vbarytskyy

This is a known issue that comes up rarely. We have a fix already and it will be pushed out with our next release (hopefully early this month). There is no easy workaround at the moment unfortunately but this issue should not impact protection.@

This is a known issue that comes up rarely. We have a fix already and it will be pushed out with our next release (hopefully early this month). There is no easy workaround at the moment unfortunately but this issue should not impact protection.

Hello @heldveld I apologize about the issue you are seeing. We are currently testing a fix for this problem and should have something out next release (hopefully by end of the month). For the time being, as a workaround on machines experiencing this issue, I would advise to add and deploy (or create one locally) a GPO batch script to start the service. Something like "net start MBEndpointAgent" as the command inside the batch file will work perfectly. If you need help doing this, please let me know and I will be happy to help further. Thank you

@johnlondon Thank you very much for a quick reply. I had one last follow up question, was this dump grabbed while "Malwarebytes Service" was using high CPU?

For those of you having random usage (while no scan is running) and seeing 15%+ CPU usage from "Malwarebytes Service", I would like to apologize about the issues you are seeing. I am actively working to get to the bottom of these issues. We'll need to get a dump of the "Malwarebytes Service" while its in high usage state and no scan is running (since running scan will cause expected CPU usage): When you notice that "Malwarebytes Service" is in high usage state (30-40% CPU), open Task Manager (as admin, if on domain user) Find "Malwarebytes Service" in the list and confirm high usage is happening (if used another tool to notice initial usage) Right-click on "Malwarebytes Service" and select "Create dump file" Wait a few minutes, it can take up to 10min to create the dump When dump is done creating, it'll give the location it was stored, please notate this location (will be %temp% most of the time) Go to the location given, copy the dump file to an easy to find location In addition, gather the following: Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop In a domain environment, the zip file may get moved to the admin's Desktop. If the zip file is not seen on the Desktop of the logged in user, check user profile of the admin Grab the dump from initial set of instructions + "mbst-grab-results.zip" and place them in one single zip, then send to us. Feel free to use your own cloud storage solution to share the dump+diag zip or upload it to wetransfer.com and provide me with the link.

@nigel1952 Is it possible that this user has an extension in Adobe Reader (or whatever software is being used)? Typically issues like this originate from a bad extension that may be trying to do something with the file. If you can get us a sample logs, I can definitely take a look. From the machine having this issue, do the following: Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop In a domain environment, the zip file may get moved to the admin's Desktop. If the zip file is not seen on the Desktop of the logged in user, check user profile of the admin Thank you

@IT_1152 We'll need to get a dump of the "Malwarebytes Service" while its in high usage state: When you notice that "Malwarebytes Service" is in high usage state (30-40% CPU), open Task Manager (as admin, if on domain user) Find "Malwarebytes Service" in the list and confirm high usage is happening (if used another tool to notice initial usage) Right-click on "Malwarebytes Service" and select "Create dump file" Wait a few minutes, it can take up to 10min to create the dump When dump is done creating, it'll give the location it was stored, please notate this location (will be %temp% most of the time) Go to the location given, zip the file and send it to us. Feel free to use your own cloud storage solution to share the dump with me or upload it to wetransfer.com and provide me with the link.

Hello @johnlondon, I am very sorry to hear about the issues you are having. Would you be able to get us some additional data from machines experiencing this issue? We'll need to get a dump of the "Malwarebytes Service" while its in high usage state: When you notice that "Malwarebytes Service" is in high usage state (30-40% CPU), open Task Manager (as admin, if on domain user) Find "Malwarebytes Service" in the list and confirm high usage is happening (if used another tool to notice initial usage) Right-click on "Malwarebytes Service" and select "Create dump file" Wait a few minutes, it can take up to 10min to create the dump When dump is done creating, it'll give the location it was stored, please notate this location (will be %temp% most of the time) Go to the location given, zip the file and send it to us. Feel free to use your own cloud storage solution to share the dump or upload it to wetransfer.com and provide me with the link. Thank you

Hello @anyWARE-Mainz We have plans to roll out SSO sometime this month (August). As far as 2FA, that feature is planned for September or October release dates. Both SSO and 2FA is our priority due to reasons you mentioned as well as generally being a highly requested feature(s). Thank you

@heldveld Thank you for those logs. Looks like we'll need a little more logging turned on in order to capture the issue happening. Could you please do the following for me: Open Powershell as administrator (search for Powershell, right-click and select to run as administrator) In admin powershell, run the following command: Set-Location -Path 'C:\Program Files\Malwarebytes Endpoint Agent\' While still in admin powershell, run a second command: (Get-Content "MBCloudEA.exe.Config") | Foreach-Object {$_.replace('<threshold value="INFO" />', '<threshold value="DEBUG" />')} | Set-Content "MBCloudEA.exe.Config" Reboot the machine and login to the computer user account having the problem. Wait 2-3min for machine to load. Get logs again (the same way you got them the first time) > send them to me Thank you,

@lindenlauf Could you PM me your Malwarebytes Cloud email address, I will take a look into this issue from the back end. Thank you

Hello @heldveld, Could you get us some logs to look over? Check this support article for help with getting logs: https://support.malwarebytes.com/docs/DOC-1818 Thank you

@Jim90, @Cleatus , @MetalSpork , @IT_Guy I PM'd all 4 of you. I apologize for the late reply on our end, we'll definitely prioritize this issue. Please get me the information requested in the PM and we'll get to the bottom of this. Thank you

Hello, I created a new topic as the old one was related to an issue in 2017. Could both of you PM me a zipped export of Application and System Event Viewer logs as we are trying to track this issue down. Also--Please PM me the endpoint FQDN name(s) that is/are experiencing this issue (doesn't have to be all of them, just a sample) and account email so we can try to pull more logs remotely. Thank you

Hello @roy300c, Try turning off "Ransomware Protection". In your Malwarebytes Cloud console, go to Settings > Policies > "select your policy" > Hit the "Settings" tab under "Windows" and find "Ransomware Protection". Note that this will turn off protection for all machines in that policy. If you would like to just turn off protection temporarily, you can stop the "Malwarebytes Service", just be sure to resume it so you can remain protected. Go to a Run dialog (Click "Windows" + R) Type in services.msc (if a domain user, make sure to open as administrator) Find "Malwarebytes Service" or "MBAMService" Right click and stop the service Perform installation of your software and be sure to resume the service. Also--We will be starting to roll out an update tonight that'll have some great improvements in our ransomware technology, it should help mitigate software installation issues.

@Jim90 Could you get us a dump file when you notice the issue happening? So when you notice high usage, do the following: Open Task Manager (as local admin) Go to Processes If "Show processes from all users" button is there, please click it as that'll elevate permissions of Task Manager Find "MBAMSERVICE.exe" in the list > Right-click > "Create Dump File" This process can take up to 5min When a dump is created, location of the file will be given, please notate it Usually in %temp% Find the file > zip and PM me personally with the dump file The dump file may be too large to upload here, use a service like www.wetransfer.com to upload the file and generate a link (to generate a link on WeTransfer, click the "3 dots") Thank you

@Budd Could you get us some logs to look over? NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so: Click "Reveal Hidden Contents" below for details on how to attach a file: Reveal hidden contents One of our experts will be able to assist you shortly. Thank you

@whatmeworry? If you are running Windows Vista/7, please install the following .NET version: https://www.microsoft.com/en-us/download/details.aspx?id=42642 After installing .NET 4.5 from that link, Support Tool should open correctly. If you are running Windows XP, please PM me and I will get you the right update to .NET to help run the Malwarebytes Support Tool Thank you

@JMAR I split your topic off from the other one, it looks like your machine is infected in addition to Malwarebytes crashing. I am going to move your topic to malware removal section so our experts can help you get rid of the infection first. Someone should reply to you shortly.

It looks like your system may be crashing based on the logs we got. Could you collect the memory.dmp for us to review in detail? Go to C:\Windows and locate "MEMORY.DMP" Copy this file and paste it somewhere it can be found easily (like the Desktop) Right-click the copied dump and go to "Send To" > "Compressed.." Upload the compressed .zip to a website like www.wetransfer.com and provide the link in your reply. Thank you

I moved your topic to malware removal section. One of our experts should reply shortly. While you are waiting for a reply, could you gather more logs for us to review: Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so: Thank you

Could you try to turn off fast start on a machine or two and reboot them? Search for and open “Control Pannel” in the Start Menu Click “Choose what the power buttons do” (under Power Options) Click “Change settings that are currently unavailable.” Under “Shutdown settings”, set “Turn on fast startup” to disabled(unchecked). Hit "Save Changes" Reboot and watch for tray

@dru Could you try updating with everything enabled except anti-ransomware protection? Open Malwarebytes Go to Settings > Protection Toggle off "Ransomware Protection" Thank you

Hello @Mbag3rd, Could you do the following for me: When the computer is using a lot of CPU, open Task Manager Go to the Processes tab and find mbamservice (you may have to click "show processes from all users) Right click mbamservice and choose Create dump file This could take a little while, but once it's done, it should give you a path to a .dmp file Zip up this .dmp file and upload it to wetransfer.com, and generate a download link Also--I noticed that your Malwarebytes installation in not in the default directory (C:\Program Files\*).

Thank you for reporting. I will do a few tests with the latest KIS 19 (RC) and make sure to pass on discoveries to our development team.