MBCloudEA.exe.Config corrupts

[TimSmith]

We are running the latest version on MB Incident Response on about 1700 endpoints and I am having an issue with about 10% of them loosing communication.  The Service is stopped and when I attempt to restart it I get Error 14001: The application has failed to start because its side-by-sideconfiguration is incorrect.  As I have investigated, I have found that the config file is corrupt and therefore unable to communicate with the cloud server.  I have tried running ConfigurationRecoveryTool.exe, with a reboot, and it seems to repair but still no communication with the server.  So far the only thing that has seemed to work completely is to do an uninstall and re-install.  I am hoping to find a better solution than touching 170 PC's across the globe.  Does anyone have any ideas?

Thanks.

[King_Of_The_Castle]

Unfortunately no dude. You would have to do a clean uninstall using the cleanup tool, manually delete installation folders, reboot and re-install...

EDIT: Pretty sure there is a way to automate this using a batch file remotely with PSEXEC.

Edited May 1, 2018 by King_Of_The_Castle

[ShaunB]

Kinda the same issue here. We find the agent stops working and we can't restart it. Same error... side by side issue. (i am guessing corrupt config)

We now run a script at login that checks that the agent service is running, if not. Email us.

We then copy from C:\ProgramData\Malwarebytes Endpoint Agent\Cache\unloaded\Service to the C:\Program Files\Malwarebytes Endpoint Agent directory. This fixes it. 

We will probably have to make a script that automates this. Seems to happen frequently

 

 

Edited May 2, 2018 by ShaunB

[TonyCummins]

Im starting to see this too....opening the MBCloudEA.exe.Config file shows it as empty !

[vbarytskyy]

Hello,

Could everyone in this topic experiencing the issue run the attached "ConfigFixer.bat" from a local machine to test with. If it does work, it can be further deployed as a batch file.

Make sure to run this bat as admin.

 

https://malwarebytes.box.com/s/599mrui1hgzx6u5txa7r3j5pryw0b8qb

[TonyCummins]

8 minutes ago, vbarytskyy said:

Hello,

Could everyone in this topic experiencing the issue run the attached "ConfigFixer.bat" from a local machine to test with. If it does work, it can be further deployed as a batch file.

Make sure to run this bat as admin.

 

https://malwarebytes.box.com/s/599mrui1hgzx6u5txa7r3j5pryw0b8qb

 

If i come across any more not communicating with cloud and having corrupt config files i will, but the 6 i found this morning ive already done a clean re install 

[TimSmith]

I have run the batch file on several PC's and it has worked well on most.  There have been a couple that it didn't work, but there will always be a few that a solution doesn't work for.  Appreciate the assist.

Thanks

[vbarytskyy]

The few that didn't work may not have a config backup to use. Those may need to be reinstalled. 

I would suggest to deploy the batch script over the network if there's a large amount of machines having the issue. Those that don't come back online after the script is ran will need reinstallation however. 

 

Thank you for updating us

[King_Of_The_Castle]

On 5/2/2018 at 12:12 PM, vbarytskyy said:

Hello,

Could everyone in this topic experiencing the issue run the attached "ConfigFixer.bat" from a local machine to test with. If it does work, it can be further deployed as a batch file.

Make sure to run this bat as admin.

 

https://malwarebytes.box.com/s/599mrui1hgzx6u5txa7r3j5pryw0b8qb

Thanks. I will test today and provide feedback.

[King_Of_The_Castle]

On 5/2/2018 at 12:12 PM, vbarytskyy said:

Hello,

Could everyone in this topic experiencing the issue run the attached "ConfigFixer.bat" from a local machine to test with. If it does work, it can be further deployed as a batch file.

Make sure to run this bat as admin.

 

https://malwarebytes.box.com/s/599mrui1hgzx6u5txa7r3j5pryw0b8qb

Tested this bat on a couple of endpoints and it fixed the issue. But I also got this message on one of them:

Making sure the Malwarebytes Endpoint Agent service is stopped...
Looking for backup in .\
No valid backup configuration was found
Unable to restore configuration from backup
System error 14001 has occurred.

The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.

 

[PaulC1]

Same problem here. Has happened again on endpoints that have been fixed previously. Does anyone know the cause? Is this something that can be fixed in the Malwarebytes Endpoint software?

Edited June 6, 2018 by PaulC1

[King_Of_The_Castle]

17 hours ago, PaulC1 said:

Same problem here. Has happened again on endpoints that have been fixed previously. Does anyone know the cause? Is this something that can be fixed in the Malwarebytes Endpoint software?

No Paul, only workarounds so far or small band-aids in order to remediate the issue for the time being... I really hope the MalwareBytes team fixes this as soon as possible.

[PaulC1]

On 6/7/2018 at 11:13 AM, King_Of_The_Castle said:

No Paul, only workarounds so far or small band-aids in order to remediate the issue for the time being... I really hope the MalwareBytes team fixes this as soon as possible.

I hope it can be fixed soon too. This is becoming a source of frustration. Can we get a comment from Malwarebytes staff regarding where this stands?