MBMC Issue

[arturt]

Hello,

Recently deployed MBAM for Business to 17 computers as well as set up a new VM on a Hyper-V to run MBMC.

The clients show up as online on MBMC however they are currently utilizing database version v2013.03.01.01 (02/28/2013) and have their real time protection turned off.

Re-did a push install on a test computer several times and still have this issue occurring where they are unable update the database.

Had all clients disconnect after reinstalling MBMC so I went ahead and connected to each computer and set MeeClient service to restart after 1st,2nd and 3rd failures and started it by hand. The computers then showed up as online again in MBMC however they still have the same old database version and are unable to accept 'Update DB' commands sent to them from MBMC.

No other AV is running on any of these PC's, they have all been restarted and have had their Domain and Private firewalls fully turned off (Domain and Private firewall also turned off on VM running MBMC)

The test PC had Visual Studio installed at one point and when the MeeClient service is started it throws the following errors thanks to the Just-In-Time debugger error window.

'An unhandled exception ('System.ArgumentException') occured in SCComm.exe [316]. '

'An unhandled exception ('System.ArgumentException') occured in SCComm.exe [3996].'

The service then turns off and attempting to turn it back on simply results in the above errors reoccurring and the service shutting back down.

Please find excerpts from the SSCom Log file below.

Info 2017-04-27 21:59:36.6931 3612 7 Not using a proxy
Info 2017-04-27 21:59:36.6931 3612 7 The organization unit is: removed.com
Info 2017-04-27 21:59:37.0331 3612 7 Client registered successfully. Client ID is 3ac64484-a83b-433b-a396-58c84edad8b5
Info 2017-04-27 21:59:37.0411 3612 7 Client ID was saved to the configuration file.
Debug 2017-04-27 21:59:37.0411 3612 7 Exiting Register client
Debug 2017-04-27 21:59:37.0411 3612 7 Tick the timer
Debug 2017-04-27 21:59:37.0651 3612 7 Heartbeat timer elapsed and is now disabled
Error 2017-04-27 21:59:37.0661 3612 7 Failed to send client status: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.
   at System.Timers.Timer.set_Interval(Double value)
   at SC.Client.SCComm.ClientCommService.HeartbeatToMeeTimer_Elapsed(Object source, ElapsedEventArgs e)
Error 2017-04-27 21:59:37.0661 3612 7 There was an unhandled exception: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.
   at System.Timers.Timer.set_Interval(Double value)
   at SC.Client.SCComm.ClientCommService.HeartbeatToMeeTimer_Elapsed(Object source, ElapsedEventArgs e)
   at SC.Client.SCComm.ClientCommService.StartCommService()
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ThreadHelper.ThreadStart()
Debug 2017-04-27 22:00:53.4507 2832 1 Client version:  1.8.0.3431
Debug 2017-04-27 22:00:53.5047 2832 1 Set application configuration file: C:\Program Files (x86)\Malwarebytes' Managed Client\SCComm.exe.config
Debug 2017-04-27 22:00:53.5437 2832 6 Client service starting...
Debug 2017-04-27 22:00:53.5437 2832 6 Reset DB files...
Debug 2017-04-27 22:00:53.5527 2832 6 Initializing communicator service...
Debug 2017-04-27 22:00:53.5527 2832 7 *** Starting SCCOMM for end point MBAM-PALAT ***
Debug 2017-04-27 22:00:53.5527 2832 7 Remote host: https://192.168.1.64:18457/SCClientService/
Debug 2017-04-27 22:00:53.5717 2832 7 The current logon user is: Administrator
Debug 2017-04-27 22:00:53.5717 2832 7 MBAM version found: 1.80.2.1012
Debug 2017-04-27 22:00:53.5717 2832 7 MBAE not found
Info 2017-04-27 22:00:53.5717 2832 7 Open policy file: C:\ProgramData\sccomm\Policy.xml
Debug 2017-04-27 22:00:53.6147 2832 6 Initializing command monitor...
Debug 2017-04-27 22:00:53.6427 2832 8 Command Monitor Thread Entry.
Debug 2017-04-27 22:00:53.6427 2832 6 Initializing log monitor...
Debug 2017-04-27 22:00:53.6737 2832 9 Log Monitor Thread Entry.
Debug 2017-04-27 22:00:53.7127 2832 6 Initialization completed.
Info 2017-04-27 22:00:53.9197 2832 7 Policy summary: 
Error 2017-04-27 22:00:53.9197 2832 7 Failed to apply new policy file: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.
   at System.Timers.Timer.set_Interval(Double value)
   at SC.Client.SCComm.ClientCommService.ApplyPolicy(PolicyContentInfo policy, String policySummary)
   at SC.Client.SCComm.ClientCommService.ApplyPolicyOnStartup()
Debug 2017-04-27 22:00:54.1977 2832 7 Starting up, register
Debug 2017-04-27 22:00:54.7447 2832 9 Client log path: C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs
Debug 2017-04-27 22:00:54.7447 2832 4 Host name: MBAM-PALAT
Debug 2017-04-27 22:00:54.7447 2832 4 Domain/workgroup name: removed.com
Debug 2017-04-27 22:00:54.7447 2832 4 DNS Domain name: removed.com
Debug 2017-04-27 22:00:54.7447 2832 4 IP addresses: 192.168.1.64
Debug 2017-04-27 22:00:54.7447 2832 4 Operating system: Windows Server 2012 R2 Datacenter
Debug 2017-04-27 22:00:54.7447 2832 4 Service pack: 
Debug 2017-04-27 22:00:54.7447 2832 4 System type: 64-bit Operating System
Debug 2017-04-27 22:00:54.8347 2832 7 Registering client MBAM-PALAT:
<?xml version="1.0"?>
<ClientInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <x_ID>3ac64484-a83b-433b-a396-58c84edad8b5</x_ID>
  <HostName>MBAM-PALAT</HostName>
  <IsDomainOrWorkgroup>true</IsDomainOrWorkgroup>
  <Domain>removed.com</Domain>
  <MacAddress>00-15-5D-05-01-3F</MacAddress>
  <IPAddress>192.168.1.64</IPAddress>
  <SubnetMask>255.255.255.0</SubnetMask>
  <DefaultGateway>192.168.1.254</DefaultGateway>
  <PreferredDNS>192.168.1.3</PreferredDNS>
  <AlternateDNS />
  <CurrentLogonUser>Administrator</CurrentLogonUser>
  <x_CurrentLogonTime xsi:nil="true" />
  <x_LastLogonTime xsi:nil="true" />
  <x_LastOfflineTime xsi:nil="true" />
  <x_PolicyID xsi:nil="true" />
  <x_PolicyVersion xsi:nil="true" />
  <ClientVersion>1.80.2.1012</ClientVersion>
  <DatabaseVersion>913030101</DatabaseVersion>
  <DatabaseDate>2013-02-28T19:06:58-06:00</DatabaseDate>
  <x_LastUpdateTime xsi:nil="true" />
  <x_Status>0</x_Status>
  <x_LastScanTime xsi:nil="true" />
  <OS>Windows Server 2012 R2 Datacenter</OS>
  <ServicePack />
  <x_NewPolicyID xsi:nil="true" />
  <PMEnabled>false</PMEnabled>
  <GroupID>01f37582-c12c-46f0-8a49-abe540a29396</GroupID>
  <DomainHostUUID>76ac0a0c-15cd-4bcb-8ca5-e10d61b6977b</DomainHostUUID>
  <ManagedClientVersion>1.8.0.3431</ManagedClientVersion>
  <MbamVersion>1.80.2.1012</MbamVersion>
  <MbaeVersion />
  <IsMbaeActive xsi:nil="true" />
</ClientInfo>
Info 2017-04-27 22:00:54.8347 2832 7 Not using a proxy
Info 2017-04-27 22:00:54.8347 2832 7 The organization unit is: removed.com
Info 2017-04-27 22:00:55.1777 2832 7 Client registered successfully. Client ID is 3ac64484-a83b-433b-a396-58c84edad8b5
Info 2017-04-27 22:00:55.1777 2832 7 Client ID was saved to the configuration file.
Debug 2017-04-27 22:00:55.1777 2832 7 Exiting Register client
Debug 2017-04-27 22:00:55.1777 2832 7 Tick the timer
Debug 2017-04-27 22:00:55.2097 2832 7 Heartbeat timer elapsed and is now disabled
Error 2017-04-27 22:00:55.2097 2832 7 Failed to send client status: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.
   at System.Timers.Timer.set_Interval(Double value)
   at SC.Client.SCComm.ClientCommService.HeartbeatToMeeTimer_Elapsed(Object source, ElapsedEventArgs e)
Error 2017-04-27 22:00:55.2097 2832 7 There was an unhandled exception: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.
   at System.Timers.Timer.set_Interval(Double value)
   at SC.Client.SCComm.ClientCommService.HeartbeatToMeeTimer_Elapsed(Object source, ElapsedEventArgs e)
   at SC.Client.SCComm.ClientCommService.StartCommService()
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ThreadHelper.ThreadStart()

Please let me know what else to try, maybe I missed something.

[arturt]

One computer randomly was able to fully register, update it's database and detect a threat. Attached is the full SCComm for that workstation.

 

sccomm-workingpc.txt

[djacobson]

Hi @arturt the version you have installed, 1.8.0.3431, has a bug in it that gives the check-in time as a zero integer:

<ManagedClientVersion>1.8.0.3431</ManagedClientVersion>
Error 2017-04-27 21:59:37.0661 3612 7 Failed to send client status: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.
Error 2017-04-27 22:00:53.9197 2832 7 Failed to apply new policy file: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.
Error 2017-04-27 22:00:55.2097 2832 7 There was an unhandled exception: System.ArgumentException: '0' is not a valid value for 'Interval'. 'Interval' must be greater than 0.

Due to that 0 value, sccomm cannot process any policy commands. Re-download the software, it will be the hotfix build instead, 1.8.0.3443. Upgrade the server and redeploy to the clients and proper service operation and communication will be restored.

[arturt]

Upgraded the server last night, seems like computers are coming online and everything working as intended after redeploying client from updated MBMC.

Feel free to close, thanks for the help.

[djacobson]

Hi @arturt awesome update, happy to hear your communication is back up after getting the hotfix build out.