Malwarebytes crashes when I run a Threat/Custom Scan

[Stuxnet]

Hey,

Recently I bumped into an issue with Malwarebytes 3. Whenever I run a Custom Scan or a Threat Scan, Malwarebytes crashes with the following message "We're sorry, but the Malwarebytes service stopped working. The program will now restart". It crashes everytime and always at the end of the scan. Nothing is logged, so I can't see what the threats are, if there are any. Things I tried:

- Followed every forum topic about this. Nothing
- Reinstalled the program. Nothing
- Disabled various settings. Nothing
- Run as administrator. Nothing
 

In the Event Viewer I see this:
 - Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
 - Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

I have the exact same Malwarebytes on my laptop and it runs fine there. I run Windows 10, update 1803 on both machines. Now I know that ntdll.dll is a important system file, so I'm not touching that, but what is wrong? Any solutions are okay with me, so are workarounds, if there is any.

Thanks.

 

Stuxnet

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
• Click the Gather Logs button
  
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
     
  
  Click "Reveal Hidden Contents" below for details on how to attach a file:
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[Stuxnet]

Please find the zip file attached

mbst-grab-results.zip

[Stuxnet]

This is the log file

 

 

Logs.rar

[Firefox]

5 hours ago, Stuxnet said:

Please find the zip file attached

mbst-grab-results.zip

Not sure what happened to this attachment but its not working correctly... can you upload the file again please?

[dcollins]

As mentioned by Firefox, we'll need the original log file which includes FRST please. If you don't want to post them publicly, you can private message them to me as well. Also, can you use the steps below to generate a crash dump of mbamservice:

1. Download Prodcump.zip and extract the files.
2. Right click 4 - mbamservice_crash.bat and choose Run as Administrator.
3. Once the black window shows up, start a scan which causes Malwarebytes to crash.
4. Once it crashes, the black window should disappear and a new .dmp file should be in the same folder as the batch file.
5. Please zip up the batch file and attach it in your reply. If the file is too large, you can use wetransfer.com to generate a download link.

[Stuxnet]

Yeah, I filtered out some stuff, because the log files expose more info that I personally want to share. Don't know what they are for to be honest, but will upload one to you soon in a private message, dcollins.

Firefox, I removed the first one and the second one is a .rar file....

[Firefox]

3 hours ago, Stuxnet said:

Yeah, I filtered out some stuff, because the log files expose more info that I personally want to share. Don't know what they are for to be honest, but will upload one to you soon in a private message, dcollins.

Firefox, I removed the first one and the second one is a .rar file....

Yes its the first one we were needing, once you send that file to @dcollins he will review them and get back to you.

Thanks

[Stuxnet]

I sent a PM to dcollins with the dump file. Hope it helps correcting the error, because I've been really happy with Malwarebytes for years now.

[Firefox]

That's great, once @dcollins checks the logs he will most likely have some more info/instructions for you.

[dcollins]

Thanks @Stuxnet, I see where the crash is happening, waiting for our developers to respond with any next steps that are needed.

Update

Can you please run the following command from a command prompt window, and then send me the "variables.txt" file from your desktop? Thanks!

set > "%userprofile%\desktop\variables.txt"

Also, can we get some debug logs?

1. Open Malwarebytes and go to Settings -> Application
2. Turn on Event Log Data
3. Reproduce the issue
4. Run the Malwarebytes Support Tool to gather a new set of logs and PM them to me please

Edited June 11, 2018 by dcollins

[Stuxnet]

@dcollins and @Firefox,

 

The issue has been resolved. For future reference, this is what I did after @dcollins found out what was causing the crash:

- In my C:\Users folder there was a folder called %USERNAME% and I think malwarebytes tripped over the %. I removed that folder and voila, problem solved.

 

Thank you both for assisting and resolving this issue.

[Firefox]

Great, glad to hear you got it working... glad we could help.

[exile360]

On 6/14/2018 at 8:42 AM, Stuxnet said:

- In my C:\Users folder there was a folder called %USERNAME% and I think malwarebytes tripped over the %. I removed that folder and voila, problem solved.

Yep, that's definitely not a valid folder/path and I'm guessing some errant installer created it when it was attempting to expand/use the default %USERPROFILE% environmental variable which should've simply redirected it to C:\Users\UserName but due to some issue with the syntax in their code, it instead failed to locate the user folder and created one by that name as a result.  I've seen similar issues in the past with bad scripts and installers in both the registry and filesystem so while it's not super common, it can and does happen from time to time when developers don't test/check their code/scripts properly to make certain they're parsing things correctly.