Jump to content
BRAM

Server Unresponsive - MBAE 1.10.2.41

Recommended Posts

I have a server (2012 R2) that stops responding to network requests almost every morning and has to be rebooted to resolve. When looking at task manager, I find multiple tasks for Malwarebytes Anti-Exploit CLI (32 bit) running (see attached). If I try to end task on them or kill them, they do not go away. I have also uploaded the contents of the entire directory that contains the logs. 

There aren't any red flags in any of the Windows event logs. In an attempt to see if Anti-Exploit was causing the issue, I stopped the serviced and disabled it. I had the same issue the next morning, along with multiple tasks in the task manager. I have now uninstalled Anti-Exploit and will see what happens tomorrow.

This started happening not long after upgrading to MBAE 1.10.2.41. I don't know if MBAE is the cause but given all of the tasks which show up in task manager, even with the service disabled, it seems possible. Appreciate any feedback.

Thanks

AntiExploit.JPG

Malwarebytes Anti-Exploit.zip

Share this post


Link to post
Share on other sites

Hi BRAM.

The MBAE CLI are the configuration commands being executed from the Management Server. Those should only show up momentarily and then disappear by themselves. Try changing the check-in internal in the Management Console policy to something greater. That should ease up on the amount of commands being sent to the machine.

 

Share this post


Link to post
Share on other sites

What do you recommend for the setting? The current setting isn't causing issues on any other server.

Thanks

Share this post


Link to post
Share on other sites

Try creating a separate policy and assign just this server to the new policy. In the policy set the check-in interval to something like an hour or two. Does that alleviate the problem?

Share this post


Link to post
Share on other sites

I have not made any policy changes yet but as I mentioned, I uninstalled Anti-Exploit yesterday. So far today, I don't have any of the MBAE CLI tasks in task manager and the server is responding normally. Usually by this time, I've had to reboot. I'm going to run in this configuration for a few days and see what happens. I will update next week.

Thanks.

Share this post


Link to post
Share on other sites

I have not had to reboot the server since I uninstalled the Anti-Exploit client.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.