Jump to content

MBA-M Tray App and MBAMService Don't Close


Recommended Posts

The FREE version is designed to run the tray app all the time. The free version offers a monthly threat scan, unlike its predecessors.

You can turn off the auto start of the MB tray by right clicking on the MB tray and uncheck start with windows. But since I don't use the free version I can't tell you anything more than that.

 

 

Link to post
Share on other sites

42 minutes ago, lazarhead said:

but starting again after I open and close it.

As I said.

1 hour ago, Porthos said:

The FREE version is designed to run the tray app all the time.

It will run till you right click and exit. If you right click and exit after you run a scan does it go away?

Link to post
Share on other sites

Can you please try the following:

  1. Make sure Malwarebytes is running and the system tray icon is present
  2. Download Procmon from https://live.sysinternals.com/procmon.exe
  3. Launch Procmon and accept the EULA
    • If you've run this tool before, you may get prompted to adjust your filters. If so, please click Reset and then OK
  4. The program should show lots of things on the screen
    • If the screen stays white, please click the magnifying glass icon at the top of the window to start capturing. At that point, the window should start to fill with data
  5. Quit Malwarebytes from the system tray
  6. Wait until the system tray icon shows up again
  7. Click the magnifying glass in Procmon to stop capturing data
  8. Click the save icon in Procmon to save the log
  9. Upload the log in your reply (you may need to zip it up)
    • If the log is too large, you can use wetransfer.com to email the file to dcollins@malwarebytes.com

With this information, it should show us what's causing mbamtray to relaunch

Link to post
Share on other sites

Lazarhead is reporting the same thing I see IF I enable a Root Kit scan and do a Threat Scan.

After having done that, when closed via right-click > Quit Mallwarebytes, from the tray the icon will go away for a moment, there will be some  failure of the service under the covers, then the service will auto-restart bringing the icon back

It's happening because you're setting the service up to auto-restart on failure by default...

ScreenGrab_NoelC4_2017_07_05_123609.png.eacc734b3d41b19a3a95903527284967.png

It seems to me I shouldn't be having to tell you how your own software works.

From what I can see in the thread above, I thought you had reproduced the problem and had already worked out why the service was failing, and that we'd see a new version soon with whatever bug the "scan for rootkits" option currently causes fixed soon.

Regarding one of the comments above... 

Please understand that for some of us it is NOT acceptable to require that your tray icon remain open continuously.  I require zero presence except for the ability to run scans when I initiate them.  That's what your product has done forever, and if it will not continue to do so because the design is being moved away from that ideal, then it's of no use to me and I will not buy licenses.  Please understand that there are people out here who understand the risks being "cloud-integrated" brings, and actively don't want those risks.

Still awaiting the fix for this issue...

-Noel

Link to post
Share on other sites

You're correct, we do set our service to restart on failure. However if you choose Quit Malwarebytes from the system tray, that should not register as a failure and should shut down as prompted. That's why I asked for another memory dump.

As far as I'm aware, there are no plans to change the functionality of the always on service/system tray icon in Malwarebytes 3

Link to post
Share on other sites

OK, now I'm a bit confused...  I thought I had provided all the input you needed and that you'd been able to reproduce the problem.

Your comment about the always on icon is also a bit confusing, in light of the fact that the tray icon provides an overt "Quit Malwarebytes" feature.  "Always on" in my vocabulary seems to mean "having no provided ability to shut it down".  I don't mind having to choose "Quit Malwarebytes" after having run a scan manually.  The loss of that ability, however, would be a show stopper.

Do you need an event trace or memory dump to continue to investigate this issue?  If so, and just to make sure we're in sync, could you please reiterate the specific instructions?  I reproduced the problem as recently as yesterday:

Faulting application name: mbamservice.exe, version: 3.1.0.479, time stamp: 0x58f6af02
Faulting module name: ntdll.dll, version: 6.3.9600.18725, time stamp: 0x59380775
Exception code: 0xc0000005
Fault offset: 0x000000000003dd8e
Faulting process id: 0x1d9c
Faulting application start time: 0x01d2f587badf5750
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: aa11fc81-61a0-11e7-8387-1803734ec99c
Faulting package full name: 
Faulting package-relative application ID: 

-Noel

Edited by NoelC
Link to post
Share on other sites

@NoelC, sorry for the confusion. But if you right click the tray icon and choose Quit Malwarebytes, that should shutdown everything related to Malwarebytes 3 and leave it turned off until you either turn it back on or reboot (if you have automatic startup enabled).

The issue you're seeing with the service crashing is causing this to work differently though, and that's why you're seeing it restart, because as mentioned, we restart on a failure. Let's try to grab a crash dump of this process following the details below:

  1. Open Malwarebytes and go to Settings -> Protection
  2. Disable the Self Protection option
  3. Download the following Procdump.zip file: Procdump.zip
  4. Right click on procdump.zip and then choose properties
  5. In the window that pops up, click the unblock button near the bottom and then click ok
    1.png.2202fcb9683916b61d40cb0d4e0e6f50.png
  6. Extract procdump.zip.
  7. Open the folder where the files were extracted
  8. Right click 4 - mbamservice_crash and select Run as administrator.
    • If you did the steps correctly you should see a black screen similar to the following:
      2.png.5ed542a9426325e2fc54360bdca0ecb3.png
  9. Attempt to quit Malwarebytes from the tray so that mbamservice.exe crashes
  10. There should be a new file in the folder that ends with .dmp once the crash happens
  11. Right click the DMP file and choose Send to -> Compressed (Zipped) folder
  12. Reply with the dump file or upload the file to wetransfer.com and email it to dcollins@malwarebytes.com
Link to post
Share on other sites

  • 4 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.