Protection module lockup issues with Mcafee 8.7i

[Leon Black]

We are having issues with Malwarebytes protection module. With the latest version of Mcafee VirusScan 8.7i with patch 1, and the latest Malwarebytes 1.39.

The scans work as normal. However, when we enable the protection module in Malwarebytes, the next time the PC is rebooted, it will boot to the desktop, desktop icons will appear. When you try to click anything (start menu for example) the system will freeze. The mouse still moves, but you cannot click on anything. Event viewer shows nothing. Reboot into safemode, disable protection, and the PC will boot and function normally again.

I have tested this issue on a few bench PC's with fresh installs of Windows XP SP3 and Mcafee 8.7i patch 1. Hardware is not similar to any of the PC's.

A couple of our customers we are trying to sell Malwarebytes protection are also experincing this with Mcafee 8.7i patch 1.

I have even tried to install one before the other, it doesn't matter.

Thanks for any assistance,

Leon

[yardbird]

Welcome to the Forum! Please review this thread below!

http://www.malwarebytes.org/forums/index.php?showtopic=18093

You will need Mcafee to trust these

files, you need to put in your AV/Firewall for mbam to trust

C:\WINDOWS\system32\drivers\mbam.sys

C:\WINDOWS\system32\drivers\mbamswissarmy.sys

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref (Windows 2000/XP)

Please post back with a report.. regards..

Also see if you can run a quick scan of malwarybytes in windows after the above is done

A couple of our customers we are trying to sell Malwarebytes protection are also experincing this with Mcafee 8.7i patch

just an FYI: If you have a Corporate license? you need to contact <corporate@malwarebytes.org>

[Leon Black]

In Mcafee enterprise virus scan, I don't really see anywhere to "Trust" malwarebytes. There is many, many areas I can add exclusions to allow malwarebytes to edit system files, or edit Mcafee files, but nothing about just accessing them. Not really sure where to go from here. There is no firewall.

We would love to sell your product, but if we cannot get it to play nice with our antivirus app, we can't recommend it.

If anyone would have time to look into this, or log in remotely to check settings, I would be happy to help.

Thanks,

Leon

[yardbird]

Hi! I posted this above, if you did not see it? Give it a try please: just an FYI: If you have a Corporate license? you need to contact <corporate@malwarebytes.org>

[Leon Black]

I have added mbam.exe, mbam.sys, mbamswissarmy.sys, rules.ref, mbam-dor.exe, mbamgui.exe, mbamservice.exe, services.exe to every single "exclusion" I can find on Mcafee enterprise, and still have the same lockup results on multiple PC's.

Here is what I experience;

If I boot the PC WITHOUT the Malwarebytes protection module, it boots normally. I can then go into Malwarebytes and enable the protection module. The PC will run fine. Does a quick scan, full scan okay. Mcafee enterprise and Malwarebytes get along.

If I then check the box to let Malwarebytes protection to start with windows, reboot the PC. The PC will boot, show the icons, and then lock up. I can't click on anything. The only way to get the PC to boot normally again is to reboot in safemode, and disable Malwarebytes protection from auto loading.

There is definitely still something wrong here. I can reproduce this issue on multiple PC's running XP Professional. Vista business seems unaffected, as the PC I currently am on are running both malwarebytes protection module and mcafee enterprise in tandem.

We would like to solve this issue soon, as we recommend your product to our customers.

~Leon

[Leon Black]

Following your instructions, we installed Malwarebytes on 6 PC's with your instructions. These PCs are all running windows XP with SP3 and Mcafee 8.7i patch 1. 4 of the 6 PC's are running fine with the protection module enabled. 2 of the 6 display the similar lockup with the protection module. Issues we have seen before. Note: All PC's do a quick/full scan normally.

Please advise. Is there a number we can call to discuss this? I can't be the only one running into this issue.

~Leon

[TeMerc]

Please heed yardbirds advice, if you're a licensed corporate user, contact corporate at the email he suppl pied.

If you're not a licensed corporate user, but using either of the Free or PRO versions in a corporate environment, you need to contact corporate to get legally licensed. They can be reached for pricing via the webform below. Responses that include complete contact information (phone, email, company, address, etc) via our corporate webform below are prioritized:

http://www.malwarebytes.org/corporate.php

These will be responded to over an anonymous email requesting a response.

[GT500]

In Mcafee enterprise virus scan, I don't really see anywhere to "Trust" malwarebytes. There is many, many areas I can add exclusions to allow malwarebytes to edit system files, or edit Mcafee files, but nothing about just accessing them. Not really sure where to go from here. There is no firewall.

Yardbird is referring to the exceptions list in McAfee. You need to add the MBAM files to it.

[Leon Black]

Yardbird is referring to the exceptions list in McAfee. You need to add the MBAM files to it.

See post #5:

I have added mbam.exe, mbam.sys, mbamswissarmy.sys, rules.ref, mbam-dor.exe, mbamgui.exe, mbamservice.exe, services.exe to every single "exclusion" I can find on Mcafee enterprise, and still have the same lockup results on multiple PC's.

We have a registered and licensed corperate account with Malwarebytes. One of our other consultants was working with someone, but not really getting anywhere. He was constantly told it will be fixed in the next version. This could be from him dropping the ball. I have picked it up. I just now have signed up for the helpdesk site, and sent a request via the webform.

[GT500]

We have a registered and licensed corperate account with Malwarebytes. ...

We have special support staff for corporate customers. Please send an e-mail to corporate <at> malwarebytes <dot> org and they will get you in touch with our corporate support staff.

My last thought before you fire off the e-mail: The issue might be caused by MBAM loading too early, and using a script to delay the startup might solve the issue. Doing this would be as simple as setting the startup type of MBAMService to manual, and then using a script to start the service on startup after a delay of some sort.

[wildpig]

I tried the steps in the sticky post about what to add in McAfee. still doesn't work. I am wondering if the problem is not just you have to tell mcafee to exclude mbam. I am wondering if there is a way to tell mbam that it also need to ignore McAfee.

Anyone else also have problem with Mcafee and mbam combo?

[GT500]

wildpig, I assume that the issues do not exist if you start MBAM manually after everything has finished loading at startup?

[AdvancedSetup]

There is a known issue with starting the MBAM Protector when Windows starts. McAfee pushed out some update about a week ago that caused this. Their program for some reason no longer honors what you tell it to do. The best I can offer for now is to stop MBAM from loading when Windows starts and start it up a minute or so later after the system has loaded and it will be fine. Then complain to McAfee that you have MBAM on exclusion and that their program is no longer honoring the exclusion.

We are working on a work around and hopefully it will be ready for beta test next week so keep an eye out and post back if you'd like to try the new beta.

[wildpig]

wildpig, I assume that the issues do not exist if you start MBAM manually after everything has finished loading at startup?

No, haven't really tried it like that. Will try that to see if that works.

There is a known issue with starting the MBAM Protector when Windows starts. McAfee pushed out some update about a week ago that caused this. Their program for some reason no longer honors what you tell it to do. The best I can offer for now is to stop MBAM from loading when Windows starts and start it up a minute or so later after the system has loaded and it will be fine. Then complain to McAfee that you have MBAM on exclusion and that their program is no longer honoring the exclusion.

We are working on a work around and hopefully it will be ready for beta test next week so keep an eye out and post back if you'd like to try the new beta.

Thanks for letting me know. That's too bad McAfee doesn't want to play nice. Will look forward to the MBAM beta. Might just have to stop using McAfee.....

[Leon Black]

The issue still remains, and I don't think I received a response from the Malwarebytes Support team. As of now, we have had to put future purchases of Malwarebytes on hold.

I will try the Malwarebytes delayed start and let you know what happens.

~Leon

[whatmeworry?]

I will try the Malwarebytes delayed start and let you know what happens.

Though some people have apparently found that the delayed start works, I continued to have problems even after trying to delay MBAM's start. See this thread:

http://www.malwarebytes.org/forums/index.p...c=21873&hl=

I gather that there will soon be a beta one can test to see whether it cures the problem.

[Leon Black]

Though some people have apparently found that the delayed start works, I continued to have problems even after trying to delay MBAM's start. See this thread:

http://www.malwarebytes.org/forums/index.p...c=21873&hl=

I gather that there will soon be a beta one can test to see whether it cures the problem.

That would be great. I can easily reproduce this problem, as every computer we load has Mcafee 8.7i Patch 1 installed, be it a Dell, HP or other. It would take no time at all to load MBAM Full with protection module and see what happens.

I am not sure what is being fixed in the next version. I can provide as much information of what we have seen, I don't know if it will help.

On average, 12 out of 20 of the PC's we install with MBAM & Mcafee (latest versions of both) experience lockups right away upon boot up. No matter what you exclude from Mcafee, the lockups remain. The PC will NEVER lock up with the protection module disabled. For example, when you do a manual MBAM scan. MBAM scans will take longer if Mcafee is running its "on-demand" scan while doing a manual MBAM scan, as the files get checked by both programs. The PC's have a fresh OS load with no other programs beside Mcafee and MBAM.

As for the 8 or so PC's that seem to run okay, half of them will start the same lockup problem as above, later in life.

The only similarity between all the PC's, they are running Windows XP Professional SP3.

We have tried MBAM Full on Vista Business PC's running Mcafee 8.7i Patch 1 and haven't experienced any issues as of yet. Also, we haven't had to add any exclusions to Mcafee. Although we have only tried it on 3 PC's, including the one I am on now.

[Firefox]

come to think of it, I believe that I am having the same problem as Leon Black, except I am using 8.5i version of McAfee.

[whatmeworry?]

The only similarity between all the PC's, they are running Windows XP Professional SP3.

Well, I should add that I'm using XP Pro with SP2, and I'm definitely having problems with MBAM. However, I've been immensely impressed with MBAM support. I think if anyone can fix the incompatibility problem, these folks can.

[wildpig]

I am using XP SP2 and SP3 and have tried both McAfee 8.5i and 8.7i with all the latest patches. McAfee has been real crappy at trying to solve this problem. I have just kind of live with this problem for months but it's getting so annoying. For me, my experience is that the computer right after boot up would freeze up for about 1-2 minutes. This would happen immediately if i start Internet Explorer. Then the computer would unfreeze with windows security alert saying mcafee is not running as mcafee would quit for a few seconds then it restarts. This would repeat every time i try to open IE or something for exactly 4 times. Then after that, i can get on with my usage and this problem would never come up again until next reboot time.

I ve been able to kind of live with it as it only prolongs my time before i can start using the computer as i kind of count it as part of the boot time. But it is extremely annoying.....

[YoKenny1]

Well, I should add that I'm using XP Pro with SP2, and I'm definitely having problems with MBAM. However, I've been immensely impressed with MBAM support. I think if anyone can fix the incompatibility problem, these folks can.

Any reason why you have not updated to SP3 as it provides Windows performance improvements and several Critical updates.

I doubt anything can be done to improve McAfee performance though.

[whatmeworry?]

Any reason why you have not updated to SP3 as it provides Windows performance improvements and several Critical updates.

You raised that question earlier and I answered it.

[Leon Black]

You raised that question earlier and I answered it.

I've never seen a computer get screwed up by installing SP3, unless it already had a problem. I HAVE seen many computers get easily infected because they do not have SP3 and the updates that come down after installing SP3.

[YoKenny1]

I guess whatmeworry? would rather struggle along for 2 months and complain than take advantage of SP3's performance enhancements?

Might make McAfee work better but the only cure for that is more RAM and a faster CPU.

[GT500]

I guess whatmeworry? would rather struggle along for 2 months and complain than take advantage of SP3's performance enhancements?

In a corporate situation you often cannot upgrade Service Packs for an extended period of time because of software incompatibilities. Yes, that is a huge security risk, but since most custom made software for corporate use is not tested on anything other than the Service Pack that the company that ordered the software uses it's almost never compatible with other Service Packs.