LiquidTension

Hi @nickyr, Have you restarted the computer or used the "Quit Malwarebytes" option and relaunched the program since experiencing the last block on Excel.exe? If not, please perform one of these actions and verify Excel opens correctly.

Hello, Please provide the logs mentioned in the second post: https://forums.malwarebytes.com/topic/261136-outlook-been-block/?do=findComment&comment=1390348 In addition, please zip up and attach the following folder: C:\ProgramData\Malwarebytes\MBAMService\ARW Thank you!

Hi Ryan, We've began to notice a rising trend and are actively investigating. Could you provide us with the logs mentioned in the post above please so we can take a closer look. Thank you!

Hi @nt albert, Instructions can be found here: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline The tool will create a file on your desktop named mbst-grab-results.zip, which can be attached in a new forum post.

Hi @OrangeSour, As mentioned above, rebooting the computer should be sufficient in resolving this. If you are running Windows 10, ensure the "Restart" option is used and not "Shut down". If you encounter the issue again, you will need to add a temporary exclusion for excel.exe until we can fix this issue. See here: https://support.malwarebytes.com/hc/en-us/articles/360038479234-Add-to-the-Allow-List-in-Malwarebytes-for-Windows-v4 Please provide us with the mbst-grab-results.zip file created by the Malwarebytes Support Tool so we can take a closer look at the issue.

Hi @truth51, Thank you for the report. Please restart the computer and try to run Word. If you encounter the issue again, you will need to add a temporary exclusion for Winword.exe until we can fix this issue. See here: https://support.malwarebytes.com/hc/en-us/articles/360038479234-Add-to-the-Allow-List-in-Malwarebytes-for-Windows-v4 Please run the Malwarebytes Support Tool so we can take a closer look at the detection: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

Hi @tgouws, Thank you for the report. Please run the Malwarebytes Support Tool so we can take a closer look at the detection: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

Hi @Nerds, Thank you for the file. We're currently reviewing the data. Unfortunately, we've been unable to reproduce this issue in all our attempts. Are you able to actively reproduce it on a consistent basis (e.g. by installing an older version and then upgrading)? If you are, it would be a big help if we could obtain some additional troubleshooting data: Process Monitor log as the issue is reproduced: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon (from start to finish of the upgrade attempt). Zipped up contents of C:\ProgramData\Malwarebytes\MBAMService\Logs and C:\ProgramData\Malwarebytes\MBAMService\ARW. Farbar Recovery Scan Tool logs: https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs

Thank you for the report. We have a defect filed and hope to address this as soon as possible. As mentioned above, closing and reopening the user interface will indeed result in the correct state being reflected.

Hi @miguelgrado, Thanks for the report. We have a defect filed and will be addressing it as soon as possible.

Hi @alexl010, Thank you for your patience with this issue. Yes, progress has been made. A fix for this is available to Malwarebytes Anti-Ransomware standalone, Malwarebytes version 4 and Malwarebytes Endpoint Security users. Unfortunately, we aren't yet able to release this fix to Malwarebytes Endpoint Protection and are currently in the process of working towards this. We intend on making this available as soon as possible.

Hi @Nerds, When you encountered the program being blocked from running by Ransomware Protection, were you notified of the block by Malwarebytes or was this silent? Please could you run the Malwarebytes Support Tool so we can gather more details on the Ransomware block: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

Hello, It was most likely the copy to desktop operation that failed. Does the following file exist? %temp%\mwb*tmp\mbst-grab-results.zip (the '*' represents random characters)

Hi all, There are different root causes to this issue. For some users, this issue may be caused by third-party software uninstalling the tunnel driver used by Malwarebytes Privacy from the driver store. This behaviour has been exhibited by third-party software such as Advanced SystemCare. For these cases, the steps listed above by Jack2211 will indeed (temporarily) solve the issue. We will be releasing an update that automatically fixes this issue when the driver is unexpectedly uninstalled. In the case of AussieKev, this issue was caused by something unrelated and we will also be releasing an update to automatically fix this in the future.

Hi @EslamEl-Deeb, After uninstalling Wintun-Windows and reinstalling Malwarebytes Privacy, did you see the following prompt? Did you click Install?

Hi @yerbmeld, Thanks for the file. We're currently working on a permanent solution. For now, can you try adding 5E9828D182B2C5FED6E0036859D47D05 as a "Allow a previously detected exploit" exclusion?

Hi @anyWARE-Mainz, Please run the Malwarebytes Support Tool on the affected machines and gather logs: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline The logs provided will help us investigate this issue further.

The dump wasn't conclusive, unfortunately. However, we have seen this same bugcheck on other machines and dumps from those implicate Plex in the crash. Is Plex running whenever the BSOD occurs? As a test, could you disable Plex and see if this has any impact on the issue?

Hi @throkr, We're going over the data currently. I'll share an update once available. We haven't been able to reproduce the drive letter issue. We'll probably need to take a closer look at that shortly.

Thank you. We have a defect filed for this and will address it in a future update.

Thank you. Unfortunately, it looks like temp was cleared, so we don't have any setup logs to review. During the 1 hour without progress, what did you see? Was only the Malwarebytes UI visible or are you referring to the Malwarebytes installer? Could you provide logs from the Malwarebytes Support Tool please so we can take a closer look?

As you found earlier, the issue was not exhibited with the standalone Anti-Ransomware beta. Is this still the case? Please see my previous post.

Hello, Could you zip up and provide us with C:\Windows\MEMORY.dmp please? You have a bunch of different security products installed. Would you be able to temporarily disable or uninstall these and check if the BSOD persists? Does the BSOD occur randomly or only after a particular set of actions?

Hi @AussieKev, Someone will follow-up with you shortly. Could you let us know if you've used Laplink PCmover Professional recently?

Hello, This is now live in the main Malwarebytes program.