Version 3.0.6.1469 Woes

[joshuals]

Have been a MBAM and MBAE user with lifetime license on MBAM and subscription on MBAE.  Upgraded to V3.0.6.1469 on March 17. OS is Win10 Home 64x on a Dell Inspiron 5559 laptop.

After upgrade to V3.0.6.1469 the computer began acting strangely, including strange graphics behavior and crashing in Internet Explorer,  plus crashing Microsoft Outlook 2016.  The problem appeared to occur when I would launch IE or Outlook just after Startup without waiting several minutes for MBAM to fully load.  When this occurred, MBAM would show as "service not running" and no amount of attempting to start the service from the console would succeed (endless message: "starting").

Apologies for not following the requested format for posting problems, but I am a customer and not a beta tester.  This has been very frustrating and I have reverted to MBAM 2.2.1.1043 and MBAE 1.09.1.1334 which ran flawlessly before the V3.0.6.1469 upgrade.  Will wait until problems are worked out before upgrading again.......

[nikhils]

Hi @joshuals

Thank you for being a trusted Malwarebytes user and sorry to hear about your experience with the MB v3 product.

We just released a Beta Preview of the MB 3.x CU4 which has a lot of fixes and improvements. That might solve the "Service not starting" issue.

You can download the Beta build from the following location: https://malwarebytes.app.box.com/s/hmazlt9djsvxz6yxkyv1clb6nlh3p1qk

Please give that build a go and let us know if things got better .

Thank you

[joshuals]

With regard to post #1 above, I now find that neither MBAM Version 2.2.1.1043 nor MBAE 1.09.1.1334 is working properly.  I realize this is off-topic for this thread: shall I start another thread or should I follow the instructions for help for Version 2 and continue this thread?

[Porthos]

Did you run the MB clean tool before going back to Version 2?

 

[joshuals]

I did, although I did not run it as Administrator.  Should I have?

The log shows numerous failed attempts to delete files/folder/registry kees

mb-cleanresult_3-27-17.txt

[Porthos]

11 minutes ago, joshuals said:

I did, although I did not run it as Administrator.  Should I have?

The log shows numerous failed attempts to delete files/folder/registry kees

mb-cleanresult_3-27-17.txt

I know you don't want to be a beta tester and I understand. But could you please do #7 and #8 from the post below so we can get a better look at your system.

 

[joshuals]

The "no beta tester" comment was in regard to version 3.  I'm just interested in getting back to where I was before doing the upgrade, and I do understand your need to see the logs.  Thank you for your help.

MB-CheckResult.txt

FRST.txt

Addition.txt

[Porthos]

I will alert @dcollins too look over your logs. Another staff member might chime in as well.

[joshuals]

Thank you.....I will probably sign off for the night shortly but will check back tomorrow.

I just confirmed with Virus Total that the installer I used to re-install MBAM V2 and MBAE have the correct SHA-256,  so I don't think there was a problem with those files.

Edited April 5, 2017 by joshuals
added info

[dcollins]

@joshuals thanks for the information. If your goal here is just to get back to MBAM2.x, can you clarify what issues you're having with MBAM2.x now that you've reinstalled it?

The error 3 errors in your log are not big a deal as that simply means the file/folder was already deleted

[joshuals]

Yes.  I am going on the road soon and, for now, am only interested in getting back to where I was before I allowed the V3 upgrade.

Neither MBAM or MBAE are running at Startup.  I can launch MBAE manually, but MBAM will not launch.  If I attempt to start MBAM manually, there is some brief activity in the Windows GUI but the MBAM console does not come up.  On the day (3-27-17) that I reinstalled MBAM and MBAE I was able to start them both and successfully enter the license information. I only noticed that they were not running yesterday when I attempted to right click on a file and have MBAM scan it.  When I did that, nothing happened and it was then that I noticed that neither product was running.

I believe that the logs I submitted in Post 7 indicate that there was an error starting MBAM, do they not?

[dcollins]

Yep, they do, just wanted to confirm what the issue was before we start troubleshooting the wrong thing. The best solution to start would be to uninstall both MBAE and MBAM, reboot, and then reinstall one product at a time and verify it works properly. I would recommend MBAM first, then MBAE

[joshuals]

For uninstalling would you recommend "mb-clean-2.4.1.1007" or should I use an application such as Revo?

Is there going to be a problem re-authorizing if I uninstall without having deactivated the license?  (Remember, I cannot open the MBAM console)

Can you verify that these two installers are "good"?

mbam-setup-2.2.1.1043.exe       5A141EA85724385EE7E68C10247E154BBD72CE1A656EBEDE99BB0FCA5BB5974A

mbae_premium.exe       C5277C6EFAACEB0738573DB4B29FBC2F36D47619EEE46631C710AD68B291B211

[dcollins]

You should be able to uninstall normally through control panel, but using mb-clean should work as well.

As for the 2x and MBAE installers, I would download them from the following links:

MBAM2.x: https://downloads.malwarebytes.com/file/mbam_2x
MBAE: https://downloads.malwarebytes.com/file/mbae

[joshuals]

Will do....

Please comment on the question in Post 13 regarding re-authorizing the product without having de-activated it first.

Thank you for your help.

[dcollins]

There shouldn't be an issue, but if there is, reaching out to our customer support teams on the following page can get that taken care of for you: https://support.malwarebytes.com/customer/portal/emails/new?b_id=6400

[joshuals]

I have completed the uninstall of MBAM V2 and MBAE and have reinstalled both using the installers you recommended.  The fresh install of MBAM was authorized without my having to enter the license information.  The fresh install of MBAE also completed successfully and I did have to enter the license info to authorize it.

I have successfully run a scan with the fresh install of MBAM V2 and the MBAE icon shows in the Notification Area.  All appears normal.

Please find the fresh log from the mb-check tool.  Do you need FRST logs as well?

MB-CheckResult_4-05-17.txt

[dcollins]

If everything is working well, then we shouldn't need any more logs and you should be good to go

[joshuals]

Thank you for the excellent support!

[Firefox]

1 hour ago, joshuals said:

Thank you for the excellent support!

Remember if you are wanting to stay on version 2 for a bit, you may want to make sure you disable program upgrades as mentioned in the reply below...

To stop your Malwarebytes v2 from upgrading to MB3 please see my post located -->> RIGHT HERE <<--

[joshuals]

Hmmm....in attempting to carry out the instructions in Post 20 I opened the MBAM Console and was greeted with the screen shown in the attached screen shot in MBAM_1.png.  Clicking "Fix Now" does nothing.

I then attempted to start "Malware Protection" and "Malicious Website Protection" from the console.  Upon opening this console, both radio buttons were "Disabled".  I changed the buttons to "Enabled" as shown in the second screen shot, but the condition shown in the first screen shot persists.  The MBAE icon still shows in the Notification Area.

What logs would  you like me to submit?

 

[Firefox]

Since you have version 2 below is the logs that @dcollins would need...

 

[joshuals]

Here are the requested logs.

Logs.zip

MB-CheckResult_4-05-17_2.txt

Addition.txt

FRST.txt

[jadinolf]

I think we must come up with a NEW nickname for this program.

 

Does Mwb work?

[AdvancedSetup]

You can see here that there are a few things that are not working on your system besides Malwarebytes. Fixing the computer should also fix and allow Malwarebytes to run. 

System errors:
=============
Error: (04/05/2017 11:40:33 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/05/2017 11:39:55 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MBAMScheduler service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (04/05/2017 11:39:55 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect.

Error: (04/05/2017 11:39:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MBAMService service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (04/05/2017 11:39:54 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMService service to connect.

Error: (04/05/2017 11:39:53 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Garmin Device Interaction Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (04/05/2017 11:39:53 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Garmin Device Interaction Service service to connect.

Error: (04/05/2017 11:37:26 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/05/2017 10:44:33 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/05/2017 10:44:15 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.