAscoobyyour fix is doing the job for now, anyway to have the auto restart for the service be behind the scenes? its sometimes popping up in front of my plex media player. That said, /index.php?/profile/34114-georgia/&do=hovercard" data-mentionid="34114" href="<___base_url___>/index.php?/profile/34114-georgia/" rel="">@Georgiaany updates on a permanent fix? MAscooby's solution is temporary and not very easy to implement for the general populace. Please let us know. 

i was unable to complete the method above provided

so i tried this way but cannot save it?  any help would be awesome.

6 hours ago, Yartting said:

i was unable to complete the method above provided

so i tried this way but cannot save it?  any help would be awesome.

/index.php?/profile/209290-yartting/&do=hovercard" data-mentionid="209290" href="<___base_url___>/index.php?/profile/209290-yartting/" rel="">@Yartting I don't think BitDefender lets you modify the Service properties. There might be a way around it (maybe boot into Safe Mode and see if you can save the changes), but I suspect it's intentional to stop malware from tinkering with the processes and services. It's also possible that BitDefender will reset itself to default even if you manage to change it in Safe Mode (although I haven't tried it).

11 hours ago, maseren said:

/index.php?/profile/209058-mascooby/&do=hovercard" data-mentionid="209058" href="<___base_url___>/index.php?/profile/209058-mascooby/" rel="">@MAscoobyyour fix is doing the job for now, anyway to have the auto restart for the service be behind the scenes? its sometimes popping up in front of my plex media player. That said, /index.php?/profile/34114-georgia/&do=hovercard" data-mentionid="34114" href="<___base_url___>/index.php?/profile/34114-georgia/" rel="">@Georgiaany updates on a permanent fix? MAscooby's solution is temporary and not very easy to implement for the general populace. Please let us know. 

/index.php?/profile/209020-maseren/&do=hovercard" data-mentionid="209020" href="<___base_url___>/index.php?/profile/209020-maseren/" rel="">@maseren Make sure you select "Hidden" on the "General" tab of the task properties (ee the attached image), and make sure you have these command line switches added when you call PowerShell.exe: -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass

Any update or ETA on a fix?


This has been going on for over a month, crashes have been happening more often -- and even when I'm not streaming media through Plex -- and if I hadn't hacked together a PowerShell deadman ******, my PC would be completely exposed to malware despite the fact that I'm paying for a subscription to BitDefender.


More to the point, do I need to look for an alternative antivirus solution?

Still happening as of version 21.0.25.92.

Can you tell us whether excluding a particular binary or folder might help? I tried excluding the transcoder but it's still crashing.

On 5/31/2017 at 5:14 PM, MAscooby said:

Can you tell us whether excluding a particular binary or folder might help? I tried excluding the transcoder but it's still crashing.

In case anyone's wondering, I tried excluding the entire Plex program files directory, and I still get the crashes.

7 hours ago, maseren said:

So wait, now it's crashing without transcode?? 

Ok folks at bitdefender I'd like an answer, do your engineers know what the cause of this is? If so, is there any danger? Is it some kind of malicious code running in the background causing this? Please clarify work some details to encourage us to keep waiting for a fix. 

Bitdefender is highly rated currently, but something like this would end up counting against it at av comparative . Org. 

 

Thanks

I'm also now getting very frustrated with the lack of response from bitdefender, perhaps this is a fundamental problem with the application that's why its taking them so long to resolve.

Would like to start looking for alternative Antivirus applications but have almost a year left on my subscription, /index.php?/profile/34114-georgia/&do=hovercard" data-mentionid="34114" href="<___base_url___>/index.php?/profile/34114-georgia/" rel="">@Georgia would it be possible to arrange a refund?

15 hours ago, maseren said:

So wait, now it's crashing without transcode?? 

Ok folks at bitdefender I'd like an answer, do your engineers know what the cause of this is? If so, is there any danger? Is it some kind of malicious code running in the background causing this? Please clarify work some details to encourage us to keep waiting for a fix. 

Bitdefender is highly rated currently, but something like this would end up counting against it at av comparative . Org. 

 

Thanks

No... I was trying to exclude the transcoder and other Plex processes from causing the crash by excluding them from antivirus scans, but it doesn't seem to make a difference. 

If BitDefender devs could advise whether excluding certain files or processes might stop the crashes, that might be a better bandaid than the PowerShell ****** that I provided.

3 hours ago, Sorin G. said:

 

/index.php?/profile/209058-mascooby/&do=hovercard" data-mentionid="209058" href="<___base_url___>/index.php?/profile/209058-mascooby/" rel="">@MAscooby As you found out for yourself excluding the process will not avoid this glitch sadly. Best workaround is to avoid transcoding until a fix is released

/index.php?/profile/201429-sorin-g/&do=hovercard" data-mentionid="201429" href="<___base_url___>/index.php?/profile/201429-sorin-g/" rel="">@Sorin G. Can you clarify for us whether the VSSERV crash and "Bitdefender services are unavailable" error means the that antivirus services (and protection) are actually not working once this happens? Or is it simply that the UI is not responsive? 

On 6/8/2017 at 8:31 PM, Sorin G. said:

Hello,

Sadly, the best option isn't not to transcode, but to not use Bitdefender.

I agree with the comment about questioning how secure Bitdefender is if it can be so easily crashed by another process.

As loyal, paying customers of your product, can we please be told when this will be fixed? It's been several months and, with the trial period of another product about it end on my PC, I need to know if I'm buying another product or sticking with Bitdefender.

Like many, this will be the final straw. A previous Bitdefender bug already cost me thousands. I won't be back. And, as many of us are IT professionals, it is more than just one or two people. We can't recommend a product whose solution, when one is provided, is "don't use that other software as ours is broken" and then says nothing.

So please, be vocal, tell us something. Better yet, fix it so your software doesn't crash!

Thanks for the update. Good, Scooby's temporary solution has been good, but it often pops up in the middle of movie watching as it restarts the service. It'll be nice to do away with that. 

27 minutes ago, maseren said:

/index.php?/profile/209058-mascooby/&do=hovercard" data-mentionid="209058" href="<___base_url___>/index.php?/profile/209058-mascooby/" rel="">@MAscoobyYeah i can appreciate the frustration. Bitdefender has been a solid wall thus far, and no viruses have come through and in AV Comparatives they rank consistently high, but then again, so does Kaspersky, which is the main people i'd go to if this doesn't get fixed soon. It IS concerning that the service can be dropped so quickly. 

Anyways,i'm holding for now... 

Yep, no argument that it's been solid. I also understand that the number of people experiencing this issue is extremely small compared to the number of people who use BitDefender.

But the fact that the AV engine dies and is never restarted... That's worrying. It's pretty obvious that the service *can* be restarted -- since that's just what my PowerShell's doing -- so I'd feel a lot better about keeping it if someone from BitDefender could tell me that I'm still protected even when this condition strikes.

In any case, Kasperksy's good (as long as you're not too worried about their ties to Moscow ), as are several others. WebRoot is another option (although it's a fundamentally different beast and not for everyone), and its extremely small footprint's awfully nice.

On 7/3/2017 at 2:10 PM, arranh said:

For those with this problem, I've had confirmation that the fix will be rolled out within the next week.

Any news?