Issue with recent HEAT EMSS Antivirus definition files from February 3, 2016

Version 1

    Details

    This article discusses an issue with Antivirus definition files  releases: 1454515923 (64-bit Definition) and 1454534803 (32-bit  Definition).


    Resolution

     

    On Feb 3rd, HEAT EMSS AntiVirus customers reported an issue with slow scanning times and negative endpoint performance.  The issue was associated with the following AV file versions:

    • 1454515923 (64-bit Systems)
    • 1454534803 (32-bit Systems)

    The issue was addressed by updating to a later version of the AV definition files. 

     

    Root Cause


    Following investigation, HEAT Software confirmed that the issue was caused by a race condition in the AV scan engine due to new features implemented in the scan engine.  Because of this race condition, when the AV scan engine was reinitialized during the loading of a new set of AV definition files, the previous engine could not be unloaded, resulting in the performance and slow scanning issues experienced by HEAT EMSS AntiVirus customers.


    The issue was addressed by our AntiVirus partner on Feb 23rd and customers will not experience this issue with any AV definition versions after that date.  While the issue was only observed with the specific versions listed above, it had the potential to occur with any definition version up to Feb 23rd.

     

    Future prevention measures

    This issue was not detected by our AntiVirus partner's own internal QA test procedures. They have since made improvements to their QA process following this issue and have added a specific test for this scenario to avoid a reoccurrence of this issue in future.