W10 Prv buils 16291 + Anti Ransomware layer not running

[JanB1948]

Since the upgrade to W10 x64 RC build 16291 the MBW Anti Ransom ware layer is not started and cannot be started manually either. 

Problem still exist after te recent update to build 16294, 16296 an 16299.

Running MBW and Vipre mutual exclusive  and recently upgraded Acronis TrueImage from v 2017 to v 2018. Acronis  True Image v2018 now also has  and active Protection function.

Shutting Vipre and MBW and than resting MBW results in MWB obviously running OK but after a timeout the Anti Ransomware function is disabled again.

Doing that in combination with the Acronis Active Protection function disables does not help either.

Problem is also reported in the MS Insiders Feedback-hub.

Janb

 

 

[JanB1948]

After the recent MS Components update to 16299.15 the problem still exists.

The problem doe3s not exist on mx x286 W10 Home tablet running  on an ( After the upcoming worldwide update) t\preview Insiders build 17004. Running MWB and Vipre mutually excluding.

 

 

[dcollins]

We've seen no issues with our internal testing. Have you tried completely uninstalling MB3 and re-installing it? This was needed at one point.

Lastly, have you tried disabling both Acronis and Vipre to see if Ransomware Protection works properly?

If none of that works, we'll need some logs to look into this:

 

Edited October 4, 2017 by dcollins

[JanB1948]

I uninstalled and reinstalled MWB yesterday  using the most recent version I downloaded just before doing that and that seems to help. Reactivated my license key But this morning again the Antiransom ware  layer e was failing again after a timeout. Tested with shutting down and restarted  things again. This time MWB Web protection was stopped and could not restarted. Weird. So I did the installation of MWB once more, without uninstalling it first, and rebooted . Seems to work OK again now. Scan did not detect malware after that.

 

[JanB1948]

As  W10 x64  is a Pro version on this desktop I used GPEDIT to switch off the Defender Policy settings. ThreatTrack 's Vipre switches of Defender but obviously not all of it.

[JanB1948]

In addition . When I keep the  Acronis 2018 Active Protection function  switched of  MWB runs OK but after I switch it back on again the problem reoccurs after a reboot.

Excluding MWB in the Acronis settings does not help.

The upgrade from Acronis True Image 2018  to 2017 is not an improvement in my case!

[dcollins]

What exclusions did you add in Acronis? Did you add all the exclusions mentioned here: https://support.malwarebytes.com/docs/DOC-1123

[JanB1948]

Thanks for the tip.

I had already added all the Exe's, but using the Acronis Active Protection function I'm no able to add the drivers it then  wants you to select. They are not seen then , but I can see  the ones applicable  if I use  the God mode to locate the in Windows\System32 Drivers.  If you then enter the full path ii is not accepted.

 The AcronisActiveProtectionService is running under the system account and I have not found an option to start it myself with Admin privileges. It is not mentioned in the list of Acronis programs anyway.

So I will maintain that function in the Switched Off state at the moment!

Edited October 20, 2017 by JanB1948
tipo

[dcollins]

For acronis, if you can type the path, try changing System32 to sysnative

[JanB1948]

Tried sysnative in the path  but that does not work too. Will report it to Acronis

[dcollins]

I'd also recommend upgrading to the official Fall Creators Update now to see if that resolves the issue

[JanB1948]

I'm running MS  Insiders RC build 16299 on this desktop, which is the Insiders build that equals the Fall Creators Update ( last RC build just before release of FC Update).

I reverted back to that build, as build 17017 ,  MS  updated after the F.C. Release  is causing  a GSOD  for the Win2kbase.sys driver and continuously crashes after you have tried  to run a  True Image  backup every few minutes with the same BSOD error.  Reported to MS and Acronis. I see many upvotes on the MS Insiders Feedback Hub for the same issue, that MS needs to fix.

MWB runs OK on that build 17017 on my 2 other test devices (a W10 Tablet and a VM) running on that build, but not having Acronis True Image 2018 installed.

Insiders report also that 17017 conflicts  with older Acronis True Image versions.