Another Windows 7 x64 freeze after the 1.0.508 update

[Fuzzy2084]

6 hours ago, Darkdirk said:

^^^^THIS IS AN EXCELLENT POINT^^^^

I shudder to think how many hundreds of thousands of hours have been wasted by individual users such as ourselves  chasing our tails and needlessly replacing hardware / reinstalling entire systems from scratch, and how many others STILL DON’T KNOW why their systems are freezing.  And how much of everyone’s TIME AND MONEY could have been so easily saved by a simple email to so-called “premium” customers (something that they already do every few weeks anyway).

You guys can keep claiming that it only affects a “very small percentage of users”, but I’m not buying it anymore.  Of the fifteen MBAM Premium / Win7 users that I personally know of (because I recommended it to each of them), only one has remained unaffected by this.  ONE.  14/15 is not a small percentage.  My guess is that Malwarebytes is justifying calling it a “small percentage” based on total installations (not just Premium) and only counting those who have reported problems.  My bet is they’re not sending out an email warning because it would probably verify what they should already suspect at this point, which is that this affects most, if not all, MBAM Premium/Win7 installations.

You know how food companies sometimes do massive recalls of millions of pounds of tainted products, even though just a few people actually got sick?  Imagine if an expensive food recall could be replaced by a simple email.  I guess what I’m saying is, I hope Malwarebytes never gets into the food packing business.

Very well said.  You would have expected some communication from the company about this.

We have 4 W7 PCs, and 3 of those were affected - one only crashed this week, the others before Christmas.

Like pretty much everyone else here, I've disabled 'web protection' and 'ransomware protection' on all 4 machines - thus negating the purpose of having the software installed in the first place.

[LiquidTension]

24 minutes ago, Fuzzy2084 said:

Very well said.  You would have expected some communication from the company about this.

We have 4 W7 PCs, and 3 of those were affected - one only crashed this week, the others before Christmas.

Like pretty much everyone else here, I've disabled 'web protection' and 'ransomware protection' on all 4 machines - thus negating the purpose of having the software installed in the first place.

If the system is completely freezing, only disabling the Web Protection component should be sufficient to mitigate the issue. Alternatively, reverting to the previous components package version (1.0.482) is an alternative workaround. See this topic for details.

If any affected users discover that disabling the Ransomware Protection component (whilst leaving Web Protection enabled) prevents the system from completely freezing, we'd be interested to know.

As mentioned here, we have been able to successfully reproduce the issue on an internal system. Thanks again to everyone for your continued feedback on the issue.

[torus_ot]

12 hours ago, GK2005 said:

bit more transparency with user-base would be nice.

How to communicate with users (suggestion)

It is obvious and understandable that Malwarebytes and affected users differently estimate impact of the current problem with Web protection 1.0.508

I can see that e-mail could be problematic, but other users can disagree. But Malwarebytes already has tools to send notification to users about updates.

Why not to use it to send other types of Alerts, Warning and Information? The software modification is minimal, benefits are plentiful and users can turn this feature on and off.

Additionally latest Alert notification can be shown on the Dashboard page with link to the forum!

(I so like my idea, I think I'm genius 🤣   )

[AnotherConcernedCitizen]

13 minutes ago, torus_ot said:

How to communicate with users (suggestion)

It is obvious and understandable that Malwarebytes and affected users differently estimate impact of the current problem with Web protection 1.0.508

I can see that e-mail could be problematic, but other users can disagree. But Malwarebytes already has tools to send notification to users about updates.

Why not to use it to send other types of Alerts, Warning and Information? The software modification is minimal, benefits are plentiful and users can turn this feature on and off.

Additionally latest Alert notification can be shown on the Dashboard page with link to the forum!

(I so like my idea, I think I'm genius 🤣   )

While I agree with the concept of some sort of alert system, and that the 'machinery', in part, might already be in place, I also anticipate the flood of users slamming this forum/MBAM support to determine if an alert is real, or some sort of 'attack'. I hope they can ultimately arrive at a solution acceptable to all parties involved, although I doubt it'll be as straight forward as most propose.

[exile360]

3 hours ago, LiquidTension said:

If the system is completely freezing, only disabling the Web Protection component should be sufficient to mitigate the issue. Alternatively, reverting to the previous components package version (1.0.482) is an alternative workaround. See this topic for details.

If any affected users discover that disabling the Ransomware Protection component (whilst leaving Web Protection enabled) prevents the system from completely freezing, we'd be interested to know.

Right here.  As I reported some days ago, on my own system I was only able to replicate the freezing issue on 7 once I enabled Ransomware Protection.  I hadn't discovered it previously because I normally keep Ransomware Protection disabled.  After enabling it the freeze didn't occur until several hours afterwards while I was streaming a movie on Netflix.  It was well into the movie when the issue occurred so I don't think any specific activity or process triggered it and it seems more like some kind of resource issue more than anything (similar to a memory leak where the module reaches some kind of upper limit and then hangs once it runs out of bandwidth, but that's just my hypothesis; I'm no developer/programmer).  The first symptom was that the browser running Netflix became unresponsive to clicks (the video froze and I couldn't minimize or close it).  I was able to launch other processes as well as Task Manager but could not terminate the process and eventually the system hung completely and not even the mouse would move at which point I had to force the system to power down by holding the power button.

I have yet to have any issues with the Web Protection component, however ever since the Ransomware Protection component was first integrated into Malwarebytes 3 I have had performance issues with it, including the widely reported hang on shutdown and slow startup issues reported with past releases.

I can try to replicate the freeze again, but I'd prefer not to since this is my only system which I use for work and everything and I'd hate to hose my OS by corrupting my registry because of forcing system shutdowns.

[Curley]

Is there an estimated time for when the Win 7 freeze issue with the Web Protection feature will be resolved? How will the user community be be informed it is time to update again? I realize I should get a MWB notification in the application that an update is available but it would be nice to understand that this specific issue was identified and corrected. Combing through this forum is informative and helpful but it's also time consuming. In the meantime, I've disabled Web Protection with no hangs for about a day now. I also turned off Automatic Updates.

System details are as follows:

OS Name    Microsoft Windows 7 Professional
Version    6.1.7601 Service Pack 1 Build 7601
Other OS Description     Not Available
OS Manufacturer    Microsoft Corporation
System Name    
System Manufacturer    System manufacturer
System Model    System Product Name
System Type    x64-based PC
Processor    Intel(R) Core(TM) i7-4930K CPU @ 3.40GHz, 3401 Mhz, 6 Core(s), 12 Logical Processor(s)
BIOS Version/Date    American Megatrends Inc. 0701, 1/7/2014
SMBIOS Version    2.7
Windows Directory    C:\Windows
System Directory    C:\Windows\system32
Boot Device    \Device\HarddiskVolume1
Locale    United States
Hardware Abstraction Layer    Version = "6.1.7601.24308"
User Name    
Time Zone    Pacific Standard Time
Installed Physical Memory (RAM)    32.0 GB
Total Physical Memory    31.9 GB
Available Physical Memory    27.4 GB
Total Virtual Memory    63.9 GB
Available Virtual Memory    59.3 GB
Page File Space    31.9 GB
Page File    C:\pagefile.sys

Thanks!

[AverageJoe]

All these posts about people spending days, if not weeks, tearing apart their desktops and checking RAM, video cards, CPUs, motherboards, power supplies, etc. and even buying entirely new hardware to replace the old terrifies me. I can't imagine someone spending so much time going to such great lengths to troubleshoot a problem of this nature, being unable to find out the cause, chalk it up to faulty hardware, replace nearly everything, if not outright upgrade to an entirely new machine, and go to reinstall all their programs and find the freezing problem STILL occurring. I was about to go down that exact same road and was dreading it. Guess I'm extremely lucky I only spent 48 hours looking into it before I started turning to forums for help.

I started with Steam and Battle.net since they are my two most used applications and there were a couple forum posts on Battle.net about system freezes during game updates. One Blizzard employee suggested uninstalling all antivirus and anti-malware to let Battle.net install and upgrade as needed and then reinstall the antivirus and anti-malware once finished. The post mentioned MBAM which I too used and found it strange to have to uninstall MBAM to allow a legit application to update, so I wandered on over here for more info and found this thread along with the pinned one.

I feel bad for the non-tech savvy users encountering this problem who don't know support forums like this exist and are just googling the problem which yields thousands of different unrelated solutions, or worse, taking their entire desktop/laptop down to the local computer repair shops or Best Buy Geek Squad and flushing hundreds of dollars down the toilet.

[exile360]

I think an in--product notification from the tray would be best, especially if there's a way to only trigger it on Windows 7 systems since those appear to be the only ones affected by this issue so far.

[mkaz]

2 minutes ago, exile360 said:

I think an in--product notification from the tray would be best, especially if there's a way to only trigger it on Windows 7 systems since those appear to be the only ones affected by this issue so far.

Just let everyone know regardless of OS, but state what OS's are known to be impacted.  Don't limit the communication - it is information of value.  We are all just desperate to get communication out in the first place in a timely manner.  This has been a case study of what NOT to do.

[mkaz]

And to the fanboi club, no more "practice patience" postings please.  Enough is enough.

[exile360]

I don't know about that.  When was the last time any vendor notified their customers about an issue like this?  I've experienced similar or worse issues with products from other security/AV/AM vendors, hardware vendors (thanks to bad drivers etc.), and even Microsoft themselves but not once did I ever receive any kind of notification/communication about it from them and only occasionally have I even seen them mention such things publicly anywhere and usually only found out either through the usual web searching/forums or, on the rare occasions where the issue was widespread enough, a tech site reported the issue (as with the recent issues with the October Creators Update for Windows 10).

I'm not saying that they shouldn't notify everyone, and I certainly wouldn't mind it, but I've never seen any vendor handle this type of situation any better.

[KJ73]

9 hours ago, exile360 said:

I'm not saying that they shouldn't notify everyone, and I certainly wouldn't mind it, but I've never seen any vendor handle this type of situation any better.

Here is an example of handling a situation better:

• Cisco put out a bad Firepower patch bundle (6.2.3.8) on Jan 2, 2019 that causes Firepower to stop processing traffic after it has been up for a few hours if a specific protection (HTTP file inspection) is enabled.
• By Jan 8, 2019, patch 6.2.3.8 was recalled, a bug report was published with specifics of the problem, how to identify it happening, and two workarounds (disable HTTP file inspection, or roll back to the previous update).
• On Jan 9, 2019, there were Reddit discussions talking about the issue and referencing the bug report:  https://www.reddit.com/r/networking/comments/aeb4gx/dont_install_cisco_ftd_6238_p1_file_policy_bug/ 
• On Jan 10, 2019, patch 6.2.3.9 was released with the fix.
• On Jan 14, 2019, a proactive notification went out to anyone who had downloaded 6.2.3.8 advising them of the defect:
   

Quote

 

This is a Proactive Notification Message from Cisco TAC

This email contains important information regarding a file that you recently downloaded from Cisco's support site. Our records indicate that you have downloaded FirePOWER Services Software for ASA with a filename Cisco_FTD_Patch-6.2.3.8-51.sh.REL.tar on 3-Jan-2019.

Cisco engineering has identified a software problem with the 6.2.3.8 patch and as a result, it has been replaced with a new patch release 6.2.3.9

Symptom of the problem:
Upon upgrading FMC to 6.2.3.8-51, managed devices (ASA Firepower services/SFR module and FTD) might stop passing traffic after a certain amount of time. This defect can be validated by reviewing the output of the following commands:

[details snipped]

 

While this notice wouldn't necessarily go to everyone impacted - only the person who downloaded the code would receive it, and that person might not even work for the affected customer - word of the defect spread quickly among people who needed to know about it.

This was for a "Severity: 1 Catastrophic" problem affecting a small portion of the userbase.

 

MBAM's customer base is different and communication techniques must necessarily be different, but the key difference here is ownership of the problem and a timely effort at customer notification.  In Cisco's case, no automatic update would have pushed 6.2.3.8, so admins were generally aware that they applied an update and afterwards there were problems - which is what makes the problematic MBAM 1.0.508 automatic update so insidious.  One day things are working, and the next day they aren't.

Nothing on the affected machines even remotely hinted at an MBAM update being the problem.  Only trial and error troubleshooting, or some lucky google searches, pointed most of us to this forum.

If you want to erode trust in your product by your userbase, this was a great way to do it.  Many of us are influencers - people who convince our customers, colleagues, relatives, and friends to buy your software.  Consider how many are reevaluating this decision.  It's not a good look.

 

[belsnerd]

Brilliantly stated.  I may be retired 20 year but I still influence many potential MB customers.  I have one suggestion for Malwarebytes.  Faced with a similar potentially nasty problem, err on the side of prompt factual advice to your existing user base, rather than pretend it will all go away in time, unnoticed.

 

[LiquidTension]

19 hours ago, exile360 said:

Right here.  As I reported some days ago, on my own system I was only able to replicate the freezing issue on 7 once I enabled Ransomware Protection.  I hadn't discovered it previously because I normally keep Ransomware Protection disabled.  After enabling it the freeze didn't occur until several hours afterwards while I was streaming a movie on Netflix.  It was well into the movie when the issue occurred so I don't think any specific activity or process triggered it and it seems more like some kind of resource issue more than anything (similar to a memory leak where the module reaches some kind of upper limit and then hangs once it runs out of bandwidth, but that's just my hypothesis; I'm no developer/programmer).  The first symptom was that the browser running Netflix became unresponsive to clicks (the video froze and I couldn't minimize or close it).  I was able to launch other processes as well as Task Manager but could not terminate the process and eventually the system hung completely and not even the mouse would move at which point I had to force the system to power down by holding the power button.

I have yet to have any issues with the Web Protection component, however ever since the Ransomware Protection component was first integrated into Malwarebytes 3 I have had performance issues with it, including the widely reported hang on shutdown and slow startup issues reported with past releases.

I can try to replicate the freeze again, but I'd prefer not to since this is my only system which I use for work and everything and I'd hate to hose my OS by corrupting my registry because of forcing system shutdowns.

When the system froze with Ransomware Protection enabled, was Web Protection also enabled? Has this occurred with Ransomware Protection enabled and Web Protection disabled?

[bdubrow]

19 hours ago, Curley said:

How will the user community be be informed it is time to update again? I realize I should get a MWB notification in the application that an update is available but it would be nice to understand that this specific issue was identified and corrected.

Great question!  

As soon as a solution is available, either as part of a new component package update or a new version upgrade, we will post both a general announcement of the release here in this forum (as we do with all new versions) and we will post a reply to the pinned topic on the Windows 7 freeze issue.  In addition, we'll post another reply to this thread confirming the issue's been resolved and including all the relevant version info and instructions on how to obtain it.

And if the fix involves a full version upgrade, you're correct that you'll see a notification alerting you that a new version is available.

Edited January 15, 2019 by bdubrow

[exile360]

42 minutes ago, LiquidTension said:

When the system froze with Ransomware Protection enabled, was Web Protection also enabled? Has this occurred with Ransomware Protection enabled and Web Protection disabled?

Yes, Web Protection was enabled.  I haven't tested with Web Protection disabled but I will shortly.

[ffwfire]

When will this be fixed?  My brother runs a Windows 7 computer that sometimes freezes, but he doesn't want me to disable protection or load a previous version.  He loves Malwarebytes.  I just hope you get it fixed soon.

[robhab]

There appears to be two different themes playing out in this thread:

1. Discussions concerning a technical fix for the freeze problem caused by Malwarebytes (MB) - which is the intended original purpose of this thread

2. Opinions about how MB  staff has handled/mishandled the problem so far - essentially a customer service and PR debate that is also a valid customer concern. 

Both themes are very important to MB and its customers. I am confident the Ms. Elena Verna (SVP, Product & Growth) and Mr. Raj Mallempati (SVP of Marketing) at MB are keenly interested in customer opinion and how this particular problem is affecting MB's reputation and future sales.  I would like to add my personal comments on the customer service aspects that directly affected me, and my evolving impression of the company as it wrestles with this most difficult fix.  I think thoughtful comments may be helpful.  However, I don't want to muck up the technical discussion here.  Further,  the technical folks at MB,  who are responding to technical comments here, are exactly the wrong folks to be responding to consumer concerns/rants.  That job takes a special skill set not often found among programmers.  Could the forum moderators please start a separate thread to discuss customer opinion on how this freeze problem has been handled by the company so far.   And direct those comments to the second thread.  This way, the two themes can be separated. 

If the moderators are not comfortable doing this, I am happy to start the second topic thread - just point me to the right place in this forum.

Thanks - and good luck on the fix.        

[alQamar]

To 

On 1/14/2019 at 1:30 PM, Fuzzy2084 said:

Very well said.  You would have expected some communication from the company about this.

We have 4 W7 PCs, and 3 of those were affected - one only crashed this week, the others before Christmas.

Like pretty much everyone else here, I've disabled 'web protection' and 'ransomware protection' on all 4 machines - thus negating the purpose of having the software installed in the first place.

 

 @Malwarebytes it is time to release a minor Release Update to get a "full screen" popup message for Premium users on Windows 7 and 10 that Systems might be freezing, I totally agree most suspect Hardware issues, just like me. 

You are excellent enough to reenable premium 30 day test on any MBAM upgrade (which enlarges the amount of affected users) even though a user has quit the test period before and choose "i do not need real time protection". You might want to save this in the registry, please!

 

[Mark_L]

One of the early posters, I disabled web protection, and have not had a freeze since. Ransomware protection has been enabled the entire time.

[LAVA]

1 hour ago, robhab said:

There appears to be two different themes playing out in this thread:

1. Discussions concerning a technical fix for the freeze problem caused by Malwarebytes (MB) - which is the intended original purpose of this thread

2. Opinions about how MB  staff has handled/mishandled the problem so far - essentially a customer service and PR debate that is also a valid customer concern. 

Both themes are very important to MB and its customers. I am confident the Ms. Elena Verna (SVP, Product & Growth) and Mr. Raj Mallempati (SVP of Marketing) at MB are keenly interested in customer opinion and how this particular problem is affecting MB's reputation and future sales.  I would like to add my personal comments on the customer service aspects that directly affected me, and my evolving impression of the company as it wrestles with this most difficult fix.  I think thoughtful comments may be helpful.  However, I don't want to muck up the technical discussion here.  Further,  the technical folks at MB,  who are responding to technical comments here, are exactly the wrong folks to be responding to consumer concerns/rants.  That job takes a special skill set not often found among programmers.  Could the forum moderators please start a separate thread to discuss customer opinion on how this freeze problem has been handled by the company so far.   And direct those comments to the second thread.  This way, the two themes can be separated. 

If the moderators are not comfortable doing this, I am happy to start the second topic thread - just point me to the right place in this forum.

Thanks - and good luck on the fix.        

At this point, 1 & 2 are no longer mutually exclusive... It's been 5 weeks.

Had they made the issue known to their subscription base in a timely manner, they might have more data to analyze the problem.

A quick search reveals users who have been struggling with 'freezing' for 3+ weeks, and yet have no clue as to the cause:

SevenForums
BleepingComputer
TomsHardware
answers.microsoft

etc.

[exile360]

So after testing for a while with Web Protection disabled and Ransomware Protection disabled, here are my findings:

• Installed .NET monthly preview update, a def update for MSE and an update for Silverlight
• Rebooted and Malwarebytes took several minutes to start and prevented one of my system startup programs (Hotkey Control Center; a hardware control/overclocking app for Clevo laptops like mine) from starting
• I terminated Control Center via Task Manager and tried launching it again
• After around 30 seconds it finally launched at the same time the Malwarebytes tray icon showed up
• It looks like Malwarebytes was having trouble starting and was preventing Control Center from launching; this is an issue I've never encountered before today (not coincidentally I have Ransomware Protection enabled and Web Protection disabled where I usually have it the other way around with Ransomware disabled and Web Protection enabled) and experienced no issues whatsoever running the system with Malwarebytes configured that way.
• I also keep self-protection disabled though I don't know if that is related or not.
• I replicated the issue by shutting down and later starting my system again.
• This time I waited and after Control Center threw an error that the system needed to be restarted for it to run, I created dump files of its process as well as MBAMService.exe (mbamtray wasn't running yet)
• After waiting for a few minutes mbamtray finally loaded along with Control Center (again, simultaneously as before) with the tray icon showing up at the same time as the Control Center UI

Dumps were too large for the forums so I've uploaded them here.

I'm glad I didn't have to force the system to shut down, but obviously it's still not ideal.  I also noticed that every time I'm shutting down the system MBAMService takes much longer when Ransomware Protection is enabled to shut down (I have verbose shutdown/logoff/logon messaging enabled so I see it taking longer than usual during the Malwarebytes service shutting down phase).

[buckyswider]

Also, a totally anecdotal observation:  Not always, but a large percentage of my hangs seemed to be at or very near the top of the hour (like :00, :01, :02).  I didn't track this, so it may just be Clustering Illusion, but I thought I'd throw it out there anyway.  And the amount of spam email these days helped form this observation also- I'd come home/wake up to a frozen PC, and after I power cycled, I could see the timestamp on the last received email...so for instance the last one was 4:58, and after outlook again started pulling down new messages the next one would be like 5:02.

Again not scientific, and may just be a false observation, but it was enough to cause me to scour logs and the windows scheduler to see if I could find any task or messages that happened at the top of the hour.  

[BillJohnson]

I have Windows 7 Professional 64 Bit, running on a high end PC with dual 8 core processors at 2.4Ghz.  After the recent update of Malwarebytes, my computer has been continually hanging up, and freezing with no end in sight.  Today I uninstalled Malwarebytes completely, and am going to have to rely on the Microsoft Security Essentials until they fix this problem.  After the uninstall, my computer runs perfectly with zero issues....    Very frustrating, as I don't want to rely on Microsoft's firewall alone to protect my PC.  Can someone at Malwarebytes notify me when there is an update that fixes this freezing up problem?   Thanks in advance.  

[magnetman]

47 minutes ago, BillJohnson said:

I have Windows 7 Professional 64 Bit, running on a high end PC with dual 8 core processors at 2.4Ghz.  After the recent update of Malwarebytes, my computer has been continually hanging up, and freezing with no end in sight.  Today I uninstalled Malwarebytes completely, and am going to have to rely on the Microsoft Security Essentials until they fix this problem.  After the uninstall, my computer runs perfectly with zero issues....    Very frustrating, as I don't want to rely on Microsoft's firewall alone to protect my PC.  Can someone at Malwarebytes notify me when there is an update that fixes this freezing up problem?   Thanks in advance.  

They are really dragging their feet on this I have 4 separate computers doing this.