Jump to content
AnotherConcernedCitizen

Component Update 1.0.508 issue

Recommended Posts

@AnotherConcernedCitizen as for your logs, they show at least two things that are concerning.  First, the Malwarebytes licensing server appears to be blocked in your HOSTS file.  I don't know if that's the cause of your issues (though I doubt it, as that wouldn't cause a loss of internet connectivity, though it could easily prevent Malwarebytes Premium from functioning properly), so it should be removed (let us know if you require instructions on how to edit or reset the HOSTS file in Windows):

Hosts File Blocks
==================================
Host data:    # 0.0.0.0        keystone.mwbsys.com

Next, I see that you have Avast installed.  There have been some compatibility issues with Avast in the past with Malwarebytes Premium, particularly the Web Protection component.  You can test to see if this is the cause by temporarily disabling Avast's web shield component, then re-enabling Web Protection in Malwarebytes.  If that eliminates the issue then you may try entering exclusions in the two programs for one another.  The files to exclude for Malwarebytes in Avast are listed in this support article.  For Avast, you should probably exclude Avast's program folder, ProgramData folder as well as any services and drivers which may be located elsewhere (such as the System32\drivers folder).  You should also verify that you're using the latest version of Avast by forcing it to check for updates via the method described in this post (just checking for updates isn't enough, as that only forces it to check for new signatures/definitions, not new program versions or patches).

Share this post


Link to post
Share on other sites

In the event this is NOT the same issue,I apologize for the hijack.

8 hours ago, exile360 said:

Host data:    # 0.0.0.0        keystone.mwbsys.com

Unsure of the pedigree of this edit, but note that it is commented out & would have no bearing on functionality. It has been removed.

I am aware of past issues w/ Avast. as I was one of the reporters of the most recent events. I will attempt some debug when I am able,

but this is the household media PC & co-opting it for any protracted period of time will likely result in death threats (or worse).

 

Update since last night's post: NO lock-ups have occurred since disabling MBAM's web protection component.

 

Share this post


Link to post
Share on other sites

Hehe, no problem, I wouldn't want you to face the wrath of angry family members :) 

Yes, this actually sounds a lot like the previous conflicts with Avast which would often show similar symptoms and were also resolved by disabling either the web shield component in Avast or the Web Protection component in Malwarebytes.

Yeah, you're right, if commented out in the HOSTS file it wouldn't affect anything.  I didn't catch that it had the leading # and just saw the entry was present which was one of the few items in the log that stood out as a potential issue.

Take your time, and once you get the chance to troubleshoot it further please let us know how it goes and we can proceed from there.

Thanks

Share this post


Link to post
Share on other sites

Since the last update, I re-enabled MBAM web protection/disabled Avast web protection (last time it was 'Real Site', IIRC) & have heard no howls of outrage. so we have that data point.

 

I've always resisted the 'mutual exclusion' tack, as that just serves to mask an issue introduced by an update... this time, MBAM's. It WOULD save me some grief, but doesn't get to the root of an issue which didn't exist prior to the update. Avast/MBAM have (~) peacefully co-existed in my environment for a number of years, so detente IS possible.

 

Later this afternoon, when things quiet down, I'll pre-load the support tool & re-enable everything to see it I can catch 'the event' live. Please let me know if this exercise is of no value.

 

 

Share this post


Link to post
Share on other sites

For reference, adding exclusions doesn't mask an issue, they help prevent compatibility issues. Sometimes two products being installed together are just incompatible and exclusions are necessary. We did make some pretty big changes to our Web Protection platform with this release that is designed to increase protection, so if I had to guess, that's what's going on. Not saying we can't fix it, but that exclusions might be necessary.

That being said, please start by making sure you have the latest version of AVAST installed as they did introduce an issue a few months ago that caused Malwarebytes to deadlock systems. A subsequent update on their side fixed the issue as well. Support Tool logs would definitely help as well, but ideally only after the issue has occurred. It would also help to enable Debug Logs under Settings -> Application.

Share this post


Link to post
Share on other sites

Question:

You note ' Support Tool logs would definitely help as well, but ideally only after the issue has occurred'. Would this include following a power cycle (HARD restart)? When this problem occurs, if I can't catch it with the support tool pre-loaded, there is no other option... the 'explorer' process is completely unresponsive... just like with the 'bad' Avast update you mentioned.

Share this post


Link to post
Share on other sites

After a hard reboot is fine. Support Tool doesn't grab too much "in the moment" stuff. Although if you can pre-load a tool like procdump (in admin mode) and wait for the hang to happen, then try to get a full memory dump of mbamservice, that would be super helpful. Not sure if that will work though depending on how bad the system locked up

Share this post


Link to post
Share on other sites

Well, in the interim, things just locked up w/ the AvastSvc consuming beau coup CPU... killed he MBAM service from the Services mgr (already open) & things faded back to normal. Avast web prot. had been disabled since this AM, w/ MBAM fully active.

 

These are the logs I just collected:

upload error: "There was a problem processing the uploaded file. -200 "

Available when I can resolve???

 

Switching to Avast 'Real Site' off (as with last conflict) & restarting everything else before someone else notices...

 

Share this post


Link to post
Share on other sites

Sorry, I didn't mean ProcDump, I meant ProcExp (which has a UI)

As for your issue, if you can't upload the logs, you can email them to me at dcollins@malwarebytes.com

Share this post


Link to post
Share on other sites

After the initial report/dump, with MBAM web protection OFF, problem did NOT recur for the remainder of last night/overnight.

 

Set Avast web protection OFF this AM & re-armed MBAM. Was OK all day until Avast SVC started to consume resources & network shut down. I immediately terminated the MBAM service & collected a dump. You just got this dump.

 

IF this is like the last MBAM/Avast conflict, (Avast bug)  it was actually shutting down the 'Real Site' component which suppressed the hang. THAT is my current config (w/ MBAM FULLY active).

Share this post


Link to post
Share on other sites

Scenario:

MBAM - ALL protection active

Avast Premiere - ALL 'shields' active, 'Real Site' component disabled

User watching video from NAS

WMC recording several shows via network tuner

Active browse session monitoring forum

Noticed Process Explorer tray icon RED

AvastSVC.exe consuming ~75% CPU & increasing

Waited for network to 'fail'... WMC recordings stop

Took FULL 'Process Explorer' dumps for 'AvastSVC' (0MB?) & 'MBAMService'

Stopped MBAM Service before system could freeze

Generated new support tool dump

G-drive invite for dump access sent

Please advise when you get 'em & on how I ought to proceed.

Share this post


Link to post
Share on other sites

Having determined a fairly reliable means of reproduction, I'm trying a few things for the weekend.

Added all recommended exclusions to both apps (they both need work for adding individual files). With all protections enabled on both, with a single active WMC recording, AvastSVC eventually jumps from ~1% to 25% CPU & eventually climbs until the network dies/system hangs. Restarting MBAMSvc instantly resolves the condition. Stopping the AvastSVC never really completes (self-protection?) & condition persists.

Disabled all Avast 'shields' & so far, no issues. Will incrementally re-enable Avast 'shields', one by one, to see where thjngs fall down.

Share this post


Link to post
Share on other sites

I don't know about Avast, but I do know that exclusions are recursive in Malwarebytes, so if you exclude a folder, it excludes all files and sub-directories within, so individual file exclusions shouldn't be necessary for folders belonging to Avast such as its Program Files folder and data folder(s) under ProgramData etc.

Share this post


Link to post
Share on other sites

It's the individual drivers. Don't want exclude THAT entire folder. Some sort of file multi-select would be nice. At least MBAM remembers the last folder accessed...

I've given up on this experiment. With all Avast 'shields' disabled, I got 2 instant back-2-back HARD lock-ups. No slow creep. No mouse/kbd. Weird buzzing sound. Only a power cycled recovered the machine. Collected logs for support, if they want them, but I'm back to Avast only/MBAM disabled. At least the machine is stable.

Share this post


Link to post
Share on other sites

Wow, OK, sounds like some kind of driver conflict then for sure.  I assume you've already forced Avast to check for program updates as I suggested in my earlier post, correct?  I just want to make sure the QA guys get accurate info on how to (hopefully) replicate this as that will go a long way to finding a fix for the Devs.

Share this post


Link to post
Share on other sites
12 minutes ago, exile360 said:

Wow, OK, sounds like some kind of driver conflict then for sure.  I assume you've already forced Avast to check for program updates as I suggested in my earlier post, correct?  I just want to make sure the QA guys get accurate info on how to (hopefully) replicate this as that will go a long way to finding a fix for the Devs.

Before I ever reported the issue. After the 1st hard lock-up, I repaired my NIC drivers, updated my Video drivers, ran 'sfc /scannow' & 'chkdsk /f'. THEN it locked-up the 2nd time. Overkill, but I was concerned about all of the dis-orderly shutdowns having a detrimental effect.

Share this post


Link to post
Share on other sites

What particular method did you use to force Avast to check for program updates?  Did you execute this command from an administrative command prompt?:

schtasks.exe /Run /TN "Avast Emergency Update"

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.