Another Windows 7 x64 freeze after the 1.0.508 update

[exile360]

OK, then in your case it must be the Web Protection component causing the issue.  If you disable that and find that it no longer crashes then I'd suggest installing the Malwarebytes browser extension beta to supplement your browser protection while Web Protection is disabled as mentioned in my above post.

[KJ73]

Stable here for 36+ hours with both Web and Ransomware Protection disabled.

[Core]

Signed up to just post here. Having this issue. 

It's always right here every time:

12/19/18    " 23:58:53.112"    50867932    0a60    0f00    INFO    MBAMShimImpl    MBAMShimImpl::InitializeInternal    "mbamshimimpl.cpp"    62    "MBAMCore was successfully loaded. CoreFilePath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dll>."

12/19/18    " 23:59:46.746"    50921565    0a60    0f00    INFO    MBAMCoreImpl    MBAMCoreImpl::Initialize    "mbamcoreimpl.cpp"    123    "MBAMCore was successfully initialized. CoreFolderPath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE>. DefsFolderPath=<C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE>."

It's always almost 60 seconds. The system updates like every 3 hours. Every 3 hours it's a hard freeze. I know it's MBAM as the service uses no CPU then it kicks up to 8% during the freeze for MBAM every time. Once i got to the logs, i found this for the exact duration each time it occurs. 

Once it never resolved and forced a hard reboot. 

Win7 Ultimate x64. 

[Core]

Decided to post a few more:

 

12/16/18    " 04:38:21.239"    282051398    0ab0    2a04    INFO    MBAMShimImpl    MBAMShimImpl::InitializeInternal    "mbamshimimpl.cpp"    62    "MBAMCore was successfully loaded. CoreFilePath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dll>."

12/16/18    " 04:39:19.089"    282109244    0ab0    2a04    INFO    MBAMCoreImpl    MBAMCoreImpl::Initialize    "mbamcoreimpl.cpp"    123    "MBAMCore was successfully initialized. CoreFolderPath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE>. DefsFolderPath=-<C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE>."

----------------------------------------------

12/16/18    " 06:26:19.039"    288529199    0ab0    0f70    INFO    MBAMShimImpl    MBAMShimImpl::InitializeInternal    "mbamshimimpl.cpp"    62    "MBAMCore was successfully loaded. CoreFilePath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dll>."

12/16/18    " 06:27:16.637"    288586795    0ab0    0f70    INFO    MBAMCoreImpl    MBAMCoreImpl::Initialize    "mbamcoreimpl.cpp"    123    "MBAMCore was successfully initialized. CoreFolderPath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE>. DefsFolderPath=<C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE>."

----------------------------------------------

12/16/18    " 16:26:19.260"    324529410    0ab0    0f70    INFO    MBAMShimImpl    MBAMShimImpl::InitializeInternal    "mbamshimimpl.cpp"    62    "MBAMCore was successfully loaded. CoreFilePath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dll>."

12/16/18    " 16:27:16.100"    324586257    0ab0    0f70    INFO    MBAMCoreImpl    MBAMCoreImpl::Initialize    "mbamcoreimpl.cpp"    123    "MBAMCore was successfully initialized. CoreFolderPath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE>. DefsFolderPath=<C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE>."

-----------------------------------------------

12/17/18    " 02:26:18.918"    360529074    0ab0    0f70    INFO    MBAMShimImpl    MBAMShimImpl::InitializeInternal    "mbamshimimpl.cpp"    62    "MBAMCore was successfully loaded. CoreFilePath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dll>."

12/17/18    " 02:27:16.873"    360587028    0ab0    0f70    INFO    MBAMCoreImpl    MBAMCoreImpl::Initialize    "mbamcoreimpl.cpp"    123    "MBAMCore was successfully initialized. CoreFolderPath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE>. DefsFolderPath=<C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE>."

 

You get the point. Whatever is happening here is taking 50-60 seconds and locking up everything else.

[bdkochis]

Yeah guys I gotta tell you that you have a serious problem here.  I'm an IT consultant who has been recommending Malwarebytes to my clients for years, and this week I have received multiple reports of both Windows 10 and Windows 7 computer locking up (all inputs unresponsive, requiring manual power down / hard reboots with the power button) on systems with the newest Malwarebytes Premium installed.  The worst systems are experiencing up to 5-10 hard freezes a day.  This is NOT GOOD as I am having to tell all my clients to disable your product until a fix is provided (and quitting Malwarebytes DOES solve the problem).  Please PLEASE get on this.  

[AnotherConcernedCitizen]

Temporarily disable web protection on the affected machines & wait for engineering to do their thing

[bdkochis]

I just quit the program entirely.  I understand these things happen.  I appreciate that they're working on it.  Just frustrated because this cost me (and my clients) a lot of extra work this week, right before the holiday.  The kind of hard freeze MB is generating doesn't give Windows time to write any traceable error log files beyond the generic "kernal-power 41",  and I suspect a whole lot more people are experiencing this than the current 31 posts on this thread would indicate. They just haven't found the needle in the haystack yet.   

[Porthos]

1 hour ago, bdkochis said:

Just frustrated because this cost me (and my clients) a lot of extra work this week, right before the holiday. 

I have 100's of clients and have had no issues.  It is not as widespread as some people think.

[Core]

Web protection off.. it happened again. Turning Ransomware protection per previous post. Seeing if that helps.

12/20/18    " 23:58:52.564"    137267385    0a60    0f00    INFO    MBAMShimImpl    MBAMShimImpl::FinishUpdate    "mbamshimimpl.cpp"    131    "MBAMCore finishing update"

12/20/18    " 23:58:52.694"    137267510    0a60    0f00    INFO    MBAMShimImpl    MBAMShimImpl::InitializeInternal    "mbamshimimpl.cpp"    62    "MBAMCore was successfully loaded. CoreFilePath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dll>."

12/20/18    " 23:59:50.369"    137325184    0a60    0f00    INFO    MBAMCoreImpl    MBAMCoreImpl::Initialize    "mbamcoreimpl.cpp"    123    "MBAMCore was successfully initialized. CoreFolderPath=<C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE>. DefsFolderPath=<C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE>."

 

[Core]

That previous post was supposed to say "off" i'm turning Ransomware protection off. 

I honestly don't know if it will help. It seems EVERY time the MBAMCore is done updating, it loads the MBAMCore.dll, then when it goes to initialize everything freezes. Can't say for sure if it's the InitalizeInternal or the Initialize.. it depends on how they're writing their debug output. Either way, this isn't much of a "needle in a haystack". Speaking as a programmer with 2 decades of experience.

1. Find a win7 machine.
2. Install MBAM
3. Trigger an automatic update. (don't tell me you can't pump out internal "junk" updates at a rapid clip to test the automatic update functions)
4. Does? The system Freeze?
   1. Yes: Great! 
   2. No: Try multiple machines with various versions of Win 7, Win 10. Have browser windows open. Leave the systems on.  Keep going until you can get one of them to trigger a freeze. Once you can reproduce the freeze on demand, that's half the battle.
5. From here it SHOULD be much easier. You can replicate it on command. Depending on what you're using to compile, get a test system that you can use to run and replicate the issue. Debuggers are fantastic. If you can replicate it with uncompiled code, you can step through it. Start stepping. I'd assume you guys are familiar enough with the code that you can find and start stepping from the "MBAMShimImp1::FinishUpdate" debug output line. 
6. Jam that step key like there is no tomorrow. As soon as it stops stepping and starts hanging, check out where you're at.

Yeah, this is likely an external thing being initialized but HEY let's make sure you're looking in the right place to start with. If MBAMShimImp1::InitializeInternal really is where it's hanging, then hook MBAMCore and find out what the hell is slowing it down. It would obviously be during "start up" of it.

This might sound complex, but it shouldn't be that hard for even a small team. A 1 man team this might take some time to replicate and get rolling. Obviously if they just can't replicate it no matter what then this is all moot. It took me a while to bother reporting it. Then because it was a freeze with no reporting, the crashes provided no info, I only caught on while watching CPU usage during a freeze (perfmon doesn't freeze for me).

I've got.. 8 drives connected. 2x spin disk. 4x SSD via SATA. 2 M.2's one in a PCI-E socket with adapter, the other in an NVME slot and an 8TB WD drive attached via USB. (OS is on an SSD) That and 128GB of RAM. 3 monitors, 2 graphics cards. I can't think of how else my system could be "unique". 

[exile360]

I'm running Windows 7 x64 Pro SP1, fully patched and haven't had this issue (yet) and I run my machine virtually 24/7, only rebooting for updates usually.  My guess is this is very likely being caused by some kind of conflict either with some specific hardware/driver or software on your system, but whatever it is, hopefully they will be able to fix it when they address the other known issues with this latest build of Malwarebytes (so far confirmed issues with Avast, ESET, Web Protection on some systems and Ransomware Protection on some systems as well as shutdown lag on some Windows 7 and Windows 10 systems).  Given the other current issues, I would speculate that it is very likely that whatever is causing the issue you're seeing probably will be addressed when these other issues are addressed but that for whatever reason, the issue in question is simply presenting itself differently in your case, likely due to your somewhat unique hardware configuration (all those drives and GPUs etc.).

Anyway, thanks for posting the debug log data, hopefully the team will find it helpful in tracking down this issue.

[Core]

It's midnight. When i submitted all the logs (private message) i stated I was more or less irritated at the "it's really hard". Assuming everything is "really hard" usually doesn't help. 

I wish you all the best of luck in tracking it down. If there's anything else i can do to help. Let me know.

 

[exile360]

I'm not a developer so I have no idea how difficult it is from that perspective to track these issues down, but I have worked QA for several years and was actually the first individual hired by Malwarebytes for that job and I can speak to the fact that it is actually much harder than you might think to replicate something when it isn't common to every system running the same OS/software (there's a reason Microsoft used to have literally thousands of unique hardware setups for testing their software prior to releasing any new product, patch or update, and recent headlines about their latest Creators Update illustrate why not doing things that way/not having access to so many diverse systems for testing can have real world consequences in my opinion).  I don't know how many QA's are currently employed by Malwarebytes or what hardware setups they are using to test, but I guarantee not one of them is running 2 GPUs and 8 drives.  Most if not all are likely off the shelf modern rigs with much more standard configurations and might even all be the same model and much of their testing is probably done in VMs (another issue with testing where an issue may occur on a live box but not in a pristine VM or 'clean' Windows installation) but I don't know for certain as I haven't been in QA for several years now and no longer work at Malwarebytes.  I just know that I always tested on my live systems and almost always found issues that none of the other QAs did and still do to this day (and I always report them of course so that they may be fixed before release).

I also know that a lot of, if not all, of these issues have been seen before and were fixed in prior releases which leads me to believe that this is some kind of regression in the code, either because some change accidentally broke whatever code had been implemented to patch those issues or because of an error in the build process when it was being compiled where it used older versions of the software's components/code where those issues hadn't been fixed/patched yet and I've reported these things to the team as well, so if they hadn't realized it, then they do now which hopefully also aids in finding the root cause(s) of these issues.  So for now all we can do is wait for a patch, which will hopefully be coming soon, and until then I'd recommend keeping an eye on this area for a new pinned topic to show up announcing the release of a new patch/version where the issues/fixes should be listed among the changes once posted.

[Core]

For sure, my main point being from the original bunch was that replicating it SHOULD be the hardest part. As long as you have access to the source code and the ability to repeat tests on various components while tracing code, it usually goes pretty fast from that point. So total agreement. It can, and may be, really difficult to replicate if they can replicate it AT ALL.

I prefer to use my QA guys to find the issues in the first place. When they do find an issue the hope is they can replicate it. Issues that arrive from a 3rd party I try to rely on "mimicking" the environment/setup as much as possible. We mostly work with web thankfully. Back in the day having a VM of every known OS just to replicate issues for debugging was a pain.

[Porthos]

I will admit after rereading the title of this post, All but one of my clients are using Windows 10. The one using Win 7 would call me if there were any issues (an old friend) and has not had any. Right now she is only using MB for protection so no software conflicts. ALL the rest are Win 10 Defender/ MB prem computers.

[exile360]

31 minutes ago, Core said:

For sure, my main point being from the original bunch was that replicating it SHOULD be the hardest part. As long as you have access to the source code and the ability to repeat tests on various components while tracing code, it usually goes pretty fast from that point. So total agreement. It can, and may be, really difficult to replicate if they can replicate it AT ALL.

I prefer to use my QA guys to find the issues in the first place. When they do find an issue the hope is they can replicate it. Issues that arrive from a 3rd party I try to rely on "mimicking" the environment/setup as much as possible. We mostly work with web thankfully. Back in the day having a VM of every known OS just to replicate issues for debugging was a pain.

Yep, I actually used to set up my system in a multi-boot configuration because I didn't trust VM testing, especially having seen how frequently an issue wouldn't occur or replicate in a VM vs a live testing environment.  I had my system set up to boot from 5 different operating systems at one point, which at the time was every supported operating system that Malwarebytes ran on (XP, both flavors of Vista and both flavors of 7 (i.e. x86 and x64)).  It was a pain but well worth it for the results as I'd almost always invariably discover issues not found by the other QAs during early testing.

These days I'm just running 7 x64 (wouldn't run Windows 8/8.1 or especially 10 even if Microsoft paid me, though they did try forcing it down my throat for free, but I spit it right back at them  ).  I haven't seen any of the issues yet, but that's likely just the luck of the draw as I know a decent number of users are affected by these issues (though definitely not all, as the numbers of reports are definitely much lower than with some more common issues we've seen in the past).

[Telliege]

1 hour ago, exile360 said:

I'm running Windows 7 x64 Pro SP1, fully patched and haven't had this issue (yet) and I run my machine virtually 24/7, only rebooting for updates usually.  My guess is this is very likely being caused by some kind of conflict either with some specific hardware/driver or software on your system, but whatever it is, hopefully they will be able to fix it when they address the other known issues with this latest build of Malwarebytes (so far confirmed issues with Avast, ESET, Web Protection on some systems and Ransomware Protection on some systems as well as shutdown lag on some Windows 7 and Windows 10 systems).  Given the other current issues, I would speculate that it is very likely that whatever is causing the issue you're seeing probably will be addressed when these other issues are addressed but that for whatever reason, the issue in question is simply presenting itself differently in your case, likely due to your somewhat unique hardware configuration (all those drives and GPUs etc.).

Anyway, thanks for posting the debug log data, hopefully the team will find it helpful in tracking down this issue.

Based of of the Clients I have had call me and  their configurations it does not appear to be hardware. As some of the builds are completely different in age and brands of hardware from each other. My brother runs windows 7 as well as my mom and they seem to be so far uneffected. Customer wise I am getting call a day of another person effected. On top of ones I discovered the first day. so far all of them are running windows 7. Have not been able to figure out anything obvious and have enough to now to look at software and hardware. Which has pointed to nothing obvious.  Hardware though does not appear to be whats triggering it. (maybe a driver) Software is far more complex and nothing obvious sadly. Perhaps why they are taking a bit to track this down.

[exile360]

Yeah, it could be something as simple as a particular setting, update, network card/driver (there were issues with some older Killer Network device drivers in the past) or any number of other potential triggers for the issue, and of course it could just be semi-random.  Whatever it may be, I'm just hoping the Devs are able to get a fix out soon for it, or at least a test build so that we can have some users test/verify that the issues are fixed, but given the upcoming holidays, I'm guessing we probably won't hear anything until after the new year.

[asadowsky]

Two different customer sites affected win 7 x64  pro mix of dell and lenovo. hard lockup requiring power resets nothing unique in config

[bashbish]

Hey CORE(new member) and all of you having clients complain of this hard freeze. I have the same issue (W-7 64).

It happened about 6 days ago and figured I had a corrupt file or something in the OS. I booted up a clone of my C drive that was about 2 weeks old. The problem stopped so i was happy until now (about 6 days later) and another hard freeze. I hard power rebooted and worked for 15 minutes and it froze again. Now I am up for about a half hour.

What to do now ? I came to this forum and at least I know I am not alone. Hope this gets resolved and for good.

[Core]

SO FAR.. disabling "Web Protection" alone didn't work. 

Disabling Web Protection and Ransomware Protection has not caused a lockup since my previous post. Keeping an eye on it for now. That's the best i can offer short of total removal of MBAM.

[mwcrumjr]

I've been encountering the same problem since Dec 13 - had a total of 5 system freezes in 2 days.  On Dec 15 I discovered that Malwarebytes was the culprit and based on the suggestions at that time, I turned Web Protection OFF.  Since then I've not had any more system freezes.  Web Protection is still ON.

My System:

Windows 7 x64

Malwarebytes 3.6.1.2711, Component Package 1.0.508, Update package 1.0.8341

Avast Free 18.8.2356 (build 18.8.4084.409)

[Fuzzy2084]

Hi all

I've been a MWB premium user for about 18 months, I have it installed on 3 networked PCs, and one laptop, all W7 64.

About 4 days ago, one of the PCs started random hard freezing. I spent countless hours scanning the disk (with chkdsk, Norton AV, MWB, etc), removing what I thought were offending programs, etc., to no avail. I had got to the point where I thought it was a hardware issue (eg; HDD or RAM failure).

Then, yesterday a second PC started doing the same. I realised that it was software or OS related, and (before I found this forum or thread) narrowed this down to MWB, which I fully uninstalled from both machines.

Needless to say, both machines have been stable (and browsing, opening files etc. is noticeably MUCH faster). 

Both the affected machines are Lenovo desktops. The unaffected machine is also a Lenovo desktop (slightly different model) and a Dell laptop.

I'm paying for this software, and I require malware protection, so after having read the above comments, I'm going to reinstall it and disable Web and Ransomware protection until a fix is found (I'll miss that speedy browsing, etc., but it's a small price to pay for the protection).

I hope a fix comes soon!

 

 

[bashbish]

Does anyone know if this is reported to MWB staff ?

I do not see any of their staff on this topic.

[Porthos]

There are several topics on this. Staff is fully aware.