Update to 3041469-service-freezing

[Horbs]

This is a followup to my last post.

Because there have been further developments, I thought it best to begin a new post here.

History.

At the end of march I posted here - https://forums.malwarebytes.com/topic/198469-mbam-3041469-service-freezing/.

Despite multiple responses to questions and file uploads this topic went nowhere, and my last response of April 16'th still hasn't been followed up.

So I haven't been able to do a file scan for months (Service kept hanging).

Now to the current problem.

Last week I noticed that a new version is out, and also that there's a new cleanup tool. So I :

1. Downloaded the cleanup tool

2. Unregistered my MalwareBytes

3. Rebooted

4. Ran the cleanup tool (which reinstalled MB after a reboot).

5. *** Attempted to re register my MBAM - which failed - "Activate License" is grayed out after I enter my Key and ID.

So where does this leave me?

I now have a situation on my main development machine where I CAN'T DO A VIRUS SCAN and I NOW HAVE NO REAL TIME PROTECTION.

Please help - you can imagine what I'm thinking about MBam right now.

mb-check-results_PreNewInstall.zip

mb-clean-resultsl.txt

[dcollins]

I apologize for not following up in your previous thread, but I believe your issue is resolved in 3.1.2. Now let's see about getting it installed properly for you

If your filename titles give any indication, mb-check was ran before you tried reinstalling? Can you run mb-check after you installed so we can see the output that's being generated.

Also, please include FRST logs

1. Download FRST and save it to your desktop
   1. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
2. Double-click to run and when the tool opens click Yes to the disclaimer
3. Press Scan button
4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   1. Attach both of these logs to your post by clicking on the "Drag files here to attach, or choose files..." or simply drag the files to the attachment area

[Horbs]

Thanks Devin - files attached.

 

The REALLY URGENT (sorry for shouting) issue at present is my inability to register my MBAM Pro license - so I've not got real time protection. 

What's the best way to fix that?

 

Note also that my current version IS 3.1.2 (3.1.2.1733), so the issue isn't fixed.

Addition.txt

FRST.txt

[dcollins]

Can you run mb-check from the following URL and upload the logs? It will contain information relevant to why you can't register.

https://downloads.malwarebytes.com/file/mb3_check

 

[Horbs]

Was out for a few hours, and when I got back (before I read your response Devin) I gave registration another try, and it worked.

 

No idea what the problem was, I used cut and paste each time so not a typo (and I must have done this 10 times over the past few months so lots of practice).

 

Anyhow, I only have the Service problem now so feeling much happier.

 

Have some calls to make and will then follow up on the current issue.

[Horbs]

@dcollins

OK Devin, here goes.

Last time you asked me to send a dump file, twice, and each time the dump file was huge so this time I decided to test with a smaller scan volume for checking to save time and file space (with the large dump files I had to use cloud storage to get the file to you and that was problematic)

I thought I'd do some testing first and here are the results from scanning a 32 Gig USB Stick with 14.5 gig free using a custom scan.

Observations using 3.1.2.1733

Custom Scan Objects

Uncheck all options : Scan succeeds

Then check "Scan Memory Objects" : Scan succeeds

Then check Scan Startup and Registry Settings : Service hangs.

I've then rebooted, check all options EXCEPT Scan for Rootkits, waited for the Service to hang, and generated a Dump File.

 

Ouch - dump file is still too large to attach (148,721 KB).

 

Will send it via wetransfer.com again. Unfortunately they purge the file after 7 days, and it takes about 30 minutes to upload - if there's an easier way to send it to you in future can you let me know?

 

Link to dump file is https://we.tl/GpIab5K5ry

 

By the way, I'm in Melbourne, Australia, so there's up to 17 hours time difference between us.

 

[dcollins]

Thanks Horbs. I'm going to PM you some instructions on some more information we need to get some more enhanced logs. I think I know the problem ,we just have to figure out what file we're hanging on.

[Horbs]

@dcollins

 

Thats great Devin

 

mb-check and reg file attached.

 

Horbs

 

Note - file attachments doesn't like .reg so I zipped it :-)

mb-check-results.zip

RegKey.zip

[dcollins]

Thanks, I'll PM you follow up instructions

[dcollins]

Can you try running a scan, and once it hangs, try clicking the X in the corner to close MB3 and then double click the desktop icon to bring it back up. Is it still in the same place?

[Horbs]

Here's a screen shot before the hang (Clip1.jpg)

 

Close the IDE after the hang and reopen - note that the Items Scanned field is blank.

But the Scan progress bar is still going (the screen no longer shows the true state ...

Clip2.jpg

Hmm, the screen shots didn't stick after saving.

 

Will try to attach the files.

 

Edited May 19, 2017 by Horbs

[Horbs]

One more thing Devin.

For the last few hours I've been getting notifications that Web Protection is off.Setting it to on indicates that it's "Starting", but it stays on Starting and never actually starts.

Shutting down MalwareBytes and starting it again just triggers the same behavior.

 

For me, the top priority is not being able to do a virus scan but maybe the other issue is related to the Service issue.

 

Seems I have the perfect machine for debugging issues with MalwareBytes :-)

 

Cheers

 

Robert (Horbs)

[Horbs]

Same thing just started happening on one of my laptops which is running version 3.0.6.1469 and has never had a problem up until now.

 

Something is afoot ?

[Horbs]

It's OK - I see it's a problem with an update.

 

Back to the Service problem

 

Sorry Devin.

[Porthos]

 

[Horbs]

Sorry for adding to the noise.

 

Back to @dcollins when he gets in for my pics above for my service freezing issue.

Edited May 19, 2017 by Horbs

[Horbs]

My response (with screen shots) to the last question asked by Devin on May 19 still hasn't received a reply

(please ignore the bit about web protection turning off as it was fixed with an update).

 

It looks like this long running issue (unable to perform a virus scan because the MalwareBytes Service freezes during a scan) has fallen into a black hole - again.

 

What do I need to do to get a solution for this long running problem?

 

Note that I'm now running Version 3.1.2.1733, Package 1.0.141 Update 1.0.2110 and the product still hangs early into the scan process ( whereby I have to kill the Service).

[dcollins]

 Can you try running a custom scan of C:\Program Files\Teracopy? Make sure that scan startup and registry is still checked as well

Edited June 8, 2017 by dcollins

[Horbs]

Thanks Deviin. Hangs on Heuristics Analysis.

[Horbs]

Had time for a play Devin. The notes in the above screenshot may be of interest.

Where the application hangs seems variable - perhaps because of the volume of data being processed.

Sure looks like a memory leak to me.

[Horbs]

Ouch - should have learned by now not to copy and paste screenshots. Here's the image (dragged from a saved file this time) :-)

[Horbs]

PS. - Looks like the Service does now recover, but fails to throw an exception when the scan terminates abnormally.

To recover the GUI I need to kill the service (and the GUI restarts back to a clean state).

However I still can't do a virus scan on my PC. So some progress has been made, but a lot of work left to do I'm guessing.

[Horbs]

Had some time to play so - after trying to browse log files -  tried the following :

1. Quit MalwareBytes.

2. Renamed log files in C:\ProgramData\Malwarebytes\MBAMService\logs

3. Started MalwareBytes.

6. Performed a custom scan of Drive C: and waited for the process to fail (stops iterating through scanned files in the main screen).

7. Killed the Service.

8. When the GUI reappeared I quit MalwareBytes.

 

The result is that we have a nice small easy to browse log file that makes it easy to see the errors.

 

Hope this helps ....

test_mbae-default.log

[dcollins]

The log provided is unfortunately not the right one, we need mbamservice.log and any mbamservice.log.bk* files. Running the latest mb-check will also grab those files for us.

Also, just to be clear, doing a scan of only c:\Program Files\Teracopy does cause the hang to occur? If so, are you able to zip that folder up and send it to me by chance? There may be a file in there tripping up our scans

[Horbs]

Sorry Devin, I'm an idiot - I attached the wrong file. Here is the ServiceLog, Cant find any files with a .log.bk* extension. .

 

Note that the service terminates part way through a scan irrespective of what folder I choose to scan (even tried it on a USB stick), but I'll have another play.

test_MBAMSERVICE.LOG