deanb1234 Posted October 12, 2017 ID:1172072 Share Posted October 12, 2017 Has anyone else experienced startup issues on endpoints recently. MBAMChameleon.sys and MBAMSwissarmy.sys have cause a few client machines to not boot the last few days. Picture below Link to post Share on other sites More sharing options...
Computerdienst Posted October 13, 2017 ID:1172341 Share Posted October 13, 2017 (edited) Yes, and so it seems like this is a real issue. Well done Malwarebytes. AGAIN. I'm really losing confidence. You really have to make up a LOT with the new release... How have you fixed this? And is there any way to avoid it? Or can I excpect that I have this all next week??? Edited October 13, 2017 by Computerdienst Link to post Share on other sites More sharing options...
deanb1234 Posted October 16, 2017 Author ID:1173169 Share Posted October 16, 2017 Had this happen on two more workstations this morning? Any updates? Link to post Share on other sites More sharing options...
exile360 Posted October 16, 2017 ID:1173267 Share Posted October 16, 2017 I'm checking with the Product team to see what the status of this issue is. I only learned of it myself yesterday when Computerdienst reported it to me along with a list of other issues he'd experienced. Hopefully I'll hear back from them soon and they'll have some good news for us. I'll let you guys know as soon as I hear anything. Link to post Share on other sites More sharing options...
deanb1234 Posted October 16, 2017 Author ID:1173271 Share Posted October 16, 2017 (edited) Thanks! Hopefully they find something! Edited October 16, 2017 by deanb1234 Link to post Share on other sites More sharing options...
exile360 Posted October 16, 2017 ID:1173300 Share Posted October 16, 2017 They've requested some additional info. Can either of you guys please run the diagnostics tool posted here on one of the affected endpoints and attach the log it creates on the desktop to a reply to this topic? They want to have a closer look at what's going on with one of the affected installations. Thanks Link to post Share on other sites More sharing options...
Computerdienst Posted October 17, 2017 ID:1173392 Share Posted October 17, 2017 8 hours ago, exile360 said: They've requested some additional info. Can either of you guys please run the diagnostics tool posted here on one of the affected endpoints and attach the log it creates on the desktop to a reply to this topic? They want to have a closer look at what's going on with one of the affected installations. Thanks Hi Samuel, I can't, as I'm an external IT guy and don't have access to this client at the moment. What I can say is, that this client has Windows 7 and the real difference to my other customers / clients is, that this machine is still running x86 and NOT x64. Also, the driver that failed was the Chameleon Driver, but "encrypted". Something like a RANDOMNUMBER.SYS. For the moment I did what you told and disabled the self protect module. Hope this won't happen now. Link to post Share on other sites More sharing options...
deanb1234 Posted October 17, 2017 Author ID:1173457 Share Posted October 17, 2017 6 hours ago, Computerdienst said: Hi Samuel, I can't, as I'm an external IT guy and don't have access to this client at the moment. What I can say is, that this client has Windows 7 and the real difference to my other customers / clients is, that this machine is still running x86 and NOT x64. Also, the driver that failed was the Chameleon Driver, but "encrypted". Something like a RANDOMNUMBER.SYS. For the moment I did what you told and disabled the self protect module. Hope this won't happen now. Hi Samuel, I'm unable to gather any logs either, we've turned the machines back over to the end users and it's very hard to get them to bring machines back to us. :-) The way we fixed it was to go into safe mode and copy the .sys file giving the error from a known good machine with the same version of Windows. That resolved it. When we get another machine I will make sure the help desk gathers the logs. Thanks, Dean Link to post Share on other sites More sharing options...
Computerdienst Posted October 17, 2017 ID:1173491 Share Posted October 17, 2017 2 hours ago, deanb1234 said: Hi Samuel, I'm unable to gather any logs either, we've turned the machines back over to the end users and it's very hard to get them to bring machines back to us. :-) The way we fixed it was to go into safe mode and copy the .sys file giving the error from a known good machine with the same version of Windows. That resolved it. When we get another machine I will make sure the help desk gathers the logs. Thanks, Dean Strange. I wasn't even able to boot up safe mode, so I needed to use the Kaspersky Boot CD and with the integrated registry editor, I was able to remove Chameleon from the Services. However, that won't work with my Bootcamp Clients in case of emergency. Link to post Share on other sites More sharing options...
exile360 Posted October 17, 2017 ID:1173529 Share Posted October 17, 2017 OK, thanks for the additional information guys. The next time you have access to one of these systems could you please verify the exact build of Malwarebytes? To find out, open the main Malwarebytes UI and click on Settings>About and make a note of the exact version numbers listed under Version Information: Malwarebytes version: <version number> Component package version: <version number> Update package version: <version number> This way they at least know which version(s) is/are being impacted by this issue and they can then let us know if the issue has been worked on and/or corrected in a newer release or is planned for an upcoming release. I'll pass on the info about x86 systems being affected. That would likely explain why I haven't encountered this issue before personally as most of our customers these days are on x64 operating systems. Link to post Share on other sites More sharing options...
deanb1234 Posted October 17, 2017 Author ID:1173531 Share Posted October 17, 2017 Just to clarify it is happening on x64 systems for us. 2 minutes ago, exile360 said: I'll pass on the info about x86 systems being affected. That would likely explain why I haven't encountered this issue before personally as most of our customers these days are on x64 operating systems. Link to post Share on other sites More sharing options...
exile360 Posted October 17, 2017 ID:1173533 Share Posted October 17, 2017 Ah, I see, thanks. So it seems both OS versions are affected. I'll let them know right away. Link to post Share on other sites More sharing options...
Computerdienst Posted October 18, 2017 ID:1173738 Share Posted October 18, 2017 12 hours ago, exile360 said: OK, thanks for the additional information guys. The next time you have access to one of these systems could you please verify the exact build of Malwarebytes? To find out, open the main Malwarebytes UI and click on Settings>About and make a note of the exact version numbers listed under Version Information: Malwarebytes version: <version number> Component package version: <version number> Update package version: <version number> This way they at least know which version(s) is/are being impacted by this issue and they can then let us know if the issue has been worked on and/or corrected in a newer release or is planned for an upcoming release. I'll pass on the info about x86 systems being affected. That would likely explain why I haven't encountered this issue before personally as most of our customers these days are on x64 operating systems. But EP has no User Interface... Link to post Share on other sites More sharing options...
exile360 Posted October 19, 2017 ID:1174008 Share Posted October 19, 2017 Ah, right you are. Apologies, I'm checking with the Product team and I'll get back to you as soon as I hear from them. In the meantime, if you have any scan logs handy that were created recently that should contain the info we need. It would be in the header at the top where it lists our product info/the OS version etc. Link to post Share on other sites More sharing options...
djacobson Posted October 27, 2017 ID:1176376 Share Posted October 27, 2017 @deanb1234 @Computerdienst do you guys have the self-protection early start option enabled in your policy? Link to post Share on other sites More sharing options...
deanb1234 Posted October 27, 2017 Author ID:1176508 Share Posted October 27, 2017 11 hours ago, djacobson said: @deanb1234 @Computerdienst do you guys have the self-protection early start option enabled in your policy? Hi Dylion, When the problem was occuring yes. I've since turned that feature off and have not received any more complaints. We did have one user that was getting the same error but turns out the hard drive was bad in that particular machine. Thanks, Dean Link to post Share on other sites More sharing options...
djacobson Posted October 27, 2017 ID:1176561 Share Posted October 27, 2017 Thanks @deanb1234, I was hoping that was the case. That setting is ultra sensitive, it is meant to be used when you are dealing with an infection that can kill security program services. You can utilize that setting to load MB drivers early to prevent tampering and killing. Be aware that this setting can prevent normal safe changes to the files and can leave your product unable to update, don't use it for the every day, it's for emergencies. Link to post Share on other sites More sharing options...
Computerdienst Posted October 29, 2017 ID:1177086 Share Posted October 29, 2017 On 27.10.2017 at 6:19 PM, djacobson said: Thanks @deanb1234, I was hoping that was the case. That setting is ultra sensitive, it is meant to be used when you are dealing with an infection that can kill security program services. You can utilize that setting to load MB drivers early to prevent tampering and killing. Be aware that this setting can prevent normal safe changes to the files and can leave your product unable to update, don't use it for the every day, it's for emergencies. Hi Dyllon, Is only the "Enable Self-Protection Module Early Start" which can cause problems or also the "Enable Self-Protection Module"? At the moment I disabled the "Enable Self-Protection" Module. Link to post Share on other sites More sharing options...
djacobson Posted October 30, 2017 ID:1177584 Share Posted October 30, 2017 Hi @Computerdienst, just the normal self-protect module causes the issue for you? Link to post Share on other sites More sharing options...
Computerdienst Posted October 31, 2017 ID:1177688 Share Posted October 31, 2017 9 hours ago, djacobson said: Hi @Computerdienst, just the normal self-protect module causes the issue for you? I think so, because I thought I never enabled the early start protection. But can't tell you anymore. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now