MB v3.2.2 - SystemTray Icon Missing After mbamtray.exe APPCRASH

[lmacri]

I've been experiencing an intermittent problem since I upgraded to MB v3.2.2 where the Malwarebytes icon doesn't load in the system tray at boot-up.  I can still launch MB from my start menu when this happens so I don't think it's affecting my real-time protection, and the icon loads correctly if I re-boot my system.

I don't know if this is a coincidence, but I have my automatic Threat Scans set to run once every three days at 6:00 PM and mbamtray.exe only crashes at boot-up on the days that I have a Threat Scan scheduled to run.  I had one or two of these crashes in the past with MB v3.1.2 and they also occurred on a day a Threat Scan was scheduled.

I noticed that MadDemon64 posted about a similar problem today in the thread Malwarebytes System Tray Icon Missing After Latest Update so thought I'd go ahead and post about this.  I have a few small (~80 KB) dump files I can attach to my next reply if that would be helpful.

mb-check-results.zip

Addition.txt

FRST.txt

 

Here's my latest APPCRASH report from this morning:
----------------------------------
Product
Malwarebytes Tray Application

Problem
Stopped working

Date
30/08/2017 6:31 AM

Status
Report Sent

Problem signature
Problem Event Name:    APPCRASH
Application Name:    mbamtray.exe
Application Version:    3.0.0.1169
Application Timestamp:    5997224a
Fault Module Name:    kernel32.dll
Fault Module Version:    6.0.6002.19623
Fault Module Timestamp:    56ec3707
Exception Code:    c0000142
Exception Offset:    00009f55
OS Version:    6.0.6002.2.2.0.768.3
Locale ID:    4105
Additional Information 1:    9d13
Additional Information 2:    1abee00edb3fc1158f9ad6f44f0f6be8
Additional Information 3:    9d13
Additional Information 4:    1abee00edb3fc1158f9ad6f44f0f6be8

Extra information about the problem
Bucket ID:    1726386488

----------
32-bit Vista Home Premium SP2 * NS Premium v22.10.0.85 * Firefox ESR v52.3.0 * MB Premium v3.2.2.2018-1.0.188
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[dcollins]

The dump files would be extremely helpful!

[lmacri]

Hi dcollins:

These mini-dumps are currently located in the hidden folder C:\Users\<username>\AppData\Local\CrashDumps on my Vista SP2 machine.  I frequently purge older scan logs from my report history so I can't say with 100% certainty that these crashes only occur at boot-up on days when a Threat Scan is scheduled.

I only had two of these errors after upgrading from MBAM v2.2.1 to MB Premium v3.1.2 on 03-Jun-2017.  I used the mbam-clean removal tool per the instructions at https://forums.malwarebytes.org/index.php?/topic/122284-mbam-clean-removal-process/ after I deactivated my license in MBAM v2.2.1.

06-Jun-2017:  mbamtray.exe.3404.dmp
13-Jun-2017:  mbamtray.exe.2416.dmp

It looks like these crashes have become more regular since I performed an over-the-top update from v3.1.2 to v3.2.2 on 27-Aug-2017.  My next Threat Scan is scheduled to run tonight (30-Aug-2017 @ 6:00 PM).

28-Aug-2017:  mbamtray.exe.2264.dmp
30-Aug-2017:  mbamtray.exe.3360.dmp

----------
32-bit Vista Home Premium SP2 * NS Premium v22.10.0.85 * Firefox ESR v52.3.0 * MB Premium v3.2.2.2018-1.0.188
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Edited August 30, 2017 by lmacri

[dcollins]

Thanks for this. Our engineers are looking it over, however the crash dumps actually point to a problem in a windows file (kernel32.dll) and your event viewer shows at least one concerning error. I don't want to write this issue off as hardware, but while we're looking over the information, can you run a hard drive test on your machine? You can find some details and software for that over here: https://www.sysnative.com/forums/hardware-tutorials/4072-hard-drive-hdd-diagnostics-ssd-test.html

Error: (08/18/2017 06:58:57 PM) (Source: volsnap) (EventID: 14) (User: )
Description: The shadow copies of volume C: were aborted because of an IO failure on volume C:.

 

[lmacri]

Hi dcollins:

Sorry, I don't have an optical drive that I can use to burn the SeaTools ISO file to a CD so I won't be able to run the diagnostic you recommended.

I ran sfc /scannow and a thorough chkdsk /r on my ystem about a month ago and no problems were found (just a few unused index entries I always see that were cleaned up by Check Disk but no bad file records) and all my important files are backed up regularly to an external USB drive so I'm not overly concerned.  I have CCleaner installed and Tools | System Restore also shows that five new restore points have been automatically created by my Vista OS since 20-Aug-2017.

This is an old Vista SP2 computer that's going to be replaced soon, so if there's not any information in the dump files that could help Malwarebytes isolate the cause of the MB icon failing to load in the system tray that MadDemon64 and others are also reporting then don't worry about it.  My Norton Security suite, Firefox ESR browser and all my other software seem to work fine as long as I disable MB v3.x's real-time Exploit and Web protection, so if I have to use MB as an on-demand scanner until I purchase a new computer then so be it.
----------
32-bit Vista Home Premium SP2 * NS Premium v22.10.0.85 * Firefox ESR v52.3.0 * MB Premium v3.2.2.2018-1.0.188
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Edited August 31, 2017 by lmacri

[lmacri]

Hi dcollins:

I'm beginning to wonder now if my mbamtray.exe crashes have something to do with my Norton Security AV and/or the order that processes load at boot-up.

I've noticed that mbamtray.exe always loads into memory at boot-up the same time as one instance of Norton Security's nsbu.exe (owned by the USER).  Is it possible my intermittent mbamtray.exe crashes occur because Norton Security and MB v3 are attempting simultaneous calls for Windows resources like kernel32.dll?

My Norton Boot Time Protection (Settings | Antivirus | Automatic Protection) is currently set to Aggressive to ensure Norton loads early in the boot process.  My MB v3 boot options at Settings | Protection | Startup Options are all set to their defaults (e.g., Delay Real-Time Protection when Malwarebytes starts is currently OFF).

Also note that Norton loads two instances of nsbu.exe at boot-up.  The first instance to load is owned by SYSTEM and is the main instance that manages high-priority tasks like real-time protection.  The second instance to load is owned by the logged in USER and manages low-priority tasks like launching of the Norton GUI and background product maintenance tasks.

Here are some sample load times from Process Explorer :

For 24-Sep-2017:
     nsbu.exe (owned by SYSTEM) starts 6:21:02 AM
     MBAMService starts 6:21:05 AM
     mbamtray.exe starts 6:23:23 AM
     nsbu.exe (owned by USER) starts 6:23:23 AM
     MB "Real-Time Protection layers turned off" warning appears ~ 6:26:52 AM

For 25-Sep-2017 (note the 10 min delay from MBAMservice.exe load to mbamtray.exe load):
     nsbu.exe (owned by SYSTEM) starts 6:50:13 AM
     MBAMService starts 6:50:15 AM
     mbamtray.exe starts 7:00:12 AM
     nsbu.exe (owned by USER) starts 7:00:12 AM
     MB "Real-Time Protection layers turned off"  warning appears ~ 7:04:42 AM

I have MB v3.x Web Protection and Exploit Protection disabled on my 32-bit Vista SP2 OS because of conflicts with Norton Security (see my threads MB / Norton Exploit Protection Conflict with 32-bit Firefox Browser? and MB v3.2.2 Web Protection Still Blocks Norton Automatic LiveUpdates) and I've also noticed that it takes around 4 minutes from the time mbamtray.exe loads into memory until the time that the "Real-Time Protection layers turned off" warning appears in my system tray.  I don't know if that's normal, but 4 minutes seems like an unusually long time delay to me.
----------
32-bit Vista Home Premium SP2 * NS Premium v22.10.1.10 * Firefox ESR v52.3.0 * MB Premium v3.2.2.2018-1.0.188
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Edited September 25, 2017 by lmacri

[Firefox]

@lmacri just a thought....

What happens if you enable the Delay Real-Time Protection when Malwarebytes starts and set I delay of 15sec (or a little more)?

[lmacri]

25 minutes ago, Firefox said:

@lmacri just a thought....

What happens if you enable the Delay Real-Time Protection when Malwarebytes starts and set I delay of 15sec (or a little more)?

HI Firefox:

I didn't want to make any changes to my settings before Devin has reviewed my post since he's troubleshooting similar mbamtray.exe crashes in MadDemon64's thread Malwarebytes System Tray Icon Missing After Latest Update, but that would likely be the next logical step if Devin approves.

These mbamtray.exe crashes only occur every 3 or 4 days on my machine so it would take me several days to confirm if a change in my MB settings would actually stop the crashes.
----------
32-bit Vista Home Premium SP2 * NS Premium v22.10.1.10 * Firefox ESR v52.3.0 * MB Premium v3.2.2.2018-1.0.188
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

 

Edited September 25, 2017 by lmacri

[Firefox]

I totally get that, I was just throwing that info out there in case it helps...

[lmacri]

On 9/25/2017 at 1:41 PM, Firefox said:

What happens if you enable the Delay Real-Time Protection when Malwarebytes starts and set I delay of 15sec (or a little more)?

Hi Firefox:

I ran some tests today after enabling Settings | Protection | Startup Options | Delay Real-Time Protection when Malwarebytes starts and that didn't solve the intermittent mbamtray.exe APPCRASHes .  It also didn't make any difference what time delay I selected (60 sec or 120 sec), MBAMService.exe continued to load only 2 or 3 seconds after Norton's main instance of nsbu.exe (owned by SYSTEM).

BOOT # 1: Delay Protection for 60 sec (mbamtray.exe loads OK)

nsbu.exe (owned by SYSTEM) starts 6:05:31 AM
MBAMService starts 6:05:34 AM
mbamtray.exe starts 6:08:55 AM
nsbu.exe (owned by USER) starts 6:08:55 AM
MB "Real-Time Protection layers turned off"  warning appears ~ 6:12:13 AM

BOOT # 2: Delay Protection for 120 sec (mbamtray.exe APPCRASH)

nsbu.exe (owned by SYSTEM) starts 3:58:27 PM
MBAMService starts 3:58:29
mbamtray.exe does not start (APPCRASH logged in Event Viewer at 4:00:23 PM)
nsbu.exe (USER) starts 3:59:50
MB "Real-Time Protection layers turned off"  warning does not appear (no system tray icon)

Dump file for BOOT # 2 APPCRASH :   mbamtray.exe.3740.dmp
----------
32-bit Vista Home Premium SP2 * NS Premium v22.10.1.10 * Firefox ESR v52.3.0 * MB Premium v3.2.2.2018-1.0.188
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS 

[Firefox]

Thanks for testing that.... lets wait to see what @dcollins has to say...

[dcollins]

Thanks for all the details here. I don't believe Norton would be causing the issue, as I expect we'd see this from a lot more people if that were the case. That being said, not too many people run Vista x64 so it's hard to say for certain.

If possible, would you mind turning down Norton's automatic protection level from Aggressive and see if it makes any difference?

On a separate note, Malwarebytes showing the notification that real-time protection is disabled after ~4 minutes is a little long, but when the service starts up we give it a few minutes before we report anything just in case it takes time for something to turn on. That being said, we did add a new toggle under Settings -> Application that will disable these message if you don't want to see it (since you turned them off on purpose)

[lmacri]

On 9/27/2017 at 8:34 AM, dcollins said:

...If possible, would you mind turning down Norton's automatic protection level from Aggressive and see if it makes any difference?

Hi dcollins:

Changing my Norton Boot Time Protection (Settings | Antivirus | Automatic Protection) from Aggressive to Off didn't stop the intermittent mbamtray.exe crashes, but that isn't too surprising since the second instance of nsbu.exe (owned by USER, not SYSTEM) that loads at the same time as mbamtray.exe only starts after I log into my Windows user account.

One thing that is consistent, however, is that my mbamtray.exe tray crashes seem to be connected to loading of my Windows Task Scheduler (taskeng.exe). I had another mbamtray.exe crash today after I logged in to my Windows account and Process Explorer showed that instances of mbamtray.exe, nsbu.exe and taskeng.exe (all owned by USER) all started at 12:33:39 PM.

This instance of taskeng.exe (running under the Windows host process svchost.exe) started my Windows Calendar (WinCal.exe) and displayed a reminder for a scheduled appointment.  I've noticed several times before that mbamtray.exe will crash if Windows Calendar displays an appointment reminder for my Windows Calendar after I log in to Windows like the one shown below from today.

 

Here are dump files for today's mbamtray.exe crash (my second boot-up of 01-Oct-2017, MB v3 Delay Protection OFF, NS v22 Early Boot Time Protection OFF, WinCal.exe loads after Windows login and displays appointment reminder).

This 82 KB dump file was created automatically in C:\Users\Lori\AppData\Local\CrashDump:
     mbamtray.exe.3896.dmp
...and this 5,601 KB dump file was created in C:\Users\Lori\AppData\Local\Temp after I opened my Windows Task Manager, right-clicked on the mbamtray.exe process in the Processes tab and selected Create Dump File:
     mbamtray.DMP    

I don't know if 32-bit Malwarebyes Premium v3 uses the built-in Windows Task Scheduler to schedule automated Threat Scans, but if so that would be consistent with my observation in my post # 1 that mbamtray.exe often crashes on days when Malwarebytes has scheduled a Threat Scan.
----------
32-bit Vista Home Premium SP2 * NS Premium v22.10.1.10 * Firefox ESR v52.4.0 * MB Premium v3.2.2.2018-1.0.188
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS 

Edited October 1, 2017 by lmacri

[dcollins]

Thanks for the detailed reply. The extra crash dumps should help greatly.

Also, is WinCal Windows Live Essential Calendar?

Edited October 2, 2017 by dcollins

[lmacri]

On 10/2/2017 at 10:56 AM, dcollins said:

...Also, is WinCal Windows Live Essential Calendar?

Hi dcollins:

Sorry for not responding sooner.  I just saw the edit in your last post and didn't realize you were waiting for a answer about my calendar.

No, like Windows Mail, my Windows Calendar program came bundled with Vista and was already installed when my computer shipped from the factory.  The Windows Live Calendar is a different app - the article How to Synchronize Windows Vista Calendar with Windows Live Calendar explains a few differences between the two calendars.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.4.0 * NS Premium v22.11.0.41 * MB Premium v3.2.2.2018-1.0.212

[moo4x]

Just an fyi: I have the same issues with Vista. My Vista machine is not important enough to me to spend the time starting a new topic & going through all the steps, but thought  it may help the programers to know it may very well be a Vista compatibility issue. If I boot the machine enough times, MBAM 3.22 usually works eventually.

Edited November 1, 2017 by moo4x

[lmacri]

Hi dcollins:

Just an FYI that I updated to MB v3.3.1 yesterday via Settings | Application Updates | Install Application Updates and the new mbamtray.exe v3.0.0.1247 crashed the first time I re-booted my system.

I'll perform a clean re-install of MB v3.3.1 and run some tests to see if MB's Exploit Protection and Web Protection are still causing conflicts with my Norton Security (see my threads MB / Norton Exploit Protection Conflict with 32-bit Firefox Browser? and MB v3.2.2 Web Protection Still Blocks Norton Automatic LiveUpdates) and if I continue see these problems on my 32-bit OS I'll just deactivate my license and use MB Free v3 as an on-demand scanner.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.4.0 * NS Premium v22.11.0.41 * MB Premium v3.3.1.2183-1.0.236

[lmacri]

Just another FYI that my 07-Dec-2017 update to the latest Component Update Package v1.0.262 hasn't solved my intermittent mbamtray.exe crashes at boot-up on my 32-bit Vista SP2 machine.  I've  also reported in a separate thread (MB v3.2.2 Web Protection Still Blocks Norton Automatic LiveUpdates) that Web Protection is still causing my Norton Automatic LiveUpdates (ALUs) to fail about two or three times a day with CU v1.0.262.

I had another mbtray.exe APPCRASH today after logging in to Windows so here's a new set of diagnostic logs (the same set posted today in my other thread <here>) and the mini-dump for my APPCRASH.

     mb-check-results.zip

     mbamtray.exe.2648.dmp

----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.2 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.262
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[lmacri]

Just an FYI that there's no change with MB Premium v3.5.1 and my intermittent mbamtray.exe APPCRASHes at boot-up.  

I've been using MB Free (i.e., as an on-demand scanner) since updating to v3.4.5 on 14-Apr-2018.  I updated to v3.5.1 last night and re-activated my Premium license to test compatibility with my Norton AV, and mbamtray.exe crashed on my second or third system re-boot.

I've attached the dump file and Event Viewer log for today's APPCRASH by mbamtray.exe as well as Malwarebytes Support Tool diagnostic logs that I captured this morning after my Premium features were enabled.

mbamtray.exe.1368.dmp

MB v3_5_1 mbamtray_exe APPCRASH Event ID 1000 11 May 2018.txt

mbst-grab-results.zip

----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.8.0 * Norton Security Premium v22.14.0.54 * MB Premium v3.5.1.2522-1.0.365
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

[dcollins]

Thanks for the logs