Malwarebytes 3.1.2 Not Starting Properly

[arbrich]

We have put those exceptions in and it has not helped. We are getting multiple calls daily with this issue and we cannot stop the MBAM Service, have to restart the machine and have resorted to Turning Anti-Exploit Protection OFF so people can work. WE have the same issue with SEP 12.1.6, 14, and 14MP1 and it is intermittent. It was suggested in another thread I opened to the Turn OFF Enable Self Protection Module so we are trying that. This has been a nightmare for us and our customers.

[dcollins]

@arbrich can you also provide the logs requested in the thread below? I'm curious if yours line up with the other ones we've received that don't show any errors happening

 

[arbrich]

They are the same logs I sent you in the other thread that I opened:

 

 

[shepcon]

Thanks for the input, Firefox.  I have used the mb-clean as well on several of the PCs but it's not resolving the issue.  It definitely performs the clean removal and re-install but it's not resolving the issue I'm having of the Malwarebytes components not starting properly upon reboot.

[shepcon]

Devin, while I appreciate that you're not seeing the issue in the logs, it's happening for certain.  And it's happening on dozens of our PCs.  And when the issue occurs, it renders the PC useless as you cannot open any Internet application or browser nor can you use Word or Excel.  It pretty much locks the PC down.

And I'm certain that the issue is with the latest build of Malwarebytes 3.1.2.  I have another dozen PCs that are still running Malwarebytes 3.0 and the issue has not occurred once.  Not once.

Is there a scheduled release of Malwarebytes soon or an early release?  I'm happy to try anything at this point.

Edited June 15, 2017 by shepcon

[arbrich]

It feels like a timing issue as sometimes you can boot and everything is fine and other times some Protections start and others do not start and then only ones active are Anti-Exploit and Anti-Ransomeware however many application will not run and MBAM gets stuck and the Service will NOT stop if you quit MBAM or try to shut it down from services.msc control panel. Then after a restart and MBAM starts running normally many times it will start running a scan thinking it missed they last one or in fact was stuck and had not scanned previously.

 

 

[arbrich]

I agree with Shepcon this is a bad problem and interaction with SEP and we need a fix as it is affecting every PC we work with that has SEP.

I will help test anything you have.

[shepcon]

Arbrich, have you tested using the service setting of Automatic (Delayed Start) in the services applet for Malwarebytes?  I completely agree that it's a timing issue.  And very random.  One reboot, it'll work fine.  And the next, it will not.

All of my affected PCs have been Windows 7 Pro x64 with SP1 and fully updated.  SEP 12.1.6 RU6 and RU8, which is the latest build.  Malwarebytes 3.1.2.  

[chakalakasp]

I've tried delayed start -- it doesn't help.

MBAM's response to all of this after more than a month is not confidence building.  "Please send us logs... we don't know, everything looks OK!"  Hey, here's a novel idea, why don't you use some of that $50M of VC funding you got to buy some Symantec licenses, install some clients on some testbed VMs, and do your own QC

[arbrich]

I will be happy to supply Sep 12.1.6, 14, 14MP1 client installs - Buy the way I have a couple machines with older versions of SEP 12.1 doing exactly the same thing. Just spent another 45 minutes fixing another customer machine.

[shepcon]

Have either of you actually tried disabling the self-protect with Malwarebytes?  While not the best setup, it's certainly better than what we have now with constant client calls following reboots.  Support clearly doesn't have an answer for our issue.

Edited June 15, 2017 by shepcon

[arbrich]

Yes, I have turned off the Self Protection Module on a couple machines and am waiting for results since it is so intermittent.

We have also turned Anti-Exploit OFF on a couple machines to see how we do. We figure we were just using SEP alone prior to this so giving anything a shot at this point.

 

 

[shepcon]

Thanks.  I have disabled the self-protection module on 7 client devices in 2 different networks.  All running SEP 12.1.6 with Malwarebytes 3.1.2.

[KLee368]

exact same problem here... the only quick solution is to remove mb using mb-clean-3.1.xxx.exe

 

would rather fix the problem if its possible

[shepcon]

KLee368, I have actually tried the mb-clean tool on several PCs and it's not solving my issue with Malwarebytes not starting all of the components properly.  And when they don't start properly, it's making the PC unusable.

[dcollins]

Sorry for the delay in responses. I was finally able to replicate this issue internally, and found a solution. Add the following exclusions into SEP and then reboot the computer, after that, MB3 should work properly.

[arbrich]

dcollins, Thanks for the info.

shepcon, I will try this on my end if you can do the same please report back and let us know what you find.

Thanks

 

 

[arbrich]

dcollins - cannot see all the exceptions and extensions  can you slide the bar over and upload again ??

[Firefox]

@arbrich

Here is the list...

I would like you to add these files to your Anti-Virus exclusions list as mentioned in this FAQ HERE (my list below includes the exe files as well)
 

• C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
• C:\Windows\system32\Drivers\farflt.sys
• C:\Windows\System32\drivers\mbae64.sys
• C:\Windows\System32\drivers\mbam.sys
• C:\Windows\System32\drivers\MBAMChameleon.sys
• C:\Windows\System32\drivers\MBAMSwissArmy.sys
• C:\Windows\System32\drivers\mwac.sys
  

Also please exclude the following folders too: (The complete folder)

• C:\Program Files\Malwarebytes\Anti-Malware
• C:\ProgramData\Malwarebytes\MBAMService
  

[arbrich]

Just tried it and turned SELF Protection module On again and after first reboot  - WebProtection and MalwareProtection OFF again, tried quitting MBAM and service hung - trying to stop, rebooted again and it came up so I turned SELF Protection module OFF again.

[shepcon]

It didn't work for me either.  I manually added all of these file and folder exceptions to SEP and then rebooted.  MB3 still didn't start-up Web Protection and Malware Protection properly.  Disabled Self-Protection Module and rebooted and all returned to normal with MB3.

Clearly the issue is with the Self-Protection Module and SEP.

[dcollins]

I did most of my testing with SEP14. I know @shepcon is using SEP12, so I'll need to test that version as well.

Shep, can you confirm that you added C:\Windows\System32\drivers\MBAMChameleon.sys to the exclusion list? I noticed that was the important one for me, and that's our self-protection driver.

[shepcon]

I did.  There were six (6) driver exceptions and several folders\files.  I'm using SEP 12.1.6

C:\Windows\system32\Drivers\farflt.sys
C:\Windows\System32\drivers\mbae64.sys
C:\Windows\System32\drivers\mbam.sys
C:\Windows\System32\drivers\MBAMChameleon.sys
C:\Windows\System32\drivers\MBAMSwissArmy.sys
C:\Windows\System32\drivers\mwac.sys

C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe

Also please exclude the following folders too: (The complete folder)
C:\Program Files\Malwarebytes\Anti-Malware
C:\ProgramData\Malwarebytes\MBAMService

[dcollins]

What type of exclusions did you add? I added each file as an application exception and chose ignore for the action to take. I did have to reboot three or four times before Mb3 would startup properly (even with Self-Protection turned on), so I'm not 100% sure what's going on. We are working on trying to solve this at a programatic method, but this seems to be working for now. I'm not sure if there are other factors in play on your machines, do you have any other security software?

[shepcon]

Devin, I can confirm that after rebooting each test PC a 2nd time following making these SEP 12 exceptions, Malwarebytes 3.1.2 is starting properly now with all modules and the Self-Protection module enabled.  I've done 4 now as a test and a 2nd reboot has been consistently needed for whatever reason.

And I have been adding the SEP exceptions as file and folder exceptions with Ignore for all scans.  An application exception for each file has the same effect with SEP if "all-scans" is the rule type.  I've also been cheating a touch to speed-up my tests by adding C:\Program Files\Malwarebytes\* and C:\ProgramData\Malwarebytes\* to cover all MB3 data in each folder.  For better security, individual exceptions would be better.

Thanks.