King_Of_The_Castle

Thank you @vbarytskyy. I will give that a try. Regards,

Sorry if this has been answered before. I was wondering if there is a way to add a custom rule to block a certain file from being opened. We would like to prevent a certain zip file named "u.zip" from being opened as we know it contains a portable version of the known proxy software "UltraSurf" that let users surf the internet unrestricted (big concern). Thanks,

No Paul, only workarounds so far or small band-aids in order to remediate the issue for the time being... I really hope the MalwareBytes team fixes this as soon as possible.

Tested this bat on a couple of endpoints and it fixed the issue. But I also got this message on one of them: Making sure the Malwarebytes Endpoint Agent service is stopped... Looking for backup in .\ No valid backup configuration was found Unable to restore configuration from backup System error 14001 has occurred. The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.

Ever since I scheduled a daily task to kill all MB-tray.exe processes on our Terminal Servers I have forgotten about this problem. Maybe not the ideal solution but it works as a workaround until MalwareBytes finally decides to fix the bug.

Thanks. I will test today and provide feedback.

I tried this on a couple of endpoints to see if it would really prevent them from going offline. Unfortunately one of them went offline a couple of days after I scheduled the service to restart everyday. Even though this is not the kind of behavior I expect from a corporate product from MalwareBytes....I'm so disappointed.

Any updates on this? I'm also experiencing this problem on a few endpoints every week, getting tired of uninstalling / re-installing every time this happens... Thanks.

Unfortunately no dude. You would have to do a clean uninstall using the cleanup tool, manually delete installation folders, reboot and re-install... EDIT: Pretty sure there is a way to automate this using a batch file remotely with PSEXEC.

Yes, I can confirm it is up and running fine again. Thanks.

Then I get this error too...

@vbarytskyy Nice! Glad I could help Thanks!

@vbarytskyy Thanks for waiting, here are both dumpfiles: https://fisherco-my.sharepoint.com/:f:/p/fernando_rios/EiSRwxbF_79IoxpBbP71guQBnCwJ-jHXoR6Q_5LfwApr2w?e=hM8TX0 Thanks!

Hi @vbarytskyy. How can I obtain dumps from both mbamservice.exe and procmon? Thanks.

Well...Looks like the "No-Tray Icon" Policy helped just for a couple of days....the tray icon processes are back and grabbing more and more RAM by the day. If I let this keep up it will become to a point where every single process is taking over 1GB of RAM, thus slowing things for every user connected to the terminal server. I'm hoping this months update helps but I don't want to keep my hopes too high...