3.2.2 update not running

[salbay]

I have a similar problem that began to occur just after 3.2.2 update , on XP computer.

At some variable time after startup (from seconds upto 70 odd hours) :-

New programs that are started fail to respond,  the program opens up a window, but the window is blank, it won't respond to any keys, or add content to the window, for example cmd.exe just starts with a blank  black box (without the usual white version number ). It happens with all programs except task manager, when you use task manager, the program shows in the processes tab, with  stagnant  values for memory etc, but doesn't show in the applications tab. Sometimes windows will notify you the program is unresponsive, and sometimes not. Any programs that were already running keep running fine, but it is impossible to start a new program (or open a new tab in chrome). the only fix is to restart.  Sometimes you need to restart 2 or 3 times.

Also Malwarebytes, will start up with one , two, or three of the protection modules turned off at random. You can usually turn them back on manually, but the "web protection" just says "starting" about 80% of the time. 

[dcollins]

If you turn off Malwarebytes by right clicking the system tray icon and choosing Quit Malwarebytes, do these issues still occur?

[salbay]

I've deselected "start MWB with windows" and the problem doesn't occur with maybe 30hrs operation so far (Malwarebytes is not loaded or running).

When you say "quit malwarebytes from system tray" do you mean

(a) to do this after the computer becomes unresponsive to new programs?

Or (b)  to do it after start up ,  to see whether the problem pops up subsequently 

noting that (b) is subtly different to what I have done (never loading MWB) as it could leave some residual stuff in memory. 

 

[salbay]

Ok so continuing on .... 

30hrs operation OK , with MWB not loaded, then

-------- manual start MWB ------

1hr all OK then wireless connection stops responding, everything else OK

===== shutdown to reboot (without MWB) =================================================================

all ok for 5 minutes 

----manual start MWB---

seems OK initially.... Chrome starts, get google homepage...

2 minutes later fault occurs (can't open gmail, )

---shutdown MWB using the taskbar quit option---

tried to start cmd.exe - blank window so the fault persists even after  MWB is shutdown..

Tried a few more applications, most of the ones in system32 directory work OK: notepad, solitaire, calc, clipboard viewer, OSK, task manager.

trying cmd.exe shows the fault (its in system32) , others that show the fault are word,excel,acrobat,windows media player, and pretty much anything in the programs directory .

====rebooted computer (without MWB) =====================================================================

Then I starting typing this message .......

[dcollins]

Can you check one more thing please? In the case where you shutdown MBW using the taskbar quit option after you started getting issues (in your example above, this starts at "tried to start cmd.exe"). Can you try to run mb-check from https://downloads.malwarebytes.com/file/mb3_check. I'm trying to see if perhaps MB3 is getting stuck when quitting and it's still running at this point.

[salbay]

Hello, 

I've downloaded MB3 check , and did a baseline run of it.

If the fault re-occurs I'll attempt to run MB3_check.

I've now been running ~ 24hrs , without fault, by turning  OFF the self protection feature.

If I can get 3 more days running OK, I'll turn self protection back on, then do the MB3_check when it faults again.

 

[salbay]

(part of this crossposted to a related forum)
Ok been running for several days now, it's a  laptop with XP, MWB running with autoprotect off.
The last couple of days I've just been closing the lid at night to hibernate, previously I would usually shut down completely.
This morning , open the lid, and chrome opens a window then stalls, also cmd.exe opens a window but doesn't display DOS version num or respond to keys. so the fault is back, the fault seems to be describable as "the application loads, opens window, but doesn't run"  possibly the part of the operating system that allocates time slices is resource locked by MWB.

So this what I did

(a) Quit MWB from the taskbar.
(b) Ctrl-alt-del to get task manager, goto processes
(c) locate  mbamservice.exe
(d) stop it (right click or press del)
(e) test your programs work normally now
(f) start MWB

When I did that a Chrome window popped open (must have been one I tried to open earlier, and it was just queued up) 
I'll just recheck whether mbamservice.exe goes away normally when MWB quits.... stand by ...

[salbay]

.........
OK , normally mbamservice.exe unloads with the quit command.
So in the fault condition  ,  mbamservice.exe does not unload , and new applications loads but can't run .

[dcollins]

Can you provide the mb-check logs mentioned above?

[salbay]

.... more detail

Fault occurs fairly soon if self protection ON, 

And rarely if self protection OFF (never occurred if computer shutdown every day) only one occurrence so far after a resume from hibernation.

In faulted sate where MWB doesn't unload itself, memory allocated is 150MB, whereas normally runs with 190MB

[salbay]

MBcheck logs here...mb-check-results5oct17.zip

(I'm in Australia so it's Thursday 5th now)

 

[dcollins]

Is this log from the state where you quit Malwarebytes from the tray but mbamservice was still running? It doesn't seem like it. Also, I see where mbamservice hung on shutting down, and it looks like you started MB3 and then immediately quit it, which could take a little longer to shutdown as it waits for everything to load first.

[salbay]

No It is not the log  from the faulted state, "quit Malwarebytes from the tray but mbamservice was still running"
It's not possible to run any new programs (like mbcheck) in the faulted state.
 

I did start and stop MWB twice to get some idea of its normal memory size, 
I did wait till it dissapeared from task manager before restarting.

I also did a test to see how mbamservice .exe behaved normally when killed from  task manager,  and it restarted itself within a few seconds , so that would be the event you see in the logs.
Sorry if I messed it up.

What do think of this idea:
Restart computer ; open a MSDOS window& leave open ;  start MWB with self protection ON (this makes MBAMservice unkillable I think?)
wait for fault, then run MBcheck from the idling DOS window.

 

[salbay]

OK , Finally captured a log file.

So from a fresh boot

(a) I have started CMD.exe  yesterday and left idling
(b) loaded MWB , set self protection to ON
(c) did normal stuff , (mostly browsing with chrome)
(d) closed lid > laptop went to hibernate
(e) opened lid , used laptop for ~ 5hrs

then fault occured , unable to open new tab in Chrome, excel and acrobat both loaded but not started, closed one open chrome window..

ran MB check , results attached

started task manager , did screen shot - you can see acroread, chrome, and excel are listed as processes, but not as applications.

opened MWB interface from user tray , all looked normal, exited.

selected "quit" from MWB systray,  systray icon disappeared 

back to task manager , MBservice has left about 30 Mb behind, this number drops ~40-60kb every 45seconds.

killed MBAMservice.exe process. Acrobat and excel and chrome all pop open windows and resume operation. MWB resumes in 5secs.

everything back to normal again.

(I have screenshots as CLP files, but 10M each, need to convert to jpeg on the other computer)
mb-check-results.zip

[salbay]

Ok another fault occurred today,

Pretty much same as above , I have done a reboot, and a MWB database update.

So in faulted state MBAMservice was 203,232kb
after quitting, it was 88,064kb , then 87,964 then 87,796 at about 40s intervals.

KIlled MBAM service, it did  automatic restart , and started with 186, 164kb memory...  190,052kb about 30 mins later.

mb-check-results7oct.zip