[Malwarebytes and 7zip library]

Hi @Malika4!!

Like you called out, the current release of Malwarebytes uses version 16.04 of the 7Zip DLL with CVE-2018-5996 and CVE-2017-17969. We are aware if this and are working on an updated release.

@jprism can you share some more info here?

[How to find licence key]

@bundyboy check your PM when you got a moment. It's good news.

[MB3 is blocking FF - Protection Against OS Security Bypass]

6 minutes ago, gUi said:

Hi Porthos,

thank you for your quick reply!
That changed the behaviour. Guess there never was a problem..

What do you think about just deactivate the Checkbox for Browsers?

regards

Hi @gUi. What @Porthos posted shows you the default values for the current version of Malwarebytes. I would recommend leaving them at these default values for the best balance of protection and functionality.

[New FIREFOX 58.1 Crashes with Exploit ROP gadget attack blocked, BUG??]

14 minutes ago, DonnaMolinari said:

Thank you Alex -I will give it a try later. What are those anti-exploit options? If they are there, they must be important.

No problem @DonnaMolinari, glad to help!!

To answer your follow up question, those are Advanced Anti-Exploit Settings that provide users the ability to control how our anti-exploit layer works in case its needed. Usually this is something that would only need to be modified when requested by a Malwarebytes support member to help resolve a specific or unique conflict/issue (similar to what is called out at the top of the settings window). It's also there for advanced users that want to have complete control of this layer.

[New FIREFOX 58.1 Crashes with Exploit ROP gadget attack blocked, BUG??]

3 minutes ago, DonnaMolinari said:

Hello Porthos,

Will this fix the issue with Firefox 58.1?

I am not going to try it out first -but did you test it to make sure it works?

Thanks in Advance,

Donna Molinari

Hi @DonnaMolinari!! What @Porthos posted is actually a screenshot of the default Anti-Exploit Settings in the current release of Malwarebytes. I can confirm with those settings set to defaults, Firefox 58.0.1 runs fine.

[Firefox 58.0.1 getting shutdown by MB for "Exploit ROP gadget attack"]

@Cain I have Firefox 58.0.1 running just fine with the latest version of Malwarebytes with the default settings. If you have adjusted/modified the default anti-exploit settings for web browsers in Malwarebytes, then there is a chance an issue may occur.

On top of that, recent builds of Firefox have had issues and conflicts with other security software that provide exploit protection features. In fact, the release notes of 58.0.1 call out that it includes a specific fix to resolve some of the recent conflicts Firefox has introduced.

My guess is that these things combined are the root causes of your issue.

[How to find licence key]

@bundyboy just posting here in case you haven't checked your private messages yet. I sent you a couple of updates that I need your input on. I want to get you back up and running as fast as possible.

Thanks!!

[reboot issues]

3 hours ago, newdude72 said:

Good Morning

Good morning to you too!!

3 hours ago, newdude72 said:

After hours of reading and investigation and trying to resolve this I found an article that said try turning off fast boot in Power Options, what your power button dose and the problem is gone. I checked 5 other PC's that I help manage for friends that do not have Malware bytes and all of them have this checked and none of them experienced this issue after the update.

Actually, this is some really good info here if you are talking about the setting I think you are. Going to get a little technical here, so I apologize if it goes too deep. Fast Startup (aka Hybrid-Shutdown or Kernel Hibernation) was introduced with Windows 8 and it changes how Windows handles the Shutdown process. With Fast Startup enabled, pressing Shutdown in any default method closes only the user mode session of Windows and places the kernel mode session in to hibernation. When the PC is powered back on, the kernel mode session is resumed from hibernation and once a user account is selected a new user mode session is established. Performing a Restart on the other hand actually closes the user mode and kernel mode sessions and provides a true full shutdown of Windows in today's world.

On top of that, starting with the Windows 10 Version 1709 (aka the Fall Creators Update) Microsoft also introduced automatically restarting and resuming user mode applications that were running when one performs a Shutdown, Restart/Reboot, or applies a Windows Update that requires a restart if the application supports the feature.

Adding that together, I am wondering if what's going on here is if there is an application, Service, or Driver running on your systems that is not friendly with those features. The best way to triage that would be to see if this hang behavior only occurs when you perform a Shutdown then power back on the system vs. selecting Restart to reboot the system.

 

3 hours ago, newdude72 said:

So, coincidence, I don't think so. Can I prove it, no and do I thank you for taking the time to help me with this issue. More then you know. People/companies always have integrity when things are good. You have just proven the opposite. For that, after I recover from all these hours this weekend on this issue and the Malwarebytes issues I will reinstall the 6 licensed Malwarebyes that I have.

Thanks so much. You certainly saved me as a customer for life

Thank you for the overly kind words!! I greatly appreciate it and am humbled to hear you will be a customer for life.

[MBAM 3.3.1 Memory Issue?]

1 minute ago, edd080 said:

@AlexSmith and @Porthos thank you for confirming. 

Our pleasure!! Always glad to help.

[MBAM 3.3.1 Memory Issue?]

@edd080 I can also confirm that what @KevinYu0504 said is accurate. What you are seeing is normal behavior.

[reboot issues]

@newdude72 looking at the logs shows Malwarebytes is no longer on that system at all. This really feels like an unrelated issue that may have coincidently occurred near or at the same time.

With that being said, does this behavior occur if you boot in to Safe Mode and Safe Mode with Networking? Does this behavior occur after creating a new test user account? Knowing that might help clue us in on where to focus next.

[reboot issues]

Hi @newdude72!! Welcome to the Malwarebytes Forums. I am sorry to hear that you are having some strange issues with multiple user accounts on your PC and our product. 

To get things started, we will need some technical logs to dig in to this issue a little deeper. Please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop.
     • FRST for Windows 64-Bit
     • FRST for Windows 32-Bit
       Note: You need to run the version compatible with your system. Check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

[what is going on with different versions ?]

2 minutes ago, info said:

I have attached a screen shot of the actual download file I downloaded from your consumer download link

 

 As @Spinner pointed out, that's version 3.2.2, not 3.3.2 which you originally posted about. 3.3.1 is the latest.

Looks like everyone got a little confused.

[Unable to contact update server]

I agree that these are deeper issues that point to a greater internet access problem or OS issue. @nikhils and @vbarytskyy should be able to jump in and help from here.

[Can't find bootmgr]

1 minute ago, screamer said:

Thanks Alex

I wasn't really needing a thread just now, as in the morning I'm away for 3 weeks and I'll try to get it sorted when I'm home

Sounds good. We can come back to this when you are back home.

[Looks Like Another Bad Day]

10 minutes ago, screamer said:

You're lucky, my main PC doesn't find its bootloader now

Was working fine before this problem

@screamer that sounds like you have a different issue. I have split your other reply in another thread in to it's own topic so we can dive in to this directly: https://forums.malwarebytes.com/topic/220375-cant-find-bootloader/

 

[Can't find bootmgr]

@screamer I have split your reply in to it's own topic so it can get dedicated attention. The issue you describe is unrelated to the issue that occurred yesterday. I know you recently upgraded your PC according to a post from last week. perhaps there is a greater hardware issue at play here?

[Unable to contact update server]

@JGarnett looking at the mb-clean-results.txt file shows that it failed to automatically reinstall Malwarebytes because it could not access the internet to download it. This aligns with your other symptoms of being unable to activate Malwarebtyes after manual installation, not being able to obtain Windows Updates, and not being able to update Windows Defender. My guess is you have a greater OS issue that is preventing applications from accessing the internet. I see a McAfee leftover in one of the posted log files, so I would recommend running their cleanup utility and rebooting your PC: http://us.mcafee.com/apps/supporttools/mcpr/mcpr.asp

[Web Protection blocks on many systems]

@amiranda we're sorry you had issues with our program yesterday. We've addressed the issue and here's what you need to do to fix it

Malwarebytes Endpoint Protection (cloud)

1. From the Malwarebytes Cloud console, go to the endpoints pane and select all the endpoints.
2. In the action drop-down, choose the ‘check for protection updates’ option to force an update on all endpoints to database update 1.0.3803 or higher.

This should fix the problem for the vast majority of Endpoint Protection endpoints. If endpoints are still affected after applying this, please reboot the machine.

If the remote agent is unable to reach out and get this update, then we must disable the web protection:

1. In the Malwarebytes Cloud console, Go to the settings> policies> and open up the policy the clients are on.
2. From here, go to the endpoint protection policy and turn off the “Web Protection” portion of the policy. Then:
   • If the machine is unresponsive, reboot the machine and log in.
   • Once in, right click on the tray icon and start a scan. This will force a database update and fix the issue.
   • Once updated, cancel the scan and reboot the machine.
3. When the computers are all online and updated, please turn back on the web protection again in the Endpoint Policy.

To learn more about what happened, please go here: 

If the above doesn’t resolve the issue, please reach out to support at corporate-support@malwarebytes.com

[How to find licence key]

55 minutes ago, bundyboy said:

yes, after reboot it did not asked me what i want... after reboot nothing happend...

and then i needed to install it manually the Malwarebytes.

now its in free mode.

but before unistall i have done mb-check-results

and there i have licence.conf file and other also.

so please tell me how can i find what is my my licence key ?

thank you

If you can send me a private message with your license.conf file, I may be able to help.

[clarify fix instructions!]

2 hours ago, JGustave said:

Greetings - on the posting from MB yesterday, on how to fix the problem with the update, one on the numbered instructions is to find "Scan Status". But you don't say where this is. You should say, "In the Dashboard," ... this will help your customers who are anxious and don't know the web layout as you do.

@JGustave thanks for the feedback!! I totally agree. We have started updating our content so that it's clearer for everyone.

[Can't activated my premium license]

1 minute ago, nunaka said:

Oh! Thank you very much ,.

I'm so sorry for my fault and make you waste your time 

thank you very much

@nunaka not a waste of time at all. Glad your issue is resolved!!

Thanks @Porthos for the assist!!

[Real-Time Protection won't stay on for me either]

1 minute ago, Baer said:

I also have am having the same problem on all my computers. What a pain.

Sorry to hear that @Baer. Did following the directions from @Porthos solve your problem? If not, please start your own thread so we can give it dedicated attention as your issue might be different.

[Can't activated my premium license]

1 minute ago, nunaka said:

I already follow your guide but it still the same. I Can't activated my license id 

@nunaka can you send me a private message with your license key?

[Can't activated my premium license]

@nunaka looks like I was able to see just enough from the log files to see what's up, so thank you for posting them.

Anyways, it appears you have not only have an older version of Malwarebytes but several of it's core components are missing, corrupted, or were installed improperly. Don't worry, we can fix that by getting you started off with a completely fresh installation of Malwarebytes by using the Malwarebytes Cleanup Utility (aka MB-Clean):

1. Download the latest version of MB-Clean
2. Close all open applications
3. Double-click and run mb-clean.exe. A prompt with an option to clean up the system will appear:
   • Yes - will proceed with backing up the license key (Malwarebytes 3.x only) and initiating the cleanup process
   • No - will exit the utility
4. Once the cleanup process is completed, a prompt will appear:
   • Yes – will proceed and post reboot you will be prompted to continue with the downloading, installation and activation of latest version of Malwarebytes 3.x
   • No – will exit the utility and you will not be prompted (post reboot) to download, reinstall and re-activate (not recommended)
     • We recommend rebooting immediately. Additionally, stopping at this step is not recommended and will most likely not resolve your issue(s).
5. Upon reboot, a prompt will appear:
   • Yes - will download, install and activate the latest version of Malwarebytes 3.x
   • No - will exit the utility and the cleanup process is complete
     • Choose this option if you do not want to download, install and activate the latest version of Malwarebytes 3.x
   • A log file ("mb-clean-results.txt") will be on your desktop. This might be needed if things didn't work out as planned.

If you continue to encounter issues after that, then we will need the full MB-Check logs mentioned earlier.