MBAM+ESET combination causing problems in Win7/64bit

[BummerMan]

Hi there!

Throughout the past few months, I've had problems running my Win7 Professional 64-bit PC rig properly. The problem showed as intermittent freezing of the whole operating system every now and then, let's say once in an hour or so, for around 5-15 min at a time. Meaning; I can't click on anything from the task bar, the mouse cursor turns into the spinning circle (as in; waiting, waiting ...); everything that I click on or type is stored in some kind of a buffer that then gets "released" after the clog re-opens.

I am running ESET Internet Security 2018 (the latest version; 12.0.27.0) as well as Malwarebytes Anti-Malware Premium (the latest version as well; 3.6.1.2711)

I have gone thru the problem on ESET's forums as well; https://forum.eset.com/topic/15962-eset-internet-security-updates-hang-up-as-well-as-sites-like-windows-update/?_fromLogin=1

Sorting out different possibilities within the last few months and I've indeed realized that it's ESET Internet Security 2018 and Malwarebytes Anti-Malware Pro/Premium conflicting with each other. Turning off Malwarebytes actually solved the problem altogether.

However, I went thru Malwarebytes' website to see all the listed components of MBAM that should be added to i.e. ESET's exclusion list, and that did NOT solve the problem. Now as I'm running Malwarebytes again, the freeze-up problem has also returned as usual. Disabling MBAM = no problems, no freeze-ups. The two software used to work just fine together before this summer.

I've tried googling up the ESET+MBAM combo and potential pitfalls and tried to check that I've got them all in order. These problems didn't start until the autumn of this year, however. Before that, I had been running ESET+MBAM side by side without any problems.

So, since I already have the exclusion list done, is there any certain modules in ESET that should NOT be enabled while MBAM is also running? I can't reply to the original thread on ESET's forums [see link above in this post] since the thread has been closed (and I did not receive any messages of anyone actually replying to me), and now I'm wondering what should I do next.

The thing is that ESET and MBAM both detect i.e. realtime web threats differently. Throughout the past few years, both of the programs have caught up with potential threats in time, sometimes it's been MBAM, sometimes it's been ESET that has caught the lurking culprit. So, I really wouldn't want to start disabling real-time protection features too heavily.

All help is kindly appreciated. Thank you.

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[BummerMan]

(P.S. Sorry about the topic, I tried to title it as "MBAM+ESET combination causing problems in Win7/64bit"?) - For some reason, only the "MBAM" part went into the topic - and I did not find a way yet to edit the post.)

[BummerMan]

Just FYI :  I received this error message (username omitted from the screencap) upon running the "Collect Logs" etc Support Ticket request. The same "AutoIt Error" appeared before, too, when I tried running the Support Tool. There should be a Support Ticket that has been sent to MBAM staff but I could not find it any longer when I tried searching my existing tickets.

[exile360]

Greetings,

I'm sorry that you're experiencing performance issues with both programs running, but hopefully we can find a solution to the issue.

To start, if you haven't already, I'd recommend excluding ESET from Malwarebytes.  I saw that you mentioned excluding Malwarebytes from ESET but didn't see anything about excluding ESET from Malwarebytes so that's worth a try if you haven't done so already.  To do so, open Malwarebytes and navigate to Settings>Exclusions and follow the instructions under the Exclude a File or Folder section in this support article and exclude the program folder for ESET which should be located under C:\Program Files or C:\Program Files (x86) as well as its data folder which should be located under C:\ProgramData.

You should also verify that you have excluded Malwarebytes files as listed in this support article if that wasn't the list you were using for your exclusions in ESET just to make sure that everything is excluded that can be.

Next, if that does not help or if you already had those items excluded, please try disabling individual components in Malwarebytes to see if we can determine which component might be causing the issue.  Begin by right-clicking on the Malwarebytes tray icon and clicking each of the four protection components listed one at a time and testing to see if the performance issue is resolved.  If disabling any individual component does not resolve the problem then open Malwarebytes and navigate to Settings>Protection and below the Startup Options section toggle the Enable self-protection module setting to Off and see if things improve.

Please let us know how it goes and if any changes to these settings eliminates the issue and we'll go from there.

Thanks

[BummerMan]

4 minutes ago, exile360 said:

You should also verify that you have excluded Malwarebytes files as listed in this support article if that wasn't the list you were using for your exclusions in ESET just to make sure that everything is excluded that can be.

Thanks a lot for the quick reply.  In the file or folder exclusion, there are three different types to choose from in the exclusion list; I'm wondering which one is it.

They are:

- Exclude from detection as malware, ransomware or potentially unwanted item

- Exclude from detection as malware or potentially unwanted item only

- Exclude from detection as ransomware only

 

Tough choice. Any suggestions? Should I go with the "full house" or just with lesser evils?

 

Cheers,

 

[exile360]

The first one; exclude it from all modules.  That's the setting you should use for AV exclusions for the best results.

[BummerMan]

19 minutes ago, exile360 said:

The first one; exclude it from all modules.  That's the setting you should use for AV exclusions for the best results.

Thanks a lot for the clarification. I started off modestly by choosing the second one; and lo and behhhhhhhhhhhhh------- the PC froze up on me.

Now the entire ESET folder is under the firstmentioned rule ( = "Exclude from detection as malware, ransomware or potentially unwanted item"), let's see how it'll roll from here on.

Meanwhile, if any of you good people out there in the dev/admin team want to check out the logs that were generated by MBAM's Support Tool, they're under support ticket # 2476090

Thanks a lot. Will keep you posted on how it's rollin' on from here.

 

[exile360]

Sounds good, hopefully those exclusions resolve it, but if not then please move on to testing the various protection options I mentioned and let us know how that goes.  Hopefully we can find a fix for this.

[BummerMan]

An old coder friend of mine once said; being a complete pessimist can only bring positive surprises. Well ... he was RIGHT.

After adding MBAM to ESET's exclusion list and vice versa as instructed (by exile360), I haven't had a single freeze-up for around 24 hours now. Ran all kinds of heavy duty software to check out if that'd happen. So far, so good! :-)

Now, the only thing that is left for this matter, for now, in my pessimistic viewpoint is that I still think everybody should keep an eye out for everybody (how does THAT make me sound? Hehe--); meaning, that one antivir/anti-malware software should seriously keep a basic tab on the other one if you should have one of each installed (i.e., in my case, MBAM + ESET). I am not a fan of exclusion lists - it easily serves as a vulnerability of its own. But enough of that.

Until further notice, I thank you all for the good work you've done, and especially exile360 for helping me out.

Never give up, and keep pushing forward.

Thank you so much. All the best.

 

[BummerMan]

(P.S. To clarify my point: Everything is working as it should now, and has been for the past 24 hours or so. I am grateful and happy. Now I can get back to work! "Hooray!")

[exile360]

Good, I'm glad that all seems to be working normally now, but please don't hesitate to let me know if the issue emerges again.

I definitely hear what you're saying regarding having your security apps watch each other/watch out for each other, however I think both ESET and Malwarebytes do a pretty decent job of protecting themselves (both have various self-defense mechanisms built in) and with both products on the job, the chances of an infection even getting through to attempt to compromise either product is extremely low, at least in my opinion (I obviously use Malwarebytes and I have used ESET in the past and still recommend it as one of the top AVs out there).

[BummerMan]

OK, well.This is interesting. It seems that the reason for the outstandingly fast performance on my desktop sort of came into a more proper light when I noticed that MBAM isn't turning on any longer. It used to after I ran the fix tool, but now iAt's not appearing on the Win7 system tray upon startup

Furthermore, when I try to start MBAM after a reboot manually, I get the same previously mentioned stuck/frozen up Windows UI. ( = the mouse cursor turns into the rolling "Busy" wheel symbol.) 

After the initial fix with the Support Tool and the exclusion lists, it worked just fine -- apparently, until the next reboot, and I didn't notice that.

Now I'm waiting for what it is that MBAM is about to do next as I started it manually just now. Been a few minutes that it's been stuck in with that busy-cursor wheel'a'rollin'.

[BummerMan]

After 5-10 mins of waiting in the busy-limbo as I tried to launch MBAM after having just booted the machine, I get the MBAM tray icon, but can't click on it. Neither left- nor right click does anything at all.

[BummerMan]

OK, to clarify things; just checked out the tray icons altogether and it seems that none of them are working, MBAM seems to have parked itself into the driver's seat of the OS with around ~20% CPU utilization as I checked just a minute or so ago. So, everything seems to be unresponsive as for now, will keep you posted.

[BummerMan]

P.P.S. If it's of any valuable knowledge, the system is showing the same symptoms that it had previously. I have the regular mouse pointer, but as I move it on top of the task bar and/or system tray, it becomes that good'ole rolling wheel-busy symbol.

Everything WAS working just fine up until a certain point of this year, and from there on, after the exclusion lists that we just went thru with exile360 the past week (see post above), things were working again in a seemingly normal fashion. And now, I'm once more stuck in the same mud. *sigh*

[BummerMan]

After a few mins more of further waiting, I got the alert box that the real-time threat protection modules were off, the task bar icons as well as all other icon in the system tray work once more, except MBAM. 

I can right click on the MBAM icon to get the usual drop-down list of modules in use (all of them show up as they'd been checked active), but the program itself doesn't open the main window. Sheesh ...

[BummerMan]

Update: I ran the MBAM Repair Tool again. Re-downloaded it from the link to make sure it was the latest version [Repair Tool version 1.5.3.553].

I can now get to the MBAM main window. The desktop alert is still warning about the protection modules being turned off. And, as it MBAM is checking for updates, it is once again frozen the OS in the same manner as described previously/aboce, i.e. everything else but the active window, which in this case is the MBAM main window, is stuck.

I'll wait it out and see what happens. I already used the Repair Tool to send a ticket w/ a description of the s(h)ituation, but it too is now stuck. Might be 5-15 mins once more until it clears up, will have to wait and see. 

Meanwhile, and during all of this ordeal - ESET has not been giving any troubles. Its latest modules+db updates are from today, and so forth.

Will keep you posted and post the support req. ticket # once I get it, if I get it. Thanks.

[BummerMan]

OK, I got a support ticket in the mail, it's # 2478469 . 

You can basically treat it as being in the same continuation with my previous support ticket, # 2476090 , so that there is no confusion over that.

I'm running the MBAM Premium's Threat Scan right now. Its scanning process seems to be running forward just fine for a while, then it gets stuck, (i.e. right now the program's progress progress indicator's green-colored wheel has become stuck and inanimate on the "Scanning memory objects" section.)

I took a backup of the MBAM Repair Tool logs+findings, can send them over as a separate .zip file if necessary.

Thanks so much.

 

[BummerMan]

The MBAM main window is now unfrozen from its stupor and is now going through the filesystem.

However, upon trying to use the MBAM Repair Tool 's separate log gathering feature, I got this "AutoIt Error" message again (username omitted from the screencap):

Might want to look into it.

 

Thanks.

 

[BummerMan]

Situation update:

The Threat Scan in MBAM after running Repair Tool finished without any problems (or detections), but now the Windows 7 task bar and its icons (incl. system tray) are frozen in the usual manner as they have done for some while now.

I have filed two support tickets over this issue, as mentioned in my previous posts ( the first one being # 2476090 and the second one that I filed just now is # 2476090 ). All help kindly appreciated.

Thank you.

[BummerMan]

Now that I've ran the computer for a while, again I am in a situation where I'm getting intermittent freeze-ups, esp. during times of high utilization, esp. web browsing seems to correlate with the freeze-up problem. Then again, as we're back to square one, I've noticed the same freezing with all USB devices plugged out apart from the keyboard and mouse, the culprit is either some next level-whack-a-mole malware or a conflict between ESET and MBAM that's extremely hard to pinpoint.

So, the reason why my Windows 7 OS seemed to run OK for a while had apparently been caused by MBAM not utilizing correctly during start-up.  That problem is now "fixed", and thus; back to square one with the freeze-ups.

One idea would be to go through the possible suspects module-by-module - if someone could answer this question: should I run MBAM's self protection module on Windows' early start? I remembered that I didn't have it on that mode for some reason the last time I checked it out. 

 

 

[exile360]

Thanks for all of that detailed info.  Yes, by default the self-protection early start option is disabled so you may leave it that way.

As for testing the individual modules, you can start by disabling self-protection, restarting, then testing to see if that fixes the issue.  If that does not help, then try disabling each protection component one at a time until you are able to isolate the culprit.

Please let us know how that goes and then we'll see what else to try next.

Thanks