System Tray Icon Missing

[Buddy]

Hello! First off I would like to reference this article.

This seems to be a near identical problem I have. I am using the Malwarebytes cloud to deploy endpoints. I currently have 5 total endpoints to deploy. On 2 of the computers (Group A), the tray icon is there and you can start a system scan that way. On the other 3 (Group B), it is missing. 

I have tried to run the malwarebytes cleanup utility and it seemed to have worked great.

I reinstalled the product on the same 3 machines and nothing changes, even after multiple restarts. I'm not sure if the endpoint protection is different or not, but there is no mbamtray exe anywhere in the directory that was talked about in the other article. 

All malwarebytes services are running on all computers, both group A and group B. The only difference is the system tray icon to initiate scans.

 

The big difference in group A and group B:

Group A is running Windows 10 Professional with 1 running a local login, and the other a Microsoft account.

Group B is running Windows 10 Enterprise with all users being Azure AD users. There are no "local" accounts on the machines. 

 

My first thought was that it has to be something with Azure AD. I've spent about 6 hours today trying to figure that one out and there are absolutely no restrictions whatsoever on any machine. All users on Group B are admins on the machine. I also contacted Azure support and there is nothing preventing that installation from taking place properly. 

 

I've had McAfee ePO products and Avast business products work fine in the past on all machines.

 

Is there some sort of compatibility issues with Windows 10 Enterprise? If not, or there other services that need to be installed that are on the Pro version by default that is not on Enterprise? 

 

Thanks in advance,

Buddy

 

 

EDIT: Here's another article of my exact issue with no resolution

 

Here's another issue that matches mine, but the solution didn't work

 

 

BIG EDIT: I disconnected 2 of the Group B PC's from Azure all together, but it still has windows 10 enterprise installed. So basically, it's Windows 10 Enterprise with a local user account and it works fine. It only happens with the Azure AD Joined PC's, I don't think Enterprise has anything to do with it.

Edited August 15, 2018 by Buddy

[Buddy]

I just want to add that I found Endpoint Agent Tray.exe in the folder. I double clicked that and ran as normal, not as admin. When I did that the icon appeared as it does on the other machines. I rebooted the machine and the icon is gone again. I'm still trying to figure out some extra details about the other ones that are different from these.

[vbarytskyy]

@Buddy

As I mentioned in a few other topics you replied to, this is a known issue we have. The behavior you are seeing is the side effect of the issue. We have a fix already in place and waiting to push out with our next release.

[Buddy]

@vbarytskyy

I did not see that you said it was a bug, I must have looked over that. Thank you.

[Buddy]

Has there been any progress on this? I see that the issue is still persisting.

[djacobson]

Hi @Buddy, this one is a new issue, but with a similar symptom as your past problem. For this one, pick out one machine and add this line to the registry via CMD or PS. Let me know if that works for you.

reg add HKLM\SYSTEM\CurrentControlSet\Control /v ServicesPipeTimeout /t REG_DWORD /d 60000

[Buddy]

8 minutes ago, djacobson said:

Hi @Buddy, this one is a new issue, but with a similar symptom as your past problem. For this one, pick out one machine and add this line to the registry via CMD or PS. Let me know if that works for you.

reg add HKLM\SYSTEM\CurrentControlSet\Control /v ServicesPipeTimeout /t REG_DWORD /d 60000

@djacobson I did give it a shot, but doesn't seem to do anything at all on my end on 2 machines I have here to test with. Any further advice?

 

EDIT: I do want to point out I did do this in an elevated command prompt.

Edited January 14, 2019 by Buddy

[djacobson]

Has the machine rebooted to take up the new service timeout config?

Do you have an existing startup delay set in your policy?

[Buddy]

@djacobson I am using the default policy configuration in the portal, and I have rebooted the machine. This machine I'm currently testing with also has a brand new fresh install of Windows 10 Business. I tried what I posted earlier before on Pro, but had the same result, leading me to believe the issue is only with Azure AD connected PCs.

Currently, there is no delayed startup in the policy.

Self protection, and early start are both enabled.

[djacobson]

The default policy is set to use the Incident Response product in a scan only config, have you changed it to run any realtime options? Just want to make sure there. Give an in-policy startup delay a try as well, upping the timer as you go, if you get to 120 seconds and it doesn't reliably start, then we'll need to look at something else conflicting with the service's attempt to be started.

I do not recommend having the self-protect or self-protect early start on unless you are actively dealing with an infection that is targeting and modifying Malwarebytes' files. That is what the option is for, getting Malwarebytes to run on a heavily infected machine in which the malware is preventing Malwarebytes from running. In the past this feature was called "Chameleon" and was a free standalone tool. When MB3 came out, this product was turned into a feature within the main program. The B2B Admin Guide doesn't really discuss its usage. The B2C help guide has much more detail on the MB3 engine, this is what Cloud uses:

https://www.malwarebytes.com/support/guides/mb/Settings2.html

• Enable self-protection module: This setting controls whether Malwarebytes creates a safe zone to prevent malicious manipulation of the program and its components. Checking this box introduces a one-time delay as the self-protection module is enabled. While not a negative, the delay may be considered undesirable by some users. When unchecked, the "early start" option which follows is disabled.
• Enable self-protection module early start: When self-protection is enabled, you may choose to enable or disable this option. When enabled, the self-protection module will become enabled earlier in the computer's boot process, essentially changing the order of services and drivers associated with your computer's startup.

Not only does it introduce more delay to the startup, it also changes items to a read-only mode, which can prevent even the legitimate file changes Malwarebytes needs to do when upgrading portions of the program.

Azure AD is an interesting angle, the support team will need a fair amount of information/logs from those machines, it would be best to open a ticket in regards to this lead.

[Buddy]

@djacobson Thanks for your help so far. I realize that some of the settings aren't optimized for this environment just yet, but deploying the endpoint on a standard installation with a local account or microsoft account seems to work perfectly. I will submit a ticket and try to post results back as soon as I hear something.

[RickyF]

hi @djacobson,

do we have to do something to solve the issue or just by waiting everyting will be all right when the new version is pushed?

regards

Ricky

[djacobson]

Hi @RickyF, give the service pipe registry key a try and policy startup delays, other than that, we'll need to wait for the upcoming release.

[Buddy]

@djacobson Do we have an ETA for an upcoming release?

[djacobson]

I believe it is going to be included in an update currently targeted for 1/31.

[AliAbbas1988]

I dont know if this release is avaiable or has been cancled i had a issue where i installed malwarebytes on a brandnew pc with a clean install of windows 10 pro. The system tray icon was fine until a day after i started my pc and the system tray icon was gone. Upon restart it comes back, so what i did was removed malwarebytes and re installed it and for two days it was fine, i was using my pc more within those days the icon was fine until today i turned my pc and the system icon was gone. It cleary is a bug with malwarebytes as i never had this issue before and nor has the system tray icon has ever vanished all my other icons stay exactly where they are no other icon has vanished.

[exile360]

The issue referred to in this thread was resolved long ago and was only present in the business version of Malwarebytes.  If you have fast startup enabled that could be the reason you are seeing this issue.  It has been known to frequently cause intermittent startup issues for Malwarebytes and many other applications as well as some hardware drivers due to Microsoft's implementation of the feature.  You can find out more about the issue as well as find how to disable it here as well as here.

If the feature is active I would suggest disabling it and testing to see if it resolves the issue and if it does, you may then make a determination on how to proceed.  Unfortunately there is no known workaround for this issue at this time except starting Malwarebytes manually when the problem occurs if fast startup is left active.  If that was not the cause of the issue then I would suggest following the instructions provided by @1PW in your other thread here and hopefully that will resolve it as it may be a problem with Avast if fast startup isn't the cause.

[AliAbbas1988]

2 minutes ago, exile360 said:

The issue referred to in this thread was resolved long ago and was only present in the business version of Malwarebytes.  If you have fast startup enabled that could be the reason you are seeing this issue.  It has been known to frequently cause intermittent startup issues for Malwarebytes and many other applications as well as some hardware drivers due to Microsoft's implementation of the feature.  You can find out more about the issue as well as find how to disable it here as well as here.

If the feature is active I would suggest disabling it and testing to see if it resolves the issue and if it does, you may then make a determination on how to proceed.  Unfortunately there is no known workaround for this issue at this time except starting Malwarebytes manually when the problem occurs if fast startup is left active.  If that was not the cause of the issue then I would suggest following the instructions provided by @1PW in your other thread here and hopefully that will resolve it as it may be a problem with Avast if fast startup isn't the cause.

This issue is new for me i have never had this issue before i have always used malwarebytes with avast for as long as i remember and never have I had this issue occur on me. This is the first time this has ever happened and it does seem like a malwarebytes bug as this is a brand new build with a clean install of windows from a clean download of windows 10 iso via usb. I will do as the person suggested and see if the issue resolves but I do not understand how his steps relate to the system tray icon vanishing and if fast start is the cause which i admit I have enabled via the bios why hasnt it ever occured before?

[exile360]

Avast released a new build not too long ago, and that's when these issues started popping up.  I believe it has something to do with a change in one of their drivers or services, and if not installed in the correct order, can lead to issues like this.

As for the issue I mentioned with fast startup, it is enabled by default in Windows 10 and you'll find tons of threads around here and on other forums around the web describing issues with Malwarebytes not starting up along with many other programs due to this feature.

[Sadasity]

I just started having this same problem and have no idea why. Sometimes it displays on startup and sometimes it doesn't. By the way this has nothing to do with fast startup. I've always had fast startup and it only started on Friday.

[exile360]

It most likely is related to fast startup even if you've never experienced this issue previously.  Any change in startup timing and/or the number of startup items can trigger it as can driver updates and even Windows Updates.

That said, if disabling fast startup doesn't eliminate it then the next possible culprit would be if you run any third party AV software (i.e. an AV besides the included Windows Defender) as it may be causing issues with Malwarebytes starting up for some reason and exclusions may be needed to correct the problem (though if that were the case I'd expect it to happen on every startup rather than intermittently as you're reporting which does lead me to believe that it is far more likely to be caused by fast startup).

[djacobson]

Thanks @exile360, that is spot on.

[Sadasity]

On 6/3/2019 at 5:56 PM, exile360 said:

It most likely is related to fast startup even if you've never experienced this issue previously.  Any change in startup timing and/or the number of startup items can trigger it as can driver updates and even Windows Updates.

That said, if disabling fast startup doesn't eliminate it then the next possible culprit would be if you run any third party AV software (i.e. an AV besides the included Windows Defender) as it may be causing issues with Malwarebytes starting up for some reason and exclusions may be needed to correct the problem (though if that were the case I'd expect it to happen on every startup rather than intermittently as you're reporting which does lead me to believe that it is far more likely to be caused by fast startup).

It was fast startup for me. Bitdefender released an update yesterday that fixed the issue.

[Sadasity]

wasn't fast startup*. Why isn't editing allowed? LOL.

[exile360]

They are well aware of the problem with fast startup as it has been one of the most common issues since Windows 10 was released.  Unfortunately it is something that can likely only be fixed by Microsoft as their unorthodox startup method is what causes the inconsistency with Malwarebytes and other programs starting up, though I am sure Malwarebytes' Developers either are or have investigated the issue from their end to seek a solution.  Given the fact that everyone, including the staff, still advises users to disable fast startup whenever it causes problems with Malwarebytes and the fact that it has caused problems since the feature was first introduced, I don't hold out much hope that Malwarebytes will be able to do much to fix it from their side.

If you search Microsoft's support forums for issues with fast startup you will find many of them, not just related to Malwarebytes, but to many different programs and even some hardware drivers and system components.  The feature was rushed in my opinion and a bad implementation of a hybrid boot state.