Another Windows 7 x64 freeze after the 1.0.508 update

[Brendan_N]

7 hours ago, robhab said:

I do not have Avast installed (only MSE), and yet I have the  exact same freezing problem that started  the same time (and right after Microsoft updated the virus definitions in MSE).  The freezing problem stopped when I deactivated MBAM Web Protection. 

Logic indicates that the problem is not exclusive to Avast (or Norton).  Likewise, I have a different network adapter than reported by others with this problem.  Again, this indicates that a particular network adapter is not the cause of this problem.   

 

Agree 100% - I am in EXACTLY the same situation.

[Dun4cheap]

I actually troubleshooted an office I manage back in late December. I didn't check the MWB forum and today there is post about it on MYCE. I isolated it to windows 7, MWB 3 latest version. The temporary work around was disabling web protection. But I was able to reproduce the problem on demand. Please note that this does not happen on ANY of my Windows 10 machines, but this one office has chosen to stay with windows 7.

These systems are nothing special, i7, i5 16gigs rigs. One with a realtek network and another intel. 

So with MWB fully enabled I was able to trigger the freeze running the speed test from www.dslreports.com. On one system running it from firefox would trigger it always. The other system running dslreports.com speed test from chrome would trigger it. Both systems were completely up to date windows 7 machines.

One other thing to note, is that the lock up would happen during the upload testing phase of the speed test every time on both systems. 

Give it a try yourself. At least with this info you don't have to wait 5-20 minutes for it to reproduce. I was able to reproduce it right away each time on the problematic machines. For now the web protection is off.

 

[AnotherConcernedCitizen]

9 minutes ago, Dun4cheap said:

One other thing to note, is that the lock up would happen during the upload testing phase of the speed test every time on both systems.

I was with you right up to the upload aspect. I can reliably repro the freeze in minutes by starting 6 WMC HD recordings from a network tuner... download only. Pretty convinced it's any ~heavy network traffic & a speed test would certainly qualify. I usually had a browser (FF) open when testing, but had been thinking it was incidental?

[alQamar]

@LiquidTension I was still up to read the numerous replys here. While doing this and using Outlook and Edge the freeze just happened again at 0:25 am.

my config has changed since the last time as January Updates trailed in

https://support.microsoft.com/de-de/help/4480056/january-8-2018-kb4480056
https://support.microsoft.com/de-de/help/4480116/windows-10-update-kb4480116
https://support.microsoft.com/de-de/help/4480979/update-for-adobe-flash-player I will observe if after these Updates the Problem still persists. Another idea what may cause the problems could be Spectre Protections, but as many using Windows 10 I doubt it as MS does not distribute all microcode Updates to older machines.

this is my current state  

 

Speculation control settings for CVE-2017-5715 [branch target injection]

Hardware support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is enabled: True

Speculation control settings for CVE-2017-5754 [rogue data cache load]

Hardware requires kernel VA shadowing: True
Windows OS support for kernel VA shadow is present: True
Windows OS support for kernel VA shadow is enabled: True
Windows OS support for PCID performance optimization is enabled: True [not required for security]

Speculation control settings for CVE-2018-3639 [speculative store bypass]

Hardware is vulnerable to speculative store bypass: True
Hardware support for speculative store bypass disable is present: False
Windows OS support for speculative store bypass disable is present: True
Windows OS support for speculative store bypass disable is enabled system-wide: False

Speculation control settings for CVE-2018-3620 [L1 terminal fault]

Hardware is vulnerable to L1 terminal fault: True
Windows OS support for L1 terminal fault mitigation is present: True
Windows OS support for L1 terminal fault mitigation is enabled: True

BTIHardwarePresent                  : True
BTIWindowsSupportPresent            : True
BTIWindowsSupportEnabled            : True
BTIDisabledBySystemPolicy           : False
BTIDisabledByNoHardwareSupport      : False
KVAShadowRequired                   : True
KVAShadowWindowsSupportPresent      : True
KVAShadowWindowsSupportEnabled      : True
KVAShadowPcidEnabled                : True
SSBDWindowsSupportPresent           : True
SSBDHardwareVulnerable              : True
SSBDHardwarePresent                 : False
SSBDWindowsSupportEnabledSystemWide : False
L1TFHardwareVulnerable              : True
L1TFWindowsSupportPresent           : True
L1TFWindowsSupportEnabled           : True
L1TFInvalidPteBit                   : 45
L1DFlushSupported                   : False

[alQamar]

sorry cannot edit

"I will observe if after these updates the problem still persists.
Another idea what may cause the problems could be Spectre Protections, but as many reporters here are not using Windows 10 I doubt this to be a reason, as MS does not distribute all microcode updates to older machines (OS).

 

[alQamar]

On 1/8/2019 at 8:22 PM, exile360 said:

I have a Samsung 960 PRO and am using the same driver on Windows 7 on an Intel Z170 board (IRST+Samsung SecNVME drivers; both must be installed to function/for the best speed/performance) and have had no issues with build 508 of Malwarebytes.  I do however typically keep Ransomware Protection disabled as I've pretty much always done so since learning of its function as being more of a reactive tool than a proactive one (it only detects an already active/installed threat based on behavior, and since I trust the other layers/modules to prevent any threats from getting in, this module seems redundant and not worth the performance degradation caused by enabling it).  I have tested with it on to see if I could replicate any of the issues being reported but haven't seen any of them show up so far.

Thank you Exile. It is not a full confirm yet that there is nothing with the driver and MBAM if you disable any module but good to know yours is running stable. What makes me worring is that the freezes on my Win 10 1809 only happens when there is generally a very low load (browsing, email) since the MBAM update.

 

[exile360]

Just FYI, I did successfully confirm the freeze issue on my own system yesterday.  I was streaming a video on Netflix at the time with a few browser windows open so not a lot of resource usage or anything particularly unique (I'd been streaming stuff on Netflix for several hours before the freeze occurred, then suddenly it rendered my system unusable starting with the browser and progressing until only the mouse would move).

It definitely isn't the Spectre mitigation since I don't have any (no microcode updates for my system since I'm running Windows 7 and I haven't received an updated BIOS from my system vendor).

[cassio1934]

Hello. Today I'm having consistent crashes when I try to use the Blizzard games launcher. After a complete reinstall, the problem persisted, and a thread on the battle.net site suggested it could be an issue with the latest 1.0.508 Malwarebytes update. It led me to this bleepingcomputer page, with instructions for a temporary fix and a suggestion to come here and post a couple of files to assist with a solution. I'm linking them below.

mbst-grab-results.zip

output1.txt

[tend2it]

Yes, Battle.net updater (specifically Overwatch) will repeatedly reproduce the crash on my system  ... if MB wants a test case to use.

I posted some info to Blizzard Technical Support forum after I discovered the bleeping computer article ... https://us.battle.net/forums/en/bnet/topic/20770537321#post-11

[exile360]

Thanks for the additional info and links guys.  I will be sure to report them to the staff for you so that the Devs are made aware.

I hope these issues are resolved soon, I'm anxious for all the bugs to get squashed.

[LiquidTension]

19 hours ago, jweigang said:

Some notes about applying Workaround #2:
After installing the previous version of MBAM, I immediately turned off application updates.
For some reason, the version didn't remember the activation key, so I entered it to engage premium.
In doing so, the application updates slider got turned back on and I had to turn it off again.

I suggest inserting a line into the "Malwarebytes for Windows and Windows 7 Freeze/Lock-up" writeup, under Known Workarounds #2, as follows:

 * Run the downloaded setup file...
>* Reenter your license key if necessary to activate the product, and after doing so,
 * To prevent the program from automatically...

If people don't notice that activation has turned app updates back on, they may think that Workaround 2 works only for a while.

Thanks for mentioning this. The instructions have been adjusted.

[LiquidTension]

18 hours ago, SubyTooner said:

The freeze only occurs for me with an ASUS usb-ac53 1200 adapter. It wouldn't freeze using a Huawei 4g usb wireless dongle.

Thank you for the information.

If you don't mind, please could you carry out the troubleshooting steps (1-3) outlined in the article listed below:
https://forums.malwarebytes.com/topic/241223-malwarebytes-for-windows-and-windows-7-freezelock-up/

[LiquidTension]

17 hours ago, MajesticWi said:

Is it possible the problem between Malwarebytes and Windows 7 started with version 3.6.1.2711 and then became worse with the 1.0.508 update?

Most likely not. The results we've seen for reverting to the previous components package suggest the issue arose from changes made to Web Protection in components package update 1.0.508.

[exile360]

13 minutes ago, LiquidTension said:

Most likely not. The results we've seen for reverting to the previous components package suggest the issue arose from changes made to Web Protection in components package update 1.0.508.

That's correct, the issue with the errors in Event Viewer from Malwarebytes during shutdown occurred in the last version as the result of a bug that was actually fixed in build 508 that was related to the self-protection driver and/or MBAMService.

[LiquidTension]

Thanks everyone for your continued feedback on the issue. For those affected by the issue, please provide the following information:

• When did the freeze first start occurring?
• What were you doing on the computer immediately prior to the latest freeze?
• Did you notice anything significant occur around the time of the latest freeze (e.g. AV notification, application crash, etc)?
• Has a freeze occurred when the computer is idle?
• Have you noticed a correlation between high network traffic and the computer freezing?
• How often does the computer freeze?
• Are you able to reproduce the freeze on-demand? If the answer is yes, what are the steps?
• How old is the computer?
• Was the computer upgraded from XP/Vista to Windows 7?
• Is the computer fully up-to-date with Windows Updates? Which updates have been installed after the first freeze occurred?
• Does the computer have multiple network adapters? If it does, what happens when you disable the adapter currently in use and switch to a different adapter?

Edited January 11, 2019 by LiquidTension

[jweigang]

When did the freeze first start occurring?
      Dec 18

What were you doing on the computer immediately prior to the latest freeze?
      Web browsing, Excel, Word--or nothing (idle)

Did you notice anything significant occur around the time of the latest freeze (e.g. AV notification, application crash, etc)?
      No

Has a freeze occurred when the computer is idle?
      Yes, this is how it usually happened once we were trying to diagnose the problem

Have you noticed a correlation between high network traffic and the computer freezing?
      No

How often does the computer freeze?
      Several times a day--until we are tired of dealing with it

Are you able to reproduce the freeze on-demand? If the answer is yes, what are the steps?
      Nothing works any better for us than just waiting

How old is the computer?
      About 6 years. It's a Toshiba P845

Was the computer upgraded from XP/Vista to Windows 7?
      No, fresh install of Windows 7 in Aug 2018 onto spinning HD, cloned to Samsung EVO 860 SSD

Is the computer fully up-to-date with Windows Updates? Which updates have been installed after the first freeze occurred?
      Yes, including the Dec 2018 updates and, for about a day, even the Jan 2018 updates (still hung)

Does the computer have multiple network adapters? If it does, what happens when you disable the adapter currently in use and switch to a different adapter?
      Tried both the built-in Intel Centrino Wireless-N 2200 adapter and an external Alfa AWUS036H adapter (Realtek-based). Hung with both. Does not hang if you disconnect from wifi (disabling adapter not necessary). BUT--all of the hangs were observed when connected to a Netgear N600 WNDR3400v3 router, and the system would not freeze (in 15+ hours) when connected (via Intel N2200) to a Cisco DP3939 modem+router. 

Someone mentioned something about hangs being correlated with MBAM automatic definition updates, and the hang patterns I observed match this: Initially, it would take up to two hours for the computer to freeze, but once it had frozen it would re-freeze much more quickly after that--as if the initial wait was for a new definition file to appear (or to be looked for), and after reboot MBAM knew it needed to check and was waiting only a randomizing amount of time.
 

[robhab]

• When did the freeze first start occurring?  - 

Dec 20, 2018  early morning

• What were you doing on the computer immediately prior to the latest freeze?  - 

Nothing -  the tower was seemingly idle

• Did you notice anything significant occur around the time of the latest freeze (e.g. AV notification, application crash, etc)?   - 

MSE virus definitions had just auto updated

• Has a freeze occurred when the computer is idle?   - 

Yes

• Have you noticed a correlation between high network traffic and the computer freezing?  - 

No correlation

• How often does the computer freeze? 

several times a day until I disabled MBAM Premium 

• Are you able to reproduce the freeze on-demand? If the answer is yes, what are the steps?  - 

no, but I did not really try to intentionally freeze my system because it has a critical function

• How old is the computer?  -

4 yrs old - a high end custom Falcon Northwest Mach V tower

• Was the computer upgraded from XP/Vista to Windows 7?  -

NO!  the system has been running the same Win Pro 64 bit OS that came already installed on the tower . I would rather buy a new system than suffer through an OS upgrade

• Is the computer fully up-to-date with Windows Updates? Which updates have been installed after the first freeze occurred? -

NO!  stopped updating Win 7 about 3 yrs ago after three episodes where Win Update bricked my tower.  Flat brick dead requiring assistance from Falcon.  IMO the OS updates are worst than malware they are supposed to prevent.  NO WIN OS updates were installed, but MSE virus definitions were just auto updated.  Nothing else - no drivers, no Chrome updates, nada  

• Does the computer have multiple network adapters? If it does, what happens when you disable the adapter currently in use and switch to a different adapter?

NO - just one adapter

 

I hope this helps and good luck

 

Rob

[KJ73]

When did the freeze first start occurring?
  December 12

What were you doing on the computer immediately prior to the latest freeze?
  Sitting at the Windows desktop after logging in.  It has also happened when working in Outlook and browsing in IE and Chrome.

Did you notice anything significant occur around the time of the latest freeze (e.g. AV notification, application crash, etc)?
  I did not notice anything

Has a freeze occurred when the computer is idle?
  Yes

Have you noticed a correlation between high network traffic and the computer freezing?
  I have not noticed this either way

How often does the computer freeze?
  I can't run more than an hour or two without a freeze.  Sometimes it happens within minutes of booting up.

Are you able to reproduce the freeze on-demand? If the answer is yes, what are the steps?
  No

How old is the computer?
  Approximately 5 years, custom built business desktop

Was the computer upgraded from XP/Vista to Windows 7?
  It was a fresh build on Windows 7 64 bit when PC was new.  There have been no hardware changes.

Is the computer fully up-to-date with Windows Updates? Which updates have been installed after the first freeze occurred?
  Yes, fully updated automatically from Windows Update

Does the computer have multiple network adapters? If it does, what happens when you disable the adapter currently in use and switch to a different adapter?
  Single embedded motherboard adapter.  "Realtek PCIe GBE Family Controller"
  

[JMac001]

When did the freeze first start occurring?

Roughly mid-December.

What were you doing on the computer immediately prior to the latest freeze?

All of the freezes here occurred while the computer was idle, never while I was actually on the computer.

Did you notice anything significant occur around the time of the latest freeze (e.g. AV notification, application crash, etc)?

Again, PC was idle. I only would notice because all other devices connected wirelessly would lose internet access, though still connected to my home network.

Has a freeze occurred when the computer is idle?

Yes, always.

Have you noticed a correlation between high network traffic and the computer freezing?

No.

How often does the computer freeze?

Three or four times daily.

Are you able to reproduce the freeze on-demand? If the answer is yes, what are the steps?

No.

How old is the computer?

Seven years.

Was the computer upgraded from XP/Vista to Windows 7?

No, was always Windows 7 x64 Pro.

Is the computer fully up-to-date with Windows Updates? Which updates have been installed after the first freeze occurred?

No, missing November and December 2018 updates.

Does the computer have multiple network adapters? If it does, what happens when you disable the adapter currently in use and switch to a different adapter?

Yes. I disabled and deleted the Intel adapter driver and switched to the Realtek adapter, however I also disabled MB Web Protection and Ransomeware Protection so I can't say which fix worked.

Thanks, Jim

[LiquidTension]

Thanks all for the information. Please keep answers to the questions in the following post coming.

To anyone who witnesses a freeze whilst actively using the computer, please make note of the exact time/date the freeze occurred. After hard rebooting, please provide your Event Viewer Logs along with the time/date you made a note of.

• Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
• Expand Windows Logs.
• Right-click Application and click Save All Events As.... Name the file application and click OK.
• Repeat for Security and System.
• Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
• Name the Zip file EventLogs.zip and attach the file to a forum post.

 

------

Whilst reports of this issue indicate that input is no longer possible after the computer freezes, we'd like to re-explore the possibility of forcing a blue screen immediately after the freeze in an effort to generate a memory dump.

To enable this, please carry out the steps outlined in the article linked below:
https://www.tenforums.com/tutorials/67856-enable-disable-bsod-crash-ctrl-scroll-lock-windows.html

If you witness the computer freeze, immediately hold the right Ctrl button, then press the Scroll Lock key twice. If successful, the machine will blue screen and a file named MEMORY.dmp will be created in %systemroot% (e.g. C:\Windows). Please provide this file to us for analysis.

Edited January 11, 2019 by LiquidTension

[abs7125]

I was freezing all the time, when this first started happening. I disabled the web protection, and things where fine. I did a windows update on the 9th, re enabled the web protection, and so far, no freezing. Not sure if the Microsoft update had anything to do with it.

[Davidtoo]

FWIW, I use Windows 7 Pro on my computer.  I did not use my computer the last ten days of December, being on vacation, but upon returning in early January, I did not and have not noticed any Freezing problems, and I use my computer a lot.  I did however notice some other issues...programs not working properly, etc, not able to access the web using I.E., error notices, etc.  I used the software at Tweak.com to reset everything....and so far the computer seems to be working fine.  I also ran an SFC /scannow scan and a have some corrupt and non-repairable files, and per Tweak.com, I also have a number of corrupt package files....still as long as the Computer works, I will avoid reinstalling Pro.  I have no idea whether malwarebytes had anything to do with this...it keeps on working along with Kaspersky in the background.

[cassio1934]

11 hours ago, cassio1934 said:

Hello. Today I'm having consistent crashes when I try to use the Blizzard games launcher. After a complete reinstall, the problem persisted, and a thread on the battle.net site suggested it could be an issue with the latest 1.0.508 Malwarebytes update. It led me to this bleepingcomputer page, with instructions for a temporary fix and a suggestion to come here and post a couple of files to assist with a solution. I'm linking them below.

mbst-grab-results.zip

output1.txt

For the record, I have since then followed one of the suggestions in the article and reverted to version 1.0.482 and didn't crash anymore.

[mwcrumjr]

• When did the freeze first start occurring?
  • Dec 12, 2018
• What were you doing on the computer immediately prior to the latest freeze?
  • Dec 15, 2018 - had 4th freeze running Firefox, Word and Windows explorer.  Did hard shutdown, waited 30 minutes, rebooted and called Dell Tech Support.  Had 5th freeze right after reboot finished - nothing running.
• Did you notice anything significant occur around the time of the latest freeze (e.g. AV notification, application crash, etc)?
  • No
• Has a freeze occurred when the computer is idle?
  • Yes - Dec 15, 2018 - 5th freeze occurred immediately after I had rebooted due to the 4th freeze.  I had not started any applications.
• Have you noticed a correlation between high network traffic and the computer freezing?
  • No
• How often does the computer freeze?
  • I had a 5 freezes before disabling Web Protection.  They seemed to occur randomly, usually late at night.  Except for freezes 4 and 5 which occurred within 1 hour of each other. 
• Are you able to reproduce the freeze on-demand? If the answer is yes, what are the steps?
  • No
• How old is the computer?
  • Dell Optiplex 7040, purchased Dec 2016, set up March 2017.
• Was the computer upgraded from XP/Vista to Windows 7?
  • No
• Is the computer fully up-to-date with Windows Updates? Which updates have been installed after the first freeze occurred?
  • Yes
  • I am not sure of exact sequencing of first freeze and Windows Updates but here is a list of successful updates from Dec 12, 2018 on:

    • 12/12/2018 4:22 PM:  2018-12 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4471318)

    • 12/12/2018 4:23 PM Windows Malicious Software Removal Tool x64 - December 2018 (KB890830)

    • 12/12/2018 4:26 PM 2018-12 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4471987)

    • 12/21/2018 12:23 PM 2018-12 Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based systems (KB4483187)

    • 01/09/2019 11:29 PM Windows Malicious Software Removal Tool x64 - January 2019 (KB890830)

    • 01/09/2019 11:31 PM 2019-01 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4480970)

    • 01/09/2019 11:34 PM 2019-01 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4481480)
• Does the computer have multiple network adapters? If it does, what happens when you disable the adapter currently in use and switch to a different adapter?  
  • No - just Intel Ethernet Connection (2) I219-LM, PCI bus o, device 31, function 6. 
  • I have run both the Intel Driver and Support Assist and the Dell Support Assist Utilities.   They show 2 different drivers for this device. I'm running the Dell Version.

    • Intel:  Intel Ethernet Controller (2) 1219-LM, Version 23.2, 05/30/2018

    • Dell:  Intel 12xx/825xx Gigabit Ethernet Network Controller Driver, Version 22.3.108.0, 01/08/2018

[abs7125]

Disregard my last post. My system just locked up again. Disabling web protection again.