BUG - Constant disk read/write while Bitdefender is installed

That did not help. "My subscriptions" shows 3/3 licens used, but only 2 computers shows up in "My devices".

BTW why is my subscription showing "ACTIVE"? I don't have automatic renewal to my license??

Hi everybody; I just updated BD2019 to the build 23.0.14.61; it looks like the problem of the topic' subject has not been solved yet; just for your knowledge... I hope this trouble will be solved soon.

On 10/31/2018 at 11:54 AM, BDAlexS said:

The feedback I'm getting is that the issue is BD with bitlocker enabled if people can confirm.

Hi Alex,



You was asking before regarding Process Monitor. Sorry for showing up so late. But anyways the problem is still here.

Today I took some time to make screen shots and I could not reproduce the stack anymore where I saw the BitDefender module. It has disappeared.

I did some more research and checked for anything wmiprvse.exe is doing while we have the christmas tree lightning in effect.

I had the suspicion before that it was related to encrypted drives as it seems WMI is enumerating those drives at this stage and possibly retrieving whatever info it needs.

I looked for any failed registry or file operation and on close examination it seems that the (Microsoft) executable is querying a for a registry value having the path HKLM\Software\Policies\Microsoft\New Key #1\RDVConfigureBDE, which seems to be located usually in HKLM\Software\Policies\Microsoft\FVE and not New Key #1. After creating the value as a REG_DWORD of 0 it stopped flickering. Here is more explanations about what this registry value does: https://blogs.technet.microsoft.com/askpfeplat/2013/06/09/how-to-enable-user-based-controlenforcement-of-bitlocker-on-removable-data-drives/.

If one is using bitlocker to encrypt currently it is probably better to be careful and read it. Unfortunately I am relatively clueless about bitlocker.

I have not yet had time to compare the procmon result to a system without bitdefender installed, when the problem does not show up, to check for example if the registry value reappears at that location after removing bit defender or if possibly wmiprvse.exe's registry path is correct, without going to "New Key #1".

Maybe this could serve as another workaround that is more persistent. I will try now if it persists and update soon.



Step 1: Start ProcMon.Exe (https://docs.microsoft.com/en-us/sysinternals/downloads/procmon)

Step 2: Make sure to add wmiprvse.exe:

Step 3: Capture events by clicking on File -> Capture Events

Update: After a reboot the workaround is indeed persistent. As said before take some precaution if you should be using Windows bitlocker to encrypt disk volumes, before making this change. For whatever reason the value set before under "New Key #1" is moving to the Policies\Microsoft\FVE key, where it seems it should go to originally. What is funny now is that I can control the lightning via this value, setting it to 0 and the lightning stops, setting it to 1 and it begins again. Now we could create some cool light effects with that method!

This behavior could be normal due to the way regedit creates keys. At first the key is created as "New Key #1" and then renamed to the desired name. Could be some caching issue in either bd or procmon or maybe procmon is not tracking the API call that renames it, leading to the invalid path in the procmon log.

The default for this value is 1 by the way, if this value is not set. Setting it to 0 aborts whatever WMI is doing at this stage, regarding encrypted drive infos, causing the drive access to stop in turn. Just another workaround.

/index.php?/profile/215110-green456/&do=hovercard&referrer=https%253A%252F%252Fforum.bitdefender.com%252Findex.php%253F%252Ftopic%252F79879-bug-constant-disk-readwrite-while-bitdefender-is-installed%252F%2526page%253D5" href="<___base_url___>/index.php?/profile/215110-green456/" style="background-color:transparent;color:#4588c5;" title="Go to Green456's profile" rel="">Green456 Thanks

BD has no idea how to communicate with its customers, I think that is no different now....

3 hours ago, hpw said:

 

Well, tested this on my Labtop with HKLM\Software\Microsoft\Policies\Microsoft\FVE\RDVConfigureBDE to (REG_DWORD) 0 ...

Any plug-in of USB Sticks gets ignored... ... removed the DWORD key and rebooted and now USB gets recognized again ..

IMHO opinion, it's may a MS issue where the WMI gets into a loop.. BD should get in touch with MS as soon as possible while worldwide all disk gets

Hp

 

Are you sure? All this does is stop WMI from looking for bitlocker protected devices. The drive should not disappear at all during this process. Was your thumb drive possibly bitlocker encrypted? Mine is still working. You can even change the key at run time without a reboot to turn the lights on and off. The detection of USB devices happens somewhere totally else and below, encryption is much more on top of this.



Maybe BD has the time to compare both runs to see if there is any difference with wmiprvse.exe's behavior with BD installed and with BD uninstalled.



Did anyone try a bitlocker encrypted thumb drive on BD?



And yes, WMIPRVSE.EXE gets into a loop because it looks for encrypted drives (opening the device, sending some IO controls to the driver). It only does that if bitlocker is enabled, therefore no loop if value is set to 0.

3 hours ago, hpw said:

OK,

New boot new behavior as using 1809

1. The USB stick is pure NTFS

2.Applied the DWORD value again and reboot

3. Did the test again and the USB gets recognized

4. BUT the DISK READING was still present

5. applied the WMI pause what helped me on my single SSD Disk

 Cheers

Hp

 

Can you try to run procmon and upload a screenshot as I did? All file and registry access of WMIPRVSE.EXE. You should see any disk access. Just to make sure it is the same pattern of device IO controls repetitively being sent to the drive. Before the open/device, io control and close you should see that it checks if the mentioned value exists or is set to 1. That should not be OS dependent. Am using a USB thumb drive at this very moment too. Very strange. I used a Windows7 by the way. Can try later what happens on a Windows10.

14 hours ago, Green456 said:

Hi HP,



This is my bad. The correct path for the value is here:  HKLM\Software\Policies\Microsoft\FVE\RDVConfigureBDE and not HKLM\Microsoft\.



I posted it incorrectly one time in one of the postings above.

I just tried it with 1803 and it had the same problem (on my surface pro). This device has nothing installed except Office and Windows 10 (1803) and BD.



I think if you try it with that registry path again it should work. Sorry

Hi again,

well I had the key already at this position....

Also, started the latest Procmon even in admin mode and no events given.

On my system 1809, 0.1% Disk activity seen on Taskmanager on Registry & System process. Added them by PID and showed no traces.

May somethings is broken ... and behaviors are OS release dependent and may that's why BD has no solution while various issues are on varios OS releases... Just a guess.

Hp

same!

Windows 10 home 64 Build 18.09, Bitdefender  Total Security 2019 Build 23.0.14.61 Engine 7.78132.

When switch WLAN, or LAN on, vsserv.exe 30% CPU. When switch Wlan/Lan off, then vsserv.exe  0.13% CPU Last (!)

restartwmi.bat not work.

Firefox https to local printer not work. Certificat.  Install fake.cert not work.

I am very disappointed.

The fastest scanner in the test is now the slowest. Too bad.

On 11/6/2018 at 12:25 AM, Green456 said:

Strange. Procmon works on Windows 10. At least up to Windows 10 (1803), I am sure the new build is supported too. Did you select "Capture events..." from the menu to start capturing? Did you set the filter correctly? Once you produce a trace we can see what is happening and if it is the same problem at all. Another poster above confirmed it is working.

OK,

have ProcMon now running.... and after setting FVE...

1. HKLM\Software\Policies\Microsoft\FVE  = Success

2. HKLM\SOFTWARE\Policies\Microsoft\FVE\AllowSystemVolumeEncryption = NAME NOT FOUND " data-emoticon="" src="https://us.v-cdn.net/6031943/uploads/ipb_attachments/emoticons/default_laugh.png" title="" />

what do you have here? Also googled without success

While running 1809 Pro...

Cheers

Hp

21 minutes ago, Sergiu C. said:

Hi, 



We've released a new update that addresses this issue. the build number will not be changed, and the update has not been released to all our users yet, but we'll let you know once this has been done. 



Thank you. 

You may have indeed a very strange development practice...

>> the build number will not be changed,

And how a turtle may identify what kind of fish we have

Hp

2 hours ago, hpw said:

 

You may have indeed a very strange development practice...

>> the build number will not be changed,

And how a turtle may identify what kind of fish we have

Hp

An update without changing the build number?

Huh??

I have tried again ... just in case.

No changes, no changes at all.

It is getting harder and harder to promote your products ...

Dan, very disappointed Dan 

The same for me

Thank you for your work even if it was a bit long.

1 hour ago, Sergiu C. said:

Hello, 



We have started releasing the update to all our customers, you should receive it the next time Bitdefender checks for an update on your computer. The update requires a computer restart to be successfully installed.

 

You can also follow these steps:

- right click on the Bitdefender icon in the system tray

- choose Update

- once the update is completed restart your computer. 



As mentioned, the build number will not be changing, as build changes are reserved for our major updates that occur about once per month. You can however check the version of the following file, to see if the update was installed on your PC:

 

- go to C:\Program Files\Bitdefender\Bitdefender Security

- look for the file called RansomwareRecoverAl.dll 

- right click on it and choose Properties > Details

- file version should be 23.0.14.62 

 

Thank you! 

OK,  now removed the FVE stuff before SW update...

1.  PC (Win10 1809) Updated and did get the new DLL dated from 8-Nov-2018 14:19

2.  PC (win 10 1809) was a long time not online,

     - Updated and did not get the DLL yet

    - Then rebooted and updated, while requires at least the mentioned reboot

    - getting a very long restart screen ....

    - log in and then mira mira... the nice stinking fish is gone forever

hp

Yes. Finally the constant read-bug is gone, farewell, and we will NOT miss you!

BitDefender is back on track :-)

is this update addressing only this bug or any chance it will also fix other issues? (like not able to scan/print)

1 hour ago, coldlinks@mail.com said:

 

Just applied the update now via the tray icon. Can also confirm the issue appears to be resolved now.

34 minutes ago, svenohrberg said:

Yes. Finally the constant read-bug is gone, farewell, and we will NOT miss you!

BitDefender is back on track :-)

32 minutes ago, chrisj said:

I can also confirm that it's fixed - tested before & after with an external HD on 5 computers, Win7 & Win10.

Thank you all for confirming! 

Good about time  I can now stop using Linux. Perhaps we can have two months or more free added to our licenses eh?

10 hours ago, BDAlexS said:

Good about time  I can now stop using Linux. Perhaps we can have two months or more free added to our licenses eh?

Hi, 



Yes, this is something that we wanted to do. Please send me a private message with your email address for the Bitdefender Central account, and ticket ID (if you had opened one), and I will make sure this happens. 



Thanks! 

I followed Sergiu's directions and received immediate, favorable response.

15 hours ago, Doug said:

I followed Sergiu's directions and received immediate, favorable response.

 

Hi,

This may be a stupid question but I did not find how to send a private message to Sergiu as he suggested ?...

Thanks in advance for an helpful answer !

I have send Sergiu a PM yesterday with my emailadress used in my license and in BitDefender Central, but there is not anything added to my account. Still 129 days left. Why is it only some people getting this?

The additional time showed up immediately in BD Central, but took another day to show up in "My Account" on the dashboard. Looks like one sys had to sync with another. Check BD Central first.