Malwarebytes System Tray Icon Missing After Latest Update

[Porthos]

1 minute ago, MadDemon64 said:

You know what the weirdest thing is?  In the past, reinstalling malwarebytes was a good way to make sure the tray didn't crash for around 20 days, but now that doesn't even work.

That is why any computer I apply power to is on Win 10 and using Defender personally  and all of my clients. I set exclusions and never had issues, I have 100"s of clients.

Its budget friendly and it works. PS you can still upgrade to 10 till the 31st.

We will let @dcollins continue.

[MadDemon64]

Forgot: here are the new dmp files

mbamtray.exe.5960.dmp

[lmacri]

23 hours ago, MadDemon64 said:

It happened again, and I had added Malwarebytes to the exclusion list for Norton.  Please tell me I'm not the only person who still has this problem.

Hi MadDemon64:

Just an FYI that I also use Norton as my AV and continue to see intermittent mbamtray.exe crashes after boot-up since updating to the latest Component Update Package v1.0.262. See my 11-Dec-2017 post # 18 of my thread MB v3.2.2 - System Tray Icon Missing After mbamtray.exe APPCRASH.

If anything, the conflicts with Norton v22 and MB v3 seem to have gotten worse, not better, since my CU package was updated from v1.0.236 to v1.0.262.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262

[dcollins]

@MadDemon64 can you clarify something for me?

Rebooting your computer allows the tray icon to show up but shutting down and powering back up does not?

[MadDemon64]

59 minutes ago, dcollins said:

@MadDemon64 can you clarify something for me?

Rebooting your computer allows the tray icon to show up but shutting down and powering back up does not?

No, it's random.  Sometimes it shows up after shutting down and powering back up, sometimes it doesn't, and the same applies to rebooting.

Malwarebytes proper always works, but the tray just decides when it wants to and doesn't want to work.

Edited December 24, 2017 by MadDemon64

[MadDemon64]

3 hours ago, lmacri said:

Hi MadDemon64:

Just an FYI that I also use Norton as my AV and continue to see intermittent mbamtray.exe crashes after boot-up since updating to the latest Component Update Package v1.0.262. See my 11-Dec-2017 post # 18 of my thread MB v3.2.2 - System Tray Icon Missing After mbamtray.exe APPCRASH.

If anything, the conflicts with Norton v22 and MB v3 seem to have gotten worse, not better, since my CU package was updated from v1.0.236 to v1.0.262.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262

You think it's Norton?

[lmacri]

3 hours ago, MadDemon64 said:

You think it's Norton?

Hi MadDemon64:

I haven't proven that Norton is involved, but when I monitor my system with Sysinternal's Process Explorer I can see that mbamtray.exe and the second instance of my Norton executable nsbu.exe (i.e., the instance of nsbu.exe owned by the logged in USER that manages low-priority tasks like launching of the Norton GUI and background maintenance tasks) both wait to load into memory after a system restart until I log into my Windows account - see <here> for sample data.  Right now my best guess is that mbamtray.exe will sometimes crash if it has to compete for system resources also used by nsbu.exe and/or other executables that load into memory immediately after the USER logs in to Windows.

There is also a known conflict between the anti-exploit modules of Norton v22 and MB v3, although I don't know if that could affect the launch of mbamtray.exe. The 06-Dec-2017 change log for the latest MBAE v1.11 build 45 at https://www.malwarebytes.com/support/releasehistory/ says "Fixed a conflict with Norton Security", but the 07-Dec-2017 change log for the Component Update Package v.1.0.262 <here> doesn't mention whether that fix was actually included in CU package v1.0.262.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262 

Edited December 24, 2017 by lmacri

[dprout69]

I don't have Norton and it does the same thing

[MadDemon64]

On 12/24/2017 at 8:40 AM, dprout69 said:

I don't have Norton and it does the same thing

 

On 12/23/2017 at 11:00 PM, lmacri said:

Hi MadDemon64:

I haven't proven that Norton is involved, but when I monitor my system with Sysinternal's Process Explorer I can see that mbamtray.exe and the second instance of my Norton executable nsbu.exe (i.e., the instance of nsbu.exe owned by the logged in USER that manages low-priority tasks like launching of the Norton GUI and background maintenance tasks) both wait to load into memory after a system restart until I log into my Windows account - see <here> for sample data.  Right now my best guess is that mbamtray.exe will sometimes crash if it has to compete for system resources also used by nsbu.exe and/or other executables that load into memory immediately after the USER logs in to Windows.

There is also a known conflict between the anti-exploit modules of Norton v22 and MB v3, although I don't know if that could affect the launch of mbamtray.exe. The 06-Dec-2017 change log for the latest MBAE v1.11 build 45 at https://www.malwarebytes.com/support/releasehistory/ says "Fixed a conflict with Norton Security", but the 07-Dec-2017 change log for the Component Update Package v.1.0.262 <here> doesn't mention whether that fix was actually included in CU package v1.0.262.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262 

Well, maybe you're on to something here.  Let's try the "delay real-time protection" option and see if that fixes the problem.  If it is indeed crashing because it's fighting for system resources, maybe delaying protection, then maybe delaying the protection until the resources are free might prevent a crash.

Just a theory, but let's try it.

[dcollins]

It's been awhile since I asked, and it was mixed in with other results, so I'd like to get some confirmation.

If we disable self-protection under Settings -> Protection, does the system tray boot properly?

[lmacri]

1 hour ago, MadDemon64 said:

...Let's try the "delay real-time protection" option and see if that fixes the problem.  If it is indeed crashing because it's fighting for system resources, maybe delaying protection, then maybe delaying the protection until the resources are free might prevent a crash.

Hi MadDemon64:

Your findings may differ from mine but I already ran that test and it made no difference on my 32-bit Vista SP2 computer  - see my 26-Sep-2017 post # 10 of my thread MB v3.2.2 - System Tray Icon Missing After mbamtray.exe APPCRASH.

Delaying real-time protection (Settings | Protection | Startup Options | Delay Real-Time Protection When Malwarebytes Starts) delays the initial loading of MBAMService.exe (the service owned by SYSTEM) at initial boot-up, but mbamtray.exe (the process owned by the USER) doesn't load until the initial boot-up is complete and the USER has logged in to their Windows user account. I can re-boot my computer and let it sit for hours, but mbamtray.exe (and other processes owned by the USER like nsbu.exe for Norton background tasks, taskeng.exe for my Windows Calendar, etc.) don't start until I log into Windows.

The only way that I can consistently prevent mbamtray.exe from crashing on my system is to disable Settings | Protection | Startup Options | Start Malwarebytes at Windows Startup and then launch Malwarebytes manually AFTER my system has booted up and AFTER I have logged into my Windows user account.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262

[MadDemon64]

45 minutes ago, dcollins said:

It's been awhile since I asked, and it was mixed in with other results, so I'd like to get some confirmation.

If we disable self-protection under Settings -> Protection, does the system tray boot properly?

I'll try that and get back to you on the results.

 

44 minutes ago, lmacri said:

Hi MadDemon64:

Your findings may differ from mine but I already ran that test and it made no difference on my 32-bit Vista SP2 computer  - see my 26-Sep-2017 post # 10 of my thread MB v3.2.2 - System Tray Icon Missing After mbamtray.exe APPCRASH.

Delaying real-time protection (Settings | Protection | Startup Options | Delay Real-Time Protection When Malwarebytes Starts) delays the initial loading of MBAMService.exe (the service owned by SYSTEM) at initial boot-up, but mbamtray.exe (the process owned by the USER) doesn't load until the initial boot-up is complete and the USER has logged in to their Windows user account. I can re-boot my computer and let it sit for hours, but mbamtray.exe (and other processes owned by the USER like nsbu.exe for Norton background tasks, taskeng.exe for my Windows Calendar, etc.) don't start until I log into Windows.

The only way that I can consistently prevent mbamtray.exe from crashing on my system is to disable Settings | Protection | Startup Options | Start Malwarebytes at Windows Startup and then launch Malwarebytes manually AFTER my system has booted up and AFTER I have logged into my Windows user account.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262

Well, that's also interesting.  It only affects automatic startup but not manual startup?  Bet the people who make Malwarebytes could use that info.

[dcollins]

Another user having this problem ran a scan in safe mode, and discovered some trojans that, once removed, allowed the tray to load properly. Can you try running a full rootkit scan in safe mode to see if any detections are picked up?

[MadDemon64]

22 minutes ago, dcollins said:

Another user having this problem ran a scan in safe mode, and discovered some trojans that, once removed, allowed the tray to load properly. Can you try running a full rootkit scan in safe mode to see if any detections are picked up?

I'll look into that.

[MadDemon64]

56 minutes ago, dcollins said:

Another user having this problem ran a scan in safe mode, and discovered some trojans that, once removed, allowed the tray to load properly. Can you try running a full rootkit scan in safe mode to see if any detections are picked up?

Well, the scan completed and found nothing.  Rootkit detection was on and the computer was in safe mode without networking.  Malwarebytes found nothing.

[MadDemon64]

Also, I just ran RKill, TDSSKiller, and HitmanPro (without safe mode on). They found nothing either.

[lmacri]

22 hours ago, dcollins said:

Another user having this problem ran a scan in safe mode, and discovered some trojans that, once removed, allowed the tray to load properly. Can you try running a full rootkit scan in safe mode to see if any detections are picked up?

Hi dcollins:

My full system scan from Safe Mode with rootkit scanning enabled took almost 8 hours on my 32-bit Vista SP2 machine (a similar scan on the same computer with MBAM v2.2.1 used to take under 2 hours) but like MadDemon64 reported in post # 90, my scan didn't find any threats.  I had one Heuristics.Shuriken detection for an old Xerox printer plugin XM7750P.dll but Malwarebytes employee Atribune confirmed <here> it was a false positive.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262 

Edited December 28, 2017 by lmacri

[MadDemon64]

40 minutes ago, lmacri said:

Hi dcollins:

My full system scan from Safe Mode with rootkit scanning enabled took almost 8 hours on my 32-bit Vista SP2 machine (a similar scan on the same computer with MBAM v2.2.1 used to take under 2 hours) but like MadDemon64 reported in post # 90, my scan didn't find any threats.  I had one Heuristics.Shuriken detection for an old Xerox printer plugin XM7750P.dll but Malwarebytes employee Atribune confirmed <here> it was a false positive.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262 

Strange, it only took my computer 15 minutes for a full scan in safe mode with rootkit enabled.

Either something is wrong with my scan or Windows 8.1 computers are beyond faster than Windows Vista computers.

[lmacri]

2 hours ago, MadDemon64 said:

Strange, it only took my computer 15 minutes for a full scan in safe mode with rootkit enabled....

Hi MadDemon64:

See Tex10's thread Custom Scans take 8 to 12 hours or more to complete.  It takes several hours for a MB v3.x full system scan to scan almost a decade worth of software updates (~20,000 subfolders) in my Windows component store at C:\Windows\WinSxS, and I'm sure having a dual core CPU / 3 GB RAM in my 32-bit Vista SP2 computer doesn't help.  I also included D:\ drive (my HP recovery partition) in my scan.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[MadDemon64]

4 hours ago, lmacri said:

Hi MadDemon64:

See Tex10's thread Custom Scans take 8 to 12 hours or more to complete.  It takes several hours for a MB v3.x full system scan to scan almost a decade worth of software updates (~20,000 subfolders) in my Windows component store at C:\Windows\WinSxS, and I'm sure having a dual core CPU / 3 GB RAM in my 32-bit Vista SP2 computer doesn't help.  I also included D:\ drive (my HP recovery partition) in my scan.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Fair enough.

[lmacri]

On 12/26/2017 at 9:34 PM, dcollins said:

...If we disable self-protection under Settings -> Protection, does the system tray boot properly?

Hi dcollins:

I've shut down and re-booted my computer about a dozen times since disabling MB v3 self-protection (Settings | Protection | Startup Options | Enable Self-Protection Module | OFF) and so far my MB icon has loaded correctly in the system tray every time.

The mbamtray.exe APPCRASHes were an intermittent problem on my 32-bit Vista SP2 computer but usually occurred every 2 or 3 re-boots so I'm still not 100% certain that the MB self-protection module is the cause.  I'll continue to monitor over the long weekend and post back if I see another crash.

Just a side note that this is the first time I've tried testing with MB v3 self-protection disabled.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.3 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262

[MadDemon64]

4 minutes ago, lmacri said:

Hi dcollins:

I've shut down and re-booted my computer about a dozen times since disabling MB v3 self-protection (Settings | Protection | Startup Options | Enable Self-Protection Module | OFF) and so far my MB icon has loaded correctly in the system tray every time.

The mbamtray.exe APPCRASHes were an intermittent problem on my 32-bit Vista SP2 computer but usually occurred every 2 or 3 re-boots so I'm still not 100% certain that the MB self-protection module is the cause.  I'll continue to monitor over the long weekend and post back if I see another crash.

Just a side note that this is the first time I've tried testing with MB v3 self-protection disabled.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.3 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262

Ditto.  So far, so good.

[MadDemon64]

Well, it's almost been three weeks since I disabled self-protection, and the tray has yet to crash once.  I think we have, with only hesitant certainty, found the cause.

[hopper15]

3 hours ago, MadDemon64 said:

Well, it's almost been three weeks since I disabled self-protection, and the tray has yet to crash once.  I think we have, with only hesitant certainty, found the cause.

Not surprised. I have to disable the self- protection anytime I have to reboot my pc. If I don't the tray app will often crash on starup.

Hopefully MB eventually finds a fix for this issue.

Edited January 17, 2018 by hopper15

[lmacri]

On 12/29/2017 at 11:37 AM, lmacri said:

I've shut down and re-booted my computer about a dozen times since disabling MB v3 self-protection (Settings | Protection | Startup Options | Enable Self-Protection Module | OFF) and so far my MB icon has loaded correctly in the system tray every time.

The mbamtray.exe APPCRASHes were an intermittent problem on my 32-bit Vista SP2 computer but usually occurred every 2 or 3 re-boots so I'm still not 100% certain that the MB self-protection module is the cause.  I'll continue to monitor over the long weekend and post back if I see another crash....

Hi dcollins:

Just an update to my early test results in post # 96:

• I disabled MB self-protection from 28-Dec-2017 to 06-Jan-2018 and did not see a mbamtray.exe APPCRASH the entire time self-protection was disabled (that includes at least 2 or 3 system restarts on most days).   
• I re-enabled MB self-protection on 07-Jan-2018 and went back to my usual routine of powering off every night and restarting every morning.  I immediately had one BEX (buffer overflow exception / application has stopped working) error for mbamservice.exe on 08-Jan-2018 (Problem Event Name: BEX; Application Name: mbamservice.exe; Application Version: 3.1.0.595; Fault Module Name: rtp.dll_unloaded).  I expected the mbamtray.exe APPCRASHes to return within a day or two, but the first mbamtray.exe crash didn't occur until 15-Jan-2018.

Here's the mini-dumps for my two mbamtray.exe APPCRASHes after MB Self-Protection was re-enabled on 07-Jan-2018:
             15-Jan-2018:  mbamtray.exe.2220.dmp
             18-Jan-2018:  mbamtray.exe.3356.dmp
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.3 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262