MBAM Potentially Causing Hang at Shutting Down Screen

[Mortisanti]

I'm currently running Windows 7 Home Premium SP1 64-bit with Malwarebytes Premium 3.6.1. I also have Windows Defender running with Malwarebytes folders and system files added to exclusions and vice versa.

Problem: Upon shutting down/restarting my computer, it will hang at the "Shutting down..." screen for about 5-8 minutes; normally it will only take 12-20 seconds.

Potential Culprit: In Event Viewer between shutdown and startup times, the only error/warning I see is an event 7043 saying, "The Malwarebytes Service service did not shut down properly after receiving a preshutdown control."

1) I've opened Malwarebytes > Settings > Application > Install Application Updates and an update installed tonight but it didn't fix the issue. I even ran the repair with the Malwarebytes Support Tool hoping it would solve the problem.
2) Malwarebytes and AdwCleaner show clean scans.
3) I have the latest Windows Updates.
4) I've tested shutdown times by disabling the Malwarebytes Service in MSConfig and they are normal without the service running.
5) Aside from hanging at the shutdown screen, my PC's performance is normal: no BSODs, no crashing/hanging of applications, etc.

Attached are my logs from the Malwarebytes Support Tool. Any help or confirmation of a bug is appreciated.

mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Please open Malwarebytes and navigate to Settings>Application and enable the option under Event Log Data to have Malwarebytes start logging additional info for its components and actions (this should help to provide more details on what's happening during shutdown) and then replicate the shutdown hang issue, then start your system again and then open Malwarebytes and disable the event log data option (you don't want to leave it running as it can consume a lot of space over time, so it's only used sparingly in advanced diagnostics).

Once that's done, go ahead and collect a fresh set of logs from the support tool:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
   

Thanks

[Mortisanti]

Additional information: I noticed that I do not experience a shutdown hang if my PC is only on for a few minutes both with and without the Malwarebytes Service enabled. So I used a few 30-minute tests:

1) 30 Minutes of system up-time with Malwarebytes Service running - Shutdown hang.
2) Disabled Malwarebytes Service, restarted the PC, left it on for 30 minutes - No shutdown hang.
3) Enabled the service again, restarted the PC, left it on for 30 minutes - Shutdown hang. Note: This time I noticed it said "Preparing to configure Windows..." on the next startup which sounds like a Windows Update issue, but I've checked my Windows Update history and every update has been successfully installed.

I've attached the updated logs with Event Log Data.

mbst-grab-results.zip

[dcollins]

Can you please disable the Ransomware Protection service under Settings -> Protection and see if this issue goes away?

[Mortisanti]

30 minutes ago, dcollins said:

Can you please disable the Ransomware Protection service under Settings -> Protection and see if this issue goes away?

I disabled the Ransomware Protection and was able to shutdown my PC with no hanging (my PC was running for well over 30 minutes, too).

I had previously noticed 'MBAMFarflt' taking a long time to unload in Event Viewer - at least 3+ minutes - after initiating a shutdown. It seems this may be the issue.

[exile360]

Thanks, that confirms my suspicions.  It was the Ransomware Protection component that caused similar shutdown hang issues in the past, so it appears there has been a regression in the code, or else some change they've made to it recently has resulted in the same issue.  Either way, I guess the Devs are going to have to patch this issue yet again, hopefully for good this time.

Thanks for the assistance in troubleshooting this issue.

[Mortisanti]

And thank you both. I look forward to the patch.

[dcollins]

Thanks for confirming what's going on. We will still need a bit more information if you don't mind though. Can you please perform the following steps so we can try to get some more information about what's going on:

1. Download and extract CrashDumps.zip
2. Right click on CrashDumps.bat and choose Run as Administrator
3. Choose option 1 and press Enter.
   1. This will enable Complete memory dumps, which contains more information than a normal memory dump
   2. It will also enable the ability to force a system crash, which we will need to do since the system is on the shutdown screen
4. Once the process completes, reboot the computer (you can leave Ransomware Protection disabled as you need to reboot properly first)
5. After rebooting, enable Ransomware Protection and reproduce the issue of hanging during shutdown
6. Once the system is hanging during shutdown, hold the Ctrl key and press the Scroll Lock button twice. This should force a system crash.
   1. This should create a memory dump, and reboot your machine.
7. Once the machine reboots, find the file C:\Windows\memory.dmp and move it to your desktop.
8. Right click the memory.dmp file on your desktop and choose Send to -> Compressed (zipped) folder
   1. This should create a zip file on your desktop
9. Upload the file to wetransfer.com
10. Near the bottom of the page, click on the three dots and change the Send as option to link.
11. Paste the link here so we can look at the memory dump and see what's getting stuck during shutdown

I realize this is a lot to do, but without this information it'll be difficult to understand exactly what's going on with your machine. Please let me know if you have any questions.

[Mortisanti]

Sure thing. Give me some time and I may be able to get this information posted by the end of the night.

[Mortisanti]

5 hours ago, dcollins said:

1. Download and extract CrashDumps.zip
2. Right click on CrashDumps.bat and choose Run as Administrator
3. Choose option 1 and press Enter.
   1. This will enable Complete memory dumps, which contains more information than a normal memory dump
   2. It will also enable the ability to force a system crash, which we will need to do since the system is on the shutdown screen
4. Once the process completes, reboot the computer (you can leave Ransomware Protection disabled as you need to reboot properly first)
5. After rebooting, enable Ransomware Protection and reproduce the issue of hanging during shutdown
6. Once the system is hanging during shutdown, hold the Ctrl key and press the Scroll Lock button twice. This should force a system crash.
   1. This should create a memory dump, and reboot your machine.
7. Once the machine reboots, find the file C:\Windows\memory.dmp and move it to your desktop.

I followed this exactly; after running the batch file as an admin, selecting option 1 and rebooting, I left my PC running for 30+ minutes with Ransomware Protection running. I shutdown my PC and while it was hanging I held Ctrl and pressed Scroll Lock twice. It seemed to reboot a few seconds after, but there is no memory.dmp file. I checked C, C:\Windows\, as well as my desktop for good measure, and nothing.

[dcollins]

Strange, can you try this please:

1. Download and extract the attached CrashDumps.zip
2. Double click on CrashDumps.reg and choose Yes to import it
3. Reboot the computer
4. Then repeat the steps as before starting at step 6

CrashDumps.zip

Edited December 10, 2018 by dcollins

[Mortisanti]

1) I've learned that in order to initiate the keyboard-induced crash it's right Ctrl, not left.
2) After I learned that, I've tried replicating my issue twice now and my PC isn't hanging at shutdown. Either Malwarebytes patched the issue already, or it's a fluke. If it hangs at shutdown again, I'll be sure to crash it with the proper keyboard shortcut and share the dmp file ASAP.

[dcollins]

We didn't release any patches yet for the issue, so if it's not a fluke, it should happen again. If it does, definitely let us know and we'll resume from there. Hopefully it was a fluke and you'll be good from here on out though!

[Mortisanti]

While I'm no longer experiencing hanging at the shutting down screen (with all protection enabled) I'm back to add that, like other recent threads, I'm also experiencing complete system freezes (no BSODs or error messages of any sort) with MBAM 3.6.1.2711, Component Package version 1.0.508, Update package version: 1.0.8345.

It mainly happens when trying to run a video game or client that connects to the internet (with the exception of Firefox, for me). For example, my system has completely frozen multiple times after opening the Battle.net Launcher and trying to update/install a patch for World of Warcraft. When the PC locks up completely, input will not register. BUT, I was able to initiate a crash via keyboard shortly after the launcher stopped responding and before my PC completely froze.

Link to my zipped up MEMORY.DMP: https://we.tl/t-XYsnzxqP0P

[Mortisanti]

It started hanging at the shutting down screen again tonight (with all protection enabled) so I decided to create another crash dump.

Link to the new MEMORY.DMP: https://we.tl/t-V2uREEIzhE