Jump to content

Software Installation stuck in loop?


lmorel

Recommended Posts

Two of my users reported this morning that they get a red pop-up that is Malwarebytes Endpoint 3 related letting them know that the software installation requires them to restart in order to complete installation. They can postpone or restart. They restarted multiple times but the popup keeps coming back on. I suspected lack of admin rights for them so I logged on myself on their computer and ran into the same issue multiple times. Rebooting didn't complete the installation and I keep getting prompted over and over.

Any ideas or suggestions? I sure hope I'm not going to get tons of my users reporting same issue today.

Edited by lmorel
Link to post
Share on other sites

We used the cleaning tool a couple of times to remove old installation to see if it helped. It did not.

We also see this in Event Viewer:

 

2017-12-20 10:26:00,562-08:00 [3 ] ERROR MBAMPlugin System.Exception: Could not complete install (Your computer must be restarted in order to complete the software installation)
   at EAMBAMPlugin.MBAMPlugin.Initialize(IEAEngine engine, String jsonPolicy)

2017-12-20 10:26:00,738-08:00 [3 ] ERROR MBAMPlugin Error applying schedules to mb3
System.NullReferenceException: Object reference not set to an instance of an object.
   at EAMBAMPlugin.MBAMPlugin.SchedulesChanged()

2017-12-20 10:26:00,354-08:00 [3 ] WARN  MBAMPlugin Could not install mbam exit code 3, this could indicate a reboot is necessary

2017-12-20 10:24:12,703-08:00 [27] ERROR EngineController Could not delete file... Renaming to .old
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Malwarebytes Endpoint Agent\Engine\MBEADomain.dll' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalDelete(String path, Boolean checkHost)
   at MBCloudEA.EngineController.MoveEngine(String newVersionLocation, Boolean& restartNecessary, String& errorMessage)

2017-12-20 10:24:12,693-08:00 [27] ERROR EngineController Could not delete file... Renaming to .old
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Malwarebytes Endpoint Agent\Engine\EAEngine.dll' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalDelete(String path, Boolean checkHost)
   at MBCloudEA.EngineController.MoveEngine(String newVersionLocation, Boolean& restartNecessary, String& errorMessage)

2017-12-20 10:24:12,432-08:00 [28] ERROR EAEngine Error posting to Nebula. Url:/api/v1/machine/results
System.OperationCanceledException: The operation was canceled.
   at System.Threading.CancellationToken.ThrowOperationCanceledException()
   at System.Threading.ManualResetEventSlim.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)

2017-12-20 10:24:11,665-08:00 [27] ERROR EngineController Could not delete file... Renaming to .old
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Malwarebytes Endpoint Agent\Newtonsoft.Json.dll' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalDelete(String path, Boolean checkHost)
   at MBCloudEA.EngineController.MoveService(String newVersionLocation, Boolean& restartNecessary, String& errorMessage)

 

 

 

 

Link to post
Share on other sites

Thank you TrinityZ! I opened a case too and did a chat session. They collected logs. I'm "glad" to hear it's not just us. I suspect this is related to the updates they just released. We received an email on Monday with a bunch of fixes being addressed in new version.

Link to post
Share on other sites

Hi guys, the main cause of this is an older Malwarebytes install still on the machine when cloud was deployed. It is preventing the update, run the tool below and I can confirm.

Malwarebytes Check Log
Please download and save our diagnostic tool, mbam-check.exe, to your desktop from this link.

Malwarebytes Check Tool

Double-click mbam-check.exe to launch the tool. A black command prompt window will briefly appear, and then a log file will open. The log which opens will be saved to your desktop as CheckResults.txt. Attach this file.

Link to post
Share on other sites

  • 2 weeks later...
  • 5 weeks later...

I have this happening now (Feb 1, 2018) - uninstalled rebooted. Reinstalled - same restart message.

Used mbcleanup tool restarted, removed all Malwarebytes folders I could find, restarted - reinstalled newest version - still the same message.

THERE IS WAY TOO MUCH SCREW UPS LATELY!!!!!

HELP!

Link to post
Share on other sites

Optinode,

Open REGEDIT and drill down to the following key:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D14F4181-275B-4837-9767-3E9E0672A884}

Delete that {D14F4181-275B-4837-9767-3E9E0672A884} folder then reboot. It should fix itself. That is some leftovers. I sometimes had it trying to install, use the registry fix without doing anything else, then rebooted and it was all fixed. Meaning the upgrade was successful. Make sure you drill down to the proper path and don't miss that WOW6432Node. And of course, make sure that you get the right folder!

I think with Windows 10 and version 1709 (Fall Creator Update), you can actually copy and paste that path into REGEDIT instead of having to drill down manually. Very nice!

Edited by lmorel
Missing info
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.