TOH Posted December 20, 2016 Author ID:1082339 Share Posted December 20, 2016 Here are the files Fixlog.txt Logfile.zip Link to post Share on other sites More sharing options...
dcollins Posted December 20, 2016 ID:1082341 Share Posted December 20, 2016 (edited) Thanks! While I'm looking these over, have you upgraded to 3.0.5 yet? We released it yesterday, and until next week it requires a manual install. If you want to try upgrading before then, feel free to download the latest MB3 from this link. You should be able to install this directly over the existing MB3 installation, but it may be helpful to uninstall first and then re-install the newer version. Is there a different zip file on your desktop? Something that has todays date in the filename? The one you sent over has the procmon log from earlier. Edited December 20, 2016 by dcollins Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082350 Share Posted December 20, 2016 Devin, Here are the files you requested Logfile.zip Fixlog.txt Link to post Share on other sites More sharing options...
dcollins Posted December 20, 2016 ID:1082351 Share Posted December 20, 2016 Hmm... that zip file still seems incorrect. That being said, did you try upgrading to 3.0.5? Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082352 Share Posted December 20, 2016 no, should i do that now? Link to post Share on other sites More sharing options...
dcollins Posted December 20, 2016 ID:1082353 Share Posted December 20, 2016 Yeah, go ahead and install 3.0.5 and let's see if that works. As mentioned, I would recommend uninstalling 3.0.4 first Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082354 Share Posted December 20, 2016 Sorry, Try this one 20.12.2016_14.06.51.zip Link to post Share on other sites More sharing options...
dcollins Posted December 20, 2016 ID:1082355 Share Posted December 20, 2016 Perfect, that's it! Thanks so much Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082378 Share Posted December 20, 2016 FYI, I just downloaded version 3.0.5 and am now able to do a threat scan. It did get stuck once again on an AOL file (see below) as it did in version 3.0.4 last week. Last week, Lisa told me to add the AOL folders to MBAM's exclusion list until fix can be found and try threat scan again and scan did finish after that. I am concerned about hundreds of AOL files not being scanned but can do that until a fix is found if you like. Link to post Share on other sites More sharing options...
Staff Jekko Posted December 20, 2016 Staff ID:1082382 Share Posted December 20, 2016 @TOH Could we get your latest MBAMSERVICE.LOG files now that you are seeing the original issue again? Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082383 Share Posted December 20, 2016 Here it is. I am running a threat scan with AOL excluded and it looks good, almost done MBAMSERVICE.LOG Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082385 Share Posted December 20, 2016 Threat scan completed with AOL folder excluded, no threats. 464,069 items scanned in 7 min 35 sec. Link to post Share on other sites More sharing options...
Staff Jekko Posted December 20, 2016 Staff ID:1082386 Share Posted December 20, 2016 Could you enable Event Log Data in Application Settings, remove the exclusions, and run a Threat Scan again? Then attach the MBAMSERVICE.LOG please. Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082390 Share Posted December 20, 2016 I enabled Event Log Data in Application Settings, removed the exclusions, and ran a Threat Scan again which locked up on an AOL file (see below) The MBAM servicelog and MBAM servicelog.bk1 in zip file are attached. MBAMSERVICE.LOG MBAMSERVICE.LOG.zip Link to post Share on other sites More sharing options...
Staff Jekko Posted December 20, 2016 Staff ID:1082391 Share Posted December 20, 2016 Thanks for the quick response! We'll take a look and see what we can find. Link to post Share on other sites More sharing options...
Staff Jekko Posted December 20, 2016 Staff ID:1082394 Share Posted December 20, 2016 Could you also attach the AOL files? C:\ProgramData\AOL Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082400 Share Posted December 20, 2016 The scan also stops at files in the AOL Downloads folder if you check the screenshot in message ID#6 on page 1 of this chain. There are hundreds of files in those two folders, can you be more specific which files you need? FYI, I attached one file (tsverchk.dll) that caused the scanner to hang up earlier today and I tried to attach a copy of the AOL file which the scanner last stopped on today but it is a 0 KB file so I could not attach it. A screenshot of that and other files in that folder is below: tsverchk.zip Link to post Share on other sites More sharing options...
Staff Jekko Posted December 20, 2016 Staff ID:1082404 Share Posted December 20, 2016 For now, can you get me all the files in this folder? C:\PROGRAMDATA\AOL DOWNLOADS\SUD4577\COMPS\TOOLBAR Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082406 Share Posted December 20, 2016 If it helps your analysis, I just did a custom scan of one file that the scan hung up on earlier today, C:\ProgramData\AOL Downloads\SUD4584\comps\acs\instSup.dll The scan completed in 35 seconds with no threats, no quarantine Link to post Share on other sites More sharing options...
TOH Posted December 20, 2016 Author ID:1082407 Share Posted December 20, 2016 Here is the only file in that folder: aol_toolbar.zip Link to post Share on other sites More sharing options...
dcollins Posted December 20, 2016 ID:1082410 Share Posted December 20, 2016 Thanks for sending us that file @TOH. Unfortunately that file scans fine for us. If you don't mind, now that we're back to your original issue, we'd like to try and grab a memory dump again. I've attached a zip file that has a registry file in it. Please run the registry file, and then start a scan. Once the scan locks up, wait about 10 minutes, and then look for the folder c:\mb_crashdumps and zip up anything inside of there. Then please upload that file here. I tested this locally and didn't have the same issue as last time where the scan would no longer run. So this should work properly for you. Thanks in advance, your willingness to work so diligently with us is helping a whole lot. localdumps_mbamservice.reg.zip Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082420 Share Posted December 21, 2016 I ran the threat scan which stopped again on an AOL file in about 60 seconds, I let it run for another 10 minutes and went to the c:\mb_crashdumps folder. It is empty, there are no files to send to you. Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082472 Share Posted December 21, 2016 Ok, we were thinking maybe there was a crash happening but it looks like that's not the case. Can you please follow the instructions below to grab an in-memory dump of the issue. Download ProcessExplorer from Sysinternal using the following link: https://live.sysinternals.com/procexp.exe Run ProcessExplorer.exe Click on File -> Show Processes for All Users and choose Yes on the UAC promptNote: This step may not be necessary. If you don't see the "Show Processes for All Users" option in the file menu, you can skip to step 4 Start a scan with Malwarebytes Once the scan sticks, wait for 5-10 minutes With the scan still stuck, go back to ProcessExplorer and look for MBAMService.exe in the list Right click MBAMService.exe and choose Create Dump -> Create Full Dump... Save the file to your desktopNote: The dump file will most likely be very large. You won't see too much happening, but wait about 30 seconds and then you can close Process Explorer Right click the dump file you created and choose Send To -> Compressed (Zip) Folder Go to https://wetransfer.com and click on the free option Click Add Your Files and choose the zip file from step 9 Put in my email address (dcollins@malwarebytes.com) for the Email To address Click transferNote: It may take a few minutes to upload the file This should send me the file so we can provide it to our developers to see what's happening Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082626 Share Posted December 21, 2016 I did steps 1-6 above but could not find a file named MBAMService.exe. The only MBAM files were MBAM.exe and MBAMTray.exe. Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082633 Share Posted December 21, 2016 Ok, that at least confirms that there is a crash happening, now we just have to figure out why a crash dump isn't being created. I've attached another registry file that should hopefully create a crash dump this time. Please double click this registry file to add the contents to your registry and then follow the steps again. Once the scan hang happens, wait for 5-10 minutes and then check in c:\mb_crashdumps. Upload any files that may be in that folder localdumps_mbamservice.zip Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now