Software Installation stuck in loop?

[lmorel]

Two of my users reported this morning that they get a red pop-up that is Malwarebytes Endpoint 3 related letting them know that the software installation requires them to restart in order to complete installation. They can postpone or restart. They restarted multiple times but the popup keeps coming back on. I suspected lack of admin rights for them so I logged on myself on their computer and ran into the same issue multiple times. Rebooting didn't complete the installation and I keep getting prompted over and over.

Any ideas or suggestions? I sure hope I'm not going to get tons of my users reporting same issue today.

Edited December 20, 2017 by lmorel

[lmorel]

Please see attached screenshot.

I have now a third user reporting same issue.

[lmorel]

We used the cleaning tool a couple of times to remove old installation to see if it helped. It did not.

We also see this in Event Viewer:

 

2017-12-20 10:26:00,562-08:00 [3 ] ERROR MBAMPlugin System.Exception: Could not complete install (Your computer must be restarted in order to complete the software installation)
   at EAMBAMPlugin.MBAMPlugin.Initialize(IEAEngine engine, String jsonPolicy)

2017-12-20 10:26:00,738-08:00 [3 ] ERROR MBAMPlugin Error applying schedules to mb3
System.NullReferenceException: Object reference not set to an instance of an object.
   at EAMBAMPlugin.MBAMPlugin.SchedulesChanged()

2017-12-20 10:26:00,354-08:00 [3 ] WARN  MBAMPlugin Could not install mbam exit code 3, this could indicate a reboot is necessary

2017-12-20 10:24:12,703-08:00 [27] ERROR EngineController Could not delete file... Renaming to .old
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Malwarebytes Endpoint Agent\Engine\MBEADomain.dll' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalDelete(String path, Boolean checkHost)
   at MBCloudEA.EngineController.MoveEngine(String newVersionLocation, Boolean& restartNecessary, String& errorMessage)

2017-12-20 10:24:12,693-08:00 [27] ERROR EngineController Could not delete file... Renaming to .old
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Malwarebytes Endpoint Agent\Engine\EAEngine.dll' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalDelete(String path, Boolean checkHost)
   at MBCloudEA.EngineController.MoveEngine(String newVersionLocation, Boolean& restartNecessary, String& errorMessage)

2017-12-20 10:24:12,432-08:00 [28] ERROR EAEngine Error posting to Nebula. Url:/api/v1/machine/results
System.OperationCanceledException: The operation was canceled.
   at System.Threading.CancellationToken.ThrowOperationCanceledException()
   at System.Threading.ManualResetEventSlim.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)

2017-12-20 10:24:11,665-08:00 [27] ERROR EngineController Could not delete file... Renaming to .old
System.UnauthorizedAccessException: Access to the path 'C:\Program Files\Malwarebytes Endpoint Agent\Newtonsoft.Json.dll' is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalDelete(String path, Boolean checkHost)
   at MBCloudEA.EngineController.MoveService(String newVersionLocation, Boolean& restartNecessary, String& errorMessage)

 

 

 

 

[TrinityZ]

I too am seeing this exact same problem on multiple computers starting today 12/20.

I just opened a support case and will follow-up once a solution is provided.

[lmorel]

Thank you TrinityZ! I opened a case too and did a chat session. They collected logs. I'm "glad" to hear it's not just us. I suspect this is related to the updates they just released. We received an email on Monday with a bunch of fixes being addressed in new version.

[djacobson]

Hi guys, the main cause of this is an older Malwarebytes install still on the machine when cloud was deployed. It is preventing the update, run the tool below and I can confirm.

Malwarebytes Check Log
Please download and save our diagnostic tool, mbam-check.exe, to your desktop from this link.

Malwarebytes Check Tool

Double-click mbam-check.exe to launch the tool. A black command prompt window will briefly appear, and then a log file will open. The log which opens will be saved to your desktop as CheckResults.txt. Attach this file.

[djacobson]

Upgrade has been halted! Any machines in the restart loop, uninstall, restart and then reinstall, the machine will pull down the prior 3.1.8 version. 3.3.2 version upgrade is suspended until the issue can be fixed.

[mytimbuk2]

I ran into this this morning, after rebooting twice it seems to be working fine with version 3.3.1.2183.  Is this the correct version?

Tanks

[djacobson]

That is one of the versions the install will now default to, the other is 3.1.8.1830. The 3.3.2.2243 is pulled.

[Optinode]

I have this happening now (Feb 1, 2018) - uninstalled rebooted. Reinstalled - same restart message.

Used mbcleanup tool restarted, removed all Malwarebytes folders I could find, restarted - reinstalled newest version - still the same message.

THERE IS WAY TOO MUCH SCREW UPS LATELY!!!!!

HELP!

[lmorel]

Optinode,

Open REGEDIT and drill down to the following key:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D14F4181-275B-4837-9767-3E9E0672A884}

Delete that {D14F4181-275B-4837-9767-3E9E0672A884} folder then reboot. It should fix itself. That is some leftovers. I sometimes had it trying to install, use the registry fix without doing anything else, then rebooted and it was all fixed. Meaning the upgrade was successful. Make sure you drill down to the proper path and don't miss that WOW6432Node. And of course, make sure that you get the right folder!

I think with Windows 10 and version 1709 (Fall Creator Update), you can actually copy and paste that path into REGEDIT instead of having to drill down manually. Very nice!

Edited February 1, 2018 by lmorel
Missing info