MB 3.5.1.2522 prevents some programs updating

[bdg2]

So far I have had to exit from Malwarebytes in order to update:

a) Skype for desktop

b) Visual Studio 2017 Community

to the latest versions when they prompted me that updates were available.

mbst-grab-results.zip

Edited May 12, 2018 by bdg2
Upload mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
• Click the Gather Logs button
  
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Click "Reveal Hidden Contents" below for details on how to attach a file:
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  

   

  After posting your new post, make sure you click the Follow button near the top right of this page, and select the option "An email when new content is posted Change how the notification is sent" so that you're alerted by email when someone has replied to your post.

  

  

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[bdg2]

File from 2nd PC (with VS 2017)

mbst-grab-results.zip

[bdg2]

Hello? No comment at all?

[TempLost]

Yes, Malwarebytes 3.5.1 has been great for me until today when I tried to update KeePass and got the error shown in the attachment, KeePass installation failed consistently even when trying to over-install with the current version - closed Malwarebytes and was able to carry out the update without problem.

[vbarytskyy]

@bdg2

I attempted to replicate the problem and could not with both Visual Studio and Skype. I see no block events in the logs provided either.

Did you possibly have your VPN running (and Malwarebytes) while the program updates came through? 

[bdg2]

I believe the errors I saw were that the installer could not write the new program files.

[mga]

I agree, something seems wrong with MBAM and other programs running their installers.  Today, my VPN service prompted me to update (I had been ignoring it for a few days).  It started up the MSI installer (minimal UI mode, where it just shows the progress bar dialog - no Next button clicking needed), and immediately my whole system came to a crawl.  I was trying to browse around in Windows Explorer, and it was super slow.  Eventually I was able to get Task Manager to open and saw the MBAM service taking a ton of CPU.  The MSI installer was still stuck at no progress for something like 10 minutes.  In Task Manager, I located MBAM service executable and killed it.  Immediately the MSI installer started working, and making progress. Then the MBAM service restarted itself, and I continued that start - kill - start - kill process of MBAM so that I could let the installer complete.  

 

Now that the installer completed, MBAM started itself, and system is working as it normally did.  Not sure what MBAB was doing, but it certainly was causing grief with the installer and general system health. 

 

MB, you have an issue with installers that needs fixing.  

Edited May 15, 2018 by mga

[exile360]

It sounds like the Ransomware Protection component may have been acting up.  It monitors processes and threads for write/move/delete/rename operations (among other things) to stop ransomware attacks in their tracks.  When an application, such as an installer, is performing these kinds of actions it's pretty normal to see some level of increased activity in MBAMService.exe because of this, but it shouldn't bring the system to a crawl like that or prevent a safe installer from completing its work.  My guess is that even though the Devs have done a lot in the recent few releases of Malwarebytes to improve the situation, the Ransomware Protection component still needs some work under certain conditions to prevent these kinds of issues.

If you see this kind of behavior again, try right-clicking the Malwarebytes tray icon and selecting Ransomware Protection: Enabled to turn it off and confirm if prompted by User Account Control.  If I'm right, then that should eliminate the problem and will indicate that the issue is indeed with Ransomware Protection.

[TempLost]

I'm sure you're right, @exile360. I'm not running a VPN and the failure I reported above when trying to update KeePass was definitely resolved temporarily by closing Malwarebytes from the system tray, which allowed the installation to proceed successfully. 

[dcollins]

I was just able to reproduce this on my personal machine, and the symptoms do align with Ransomware Protection causing the issue. Until we get this fixed, you should be able to toggle off Ransomware Protection when you run into the issue, then retry the update, and turn Ransomware Protection back on once completed. Thanks for the reports

[Chris-G]

I'm glad I found this topic, as I thought the problems I was having, was due to the Latest Win10 1803 update.

I too have had similar problems when updating Cyberfox (64bit) browser and Foxit PDF viewer (Free version). See Image for Cyberfox.  There was no problems manually installing the latest versions of software over the old.

I don't know if this is related, but I have also had a problem with a program called Essential PIM (See Image).  I cured this problem by deleting the log file that was causing the problem, again I don't know if this is a MB issue or an Essential PIM issue, as both were updated about the same time.

[TempLost]

The message you got when trying to update Cyber Fox is pretty much a duplicate of the message I received when trying to manually update KeePass. No doubt the techs will get it sorted soon. 

[tetonbob]

Thanks all. We've been able to reproduce a couple of scenarios and our Developers are investigating.

We have no timeline for a fix at this point, as investigation has just begun. Thanks for your patience while we work towards a solution.

[mga]

On 5/14/2018 at 10:59 PM, dcollins said:

I was just able to reproduce this on my personal machine, and the symptoms do align with Ransomware Protection causing the issue. Until we get this fixed, you should be able to toggle off Ransomware Protection when you run into the issue, then retry the update, and turn Ransomware Protection back on once completed. Thanks for the reports

Thanks for the confirmation of the issue.  As it was happening, my attempts at interacting with the MalwareBytes system tray icon's toggle features were unsuccessful due to Windows being nearly unresponsive.  There was no UAC prompt when toggling settings off because Windows was being held up by MBAM.  Now when my system is fine and idle, I get the UAC prompts as I toggle the various MBAM settings in the system tray.  While a nice work around, in the middle of the incident, it isn't as easy/simple/viable solution as it sounds, thus my end-task was ultimately what got me through it.   

[bdg2]

I don't remember noticing any loss of responsiveness on either of my PCs.

Also I was able to manually update KeePass V2 without any problem. I downloaded the new installer, saved it and then double clicked it.

As far as I remember Adobe Reader was also able to update itself from 18.011.20038 to 18.011.20040 without any problem on both PCs.

So it's kind of hit and miss what works and what fails.

Edited May 16, 2018 by bdg2

[TempLost]

KeePass 2 wouldn't install for me following the same procedure as you followed unless I closed Malwarebytes, but I'm on Windows 7

 

[bdg2]

2 minutes ago, TempLost said:

KeePass 2 wouldn't install for me following the same procedure as you followed unless I closed Malwarebytes, but I'm on Windows 7

 

Also Windows 7 (64 bit) here.

[TempLost]

64 bit here as well. 

13 hours ago, tetonbob said:

Thanks all. We've been able to reproduce a couple of scenarios and our Developers are investigating.

We have no timeline for a fix at this point, as investigation has just begun. Thanks for your patience while we work towards a solution.

@tetonbob

Let me know if I can provide any other logs or info to help resolve the problem. 

[garioch7]

The latest CCleaner update also falls victim to this "bug".  Turning off the Ransomware Protection allowed the update to install successfully.

Submitted for your information.

Have a great day.

Regards,
-Phil

[carmor]

Same problem with Foxit reader automatic update. I had to uninstall and install manually.

Win10 Spring update

Regards

Edited May 17, 2018 by carmor

[tetonbob]

7 hours ago, TempLost said:

64 bit here as well. 

@tetonbob

Let me know if I can provide any other logs or info to help resolve the problem. 

@TempLost - thank you. As of now we don't need any data but I'll let you know if we do.

[bdg2]

Confirming that Ransomware protection is the problem:

Skype for desktop downloaded an update last night. When I pressed the button to update an error message much like those described by others further up this thread appeared. The Retry button just made the message re-appear until I disabled Ransomware protection, then the Retry button allowed the update to complete correctly.

[tetonbob]

I just wanted to update this topic. We've been able to reproduce this issue and have a fix in test. 

That solution is currently undergoing internal testing in our standalone Malwarebytes Anti-Ransomware (MBARW) product. The solution would first be released in MBARW before being integrated to Malwarebytes for Windows.

The problem is in the Anti-Ransomware component. If you disable it during those program upgrades, the issue should resolve.

[bluefin2105]

When can we expect this fix to be rolled out?  Programs such as OneDrive auto-update without my intervention (so I have no opportunity to temporarily halt  the ransomware component) and effectively deletes itself. So I now have to keep the ransomware component permanently disabled.

Thanks