TOH Posted December 21, 2016 Author ID:1082672 Share Posted December 21, 2016 Do you also need the MBAMService.exe file dump or just the c:\mb_crashdumps? Link to post Share on other sites More sharing options...
Staff Benno1024 Posted December 21, 2016 Staff ID:1082673 Share Posted December 21, 2016 dcollins - you might have him disable the Self Protection, which is likely preventing the process from being attached to for the dump. Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082674 Share Posted December 21, 2016 4 minutes ago, TOH said: Do you also need the MBAMService.exe file dump or just the c:\mb_crashdumps? Just the dumps please Just now, Benno1024 said: dcollins - you might have him disable the Self Protection, which is likely preventing the process from being attached to for the dump. Not a bad idea, but unfortunately that won't help here. Thanks for the idea though Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082675 Share Posted December 21, 2016 I waited 10 minutes after the scan stopped and the mb_crashdumps folder is empty Link to post Share on other sites More sharing options...
Staff Benno1024 Posted December 21, 2016 Staff ID:1082684 Share Posted December 21, 2016 I'd try this -- Quit mbam3 from the system tray, and make sure mbamservice is NOT running. Download ProcDump from sysinternals: https://download.sysinternals.com/files/Procdump.zip Unzip it, then open an Admin-elevated command prompt, go to the directory which contains procdump.exe, and enter this command: procdump.exe -e -w mbamservice.exe Keep that window open, maybe minimize it. Then start MBAM3 and do the scan (reproduce the error). Check for a dump file (.dmp) in the same directory that procdump was run from. Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082685 Share Posted December 21, 2016 Just now, Benno1024 said: I'd try this -- Quit mbam3 from the system tray, and make sure mbamservice is NOT running. Download ProcDump from sysinternals: https://download.sysinternals.com/files/Procdump.zip Unzip it, then open an Admin-elevated command prompt, go to the directory which contains procdump.exe, and enter this command: procdump.exe -e -w mbamservice.exe Keep that window open, maybe minimize it. Then start MBAM3 and do the scan (reproduce the error). Check for a dump file (.dmp) in the same directory that procdump was run from. Good idea here. Thanks for the recommendation. @TOH would you be willing to try these steps? Let me know if any clarification is needed for these steps. Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082686 Share Posted December 21, 2016 I will need help with those instructions, can you logon to my PC? Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082687 Share Posted December 21, 2016 I'm checking with our other support members to see about remoting in, in the meantime, let's try @Benno1024's solution above first since it should be a quick one. Inside of MB3, can you go to Settings -> Protection and make sure the Enable Self-Protection Module is disabled? I've attached a screenshot of the setting. Once you disable that setting, then try running another scan, waiting 5-10 minutes after the process hangs, and then seeing if there are any files under c:\mb_crashdumps. Thanks! Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082690 Share Posted December 21, 2016 Ok, will do. By the way, malware protection shut itself off again. Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082697 Share Posted December 21, 2016 Self protection module is off. I ran the scan again and waited 10 minutes after the scan stopped and the mb_crashdumps folder is empty. Link to post Share on other sites More sharing options...
Staff Jekko Posted December 21, 2016 Staff ID:1082722 Share Posted December 21, 2016 @TOH, Try these steps for running Procdump. Download the following Procdump.zip file: Procdump.zip Place procdump.zip in C:\ Extract procdump.zip. Check that the extracted files are in the directory "C:\Procdump" Right click "mbamservice_procdump.bat" and select Run as administrator. If you did the steps correctly you will see the following: Run a threat scan with MBAM 3.0. When MBAMSERVICE.exe crashes it should close that command window and generate a memory dump file in "C:\Procdump". Please follow these directions because "mbamservice_procdump.bat" needs to be run in the directory "C:\Procdump" for it to work correctly. Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082728 Share Posted December 21, 2016 When I tried to run the bat file as administrator, I got the following error message and it did not run: Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082729 Share Posted December 21, 2016 Delete the existing C:\Procdump folder Right click C:\Procdump.zip and choose Properties At the bottom of the properties window, click the Unblock button as shown in the attached screenshot Then follow the rest of the instructions from @Jekko starting with step 3 Link to post Share on other sites More sharing options...
TOH Posted December 21, 2016 Author ID:1082734 Share Posted December 21, 2016 I ran the scan which hung up again and presume that you want the dump file so here it is: MBAMService.exe_161221_141609.dmp Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082735 Share Posted December 21, 2016 Thanks a lot @TOH, we'll get this to our development team to check out. Link to post Share on other sites More sharing options...
Staff Jekko Posted December 21, 2016 Staff ID:1082736 Share Posted December 21, 2016 Agreed. Thanks for being patient with us @TOH. We'll keep you informed with our progress. Link to post Share on other sites More sharing options...
dcollins Posted December 21, 2016 ID:1082769 Share Posted December 21, 2016 @TOH it looks like we still need some more data, sorry to keep pestering you. Can you find the folder C:\PROGRAMDATA (the ProgramData folder may be hidden, but you should be able to type it in and get there) and zip the entire AOL Downloads folder? You should just need to right click that file and choose Send to -> Compressed (Zipped) folder. It should create a .zip file that I'd like you to upload here. That file may be too large to upload here, and if it is, please upload the file to wetransfer.com using the instructions I mentioned before and email it to me. Thanks again! Link to post Share on other sites More sharing options...
TOH Posted December 22, 2016 Author ID:1082829 Share Posted December 22, 2016 I just sent the AOL Downloads folder (700MB) to your email via wetransfer since it was too large to send via this forum. Link to post Share on other sites More sharing options...
dcollins Posted December 22, 2016 ID:1082858 Share Posted December 22, 2016 Thanks @TOH, it's a large file but hopefully this will help us figure out what's going on Link to post Share on other sites More sharing options...
dcollins Posted December 22, 2016 ID:1082861 Share Posted December 22, 2016 Good news @TOH, with that zip file you uploaded I am able to replicate this issue! That means that while we don't have a solution for you at this exact moment, we should be able to figure one out without needing you to run a bunch of things for us! I won't jump the gun and say we're done yet, but hopefully we should be good. You've been a great help! I know we've had you change a lot of settings, so just to make sure you're back in working order, I'd recommend doing the following things to clean up where left off: Download the attached zip file and run the .reg file inside of there. This will disable the localdumps we setup earlier. Delete C:\mb_crashdumps Delete C:\Procdump and C:\Procdump.zip In Malwarebytes 3.0, go to Settings -> Application and disable the Event Log Data option This should put you right back where you were when you started using Malwarebytes 3. For the time being, it's probably best to keep that exclusion on C:\ProgramData\AOL Downloads until we get the issue resolved as well. Feel free to let me know if you have any more questions. disable_localdumps.zip Link to post Share on other sites More sharing options...
TOH Posted December 22, 2016 Author ID:1082864 Share Posted December 22, 2016 I have completed the 4 steps outlined above. Can I also delete all the folders and files created (see below) in the past 7 days for this fix attempt or are some still needed? Link to post Share on other sites More sharing options...
dcollins Posted December 22, 2016 ID:1082866 Share Posted December 22, 2016 Yep, assuming those screenshots are ones you took for us, you should be good to clear just bout everything. I don't know what those three RTF documents are at the top "ExelixisInc.rtf" so I can't say if you should delete those or not though. Link to post Share on other sites More sharing options...
TOH Posted December 22, 2016 Author ID:1082872 Share Posted December 22, 2016 Should I enable the self protection module in the Protection tab or leave it off? Link to post Share on other sites More sharing options...
Staff Jekko Posted December 22, 2016 Staff ID:1082976 Share Posted December 22, 2016 Please keep it enabled. It will protect your Malwarebytes files from being modified or deleted. The Engineering team has identified which file is causing this issue. "AOL Downloads\<subfolder>\comps\vwpt\Vwpt.exe" Until we can fix this, as @dcollins mentioned, please keep your exclusion for the AOL Downloads folder. Thank you so much for your help with us on this issue! Link to post Share on other sites More sharing options...
TOH Posted December 22, 2016 Author ID:1083073 Share Posted December 22, 2016 Can I delete viewpoint.exe and related files from my PC or are they needed for AOL to operate? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now