Jump to content

Recent Malwarebytes Update causes Outlook mso20win32client.dll crash/fault


Recommended Posts

@dcollins I generated the mb_check file using mb3_check utility as your requested and sent the .zip file directly to you. I've not heard back and my Malwarebytes install is still showing as non-premium meaning I cannot evaluate your latest update. We continue to get error reports from customers regarding this issue where the exploit protection feature causes a crash within the mso20win32client.dll library during shutdown. Disabling the Exploit Protection feature does mitigate this issue when your software is installed. 

 

This ssue does not occur when Malwarebytes is not installed and we've never had reports of this issue until you released Malwarebytes v3. The only customers reporting this issue are those using Malwarebytes v3. 

 

 

Link to post
Share on other sites

I may have found the trigger of the issue which I still believe is a defect caused by Malwarebytes. When the gSyncit system tray unloads it will invoke Application.Quit() on the Outlook object model of which it has a COM reference to. If I disable this Quit() call with the Exploit Protection feature enabled then the issue does not occur. gSyncit has performed this call to Quit() for the past 9 years (or as far back as I can recall). It only triggers this 0x0 error when the Exploit Feature is enabled.

Can you please describe what your Exploit Protection feature is doing? 

Link to post
Share on other sites

I did a little more debugging and calling _Application.Session.Logoff() also causes Malwarebytes to trigger a crash on shutdown. It looks like when the COM interface reference is released during the system shutdown that's when the issue occurs. As noted previously, if I disable Exploit Protection then the issue goes away. 

Link to post
Share on other sites

I uninstalled MB, reinstalled it and was able to reset the Trial. I spent three hours trying out different things and nothing worked in terms of working around this issue. Malwarebytes is hooking into or doing something to mso20win32client.dll to cause it encounter a null pointer/reference. 

In my code I tried removing the _Application.Quit() call, I tried switching to _Application.Session.Logoff(), I tried not doing nothing (m_outlook = null) and letting the .Net garbage collector release the reference and in all cases the same error occurs. HOWEVER, if I disable MB v3.2 the issue magically disappears. 

The gSyncit system tray app is a .Net application that uses the Outlook Object Model to interface with Outlook. Honestly, nothing fancy in the system tray utility (IMHO). All COM reference counting/memory is handled by the .Net framework which in my experience works quite well. 

 

WHAT does Exploit Protection do? How does it work? Does it hook into LoadLibrary calls? Does it do anything specific with mso20win32client.dll? 

   

Link to post
Share on other sites

I continue to have the same issue reported by cyberhex since the Malwarebytes 3.2 update.  As noted earlier in the thread, unlike cyberhex's experience my issue does not go away when I disable the exploit protection in Malwarebytes, but it does go away when I disable MB entirely.  I did some more experimentation this morning and found that the problem does reliably go away for me when I disable the ransomware protection in MB.  Not sure why my experience in this regard is slightly different, but the basics of the problem seem to be the same for me.

Link to post
Share on other sites

On 8/25/2017 at 10:22 AM, dcollins said:

@cyberhex also, can you check if leaving Exploit Protection enabled, but disabling Ransomware Protection causes the problem to go away as well? We had reports from another user that this also worked

Sorry for the late reply, but this seems to work for me as well running 3.2.2.2018/1.0.188/1.0.2788.

Link to post
Share on other sites

On 9/15/2017 at 7:21 AM, FarmerBrown said:

I cannot speak for everyone, and cannot say every time, but since the last update a couple days ago, the problem seems to be solved.  For the last three nights I shut down with no problem.

Still no problems.  I do not know what changed, but I have not had any problems since around 09-10.

Link to post
Share on other sites

  • 2 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.