Another Windows 7 x64 freeze after the 1.0.508 update

[LiquidTension]

Hi everyone,

Thanks for sharing your feedback with us! We're working hard towards finding a solution for this issue.

It'd be very helpful if the following instructions could be carried out on machines exhibiting the freeze/lock up. This will provide data on the state of the processes running up until the system freeze and help us track down the source of the issue.

• Please download PSList.zip using the link below.
  → https://malwarebytes.box.com/shared/static/jrbrzr4rpbu4rlstl4abq0ghglg24hov.zip
• Open your Downloads folder. Right-click  PSList.zip and click Extract All.... Ensure Show extracted files when complete is checked and click Extract.
• A folder will open. Open the PSList folder inside. Right-click PSList64.bat (use PSList.bat if you are running 32-bit Windows) and click Run as administrator.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A black console window will appear. Each second, a new text file will be written to the extracted PSList folder. 
• Please leave the console window open and wait for the machine to freeze/lock up.
• Once the machine has locked up, force a restart.
• After the machine has restarted, right-click the extracted PSList folder and click Send to followed by Compressed (Zipped) folder.
• Name the Zip file PSList-Output. Please attach PSList-Output.zip to a forum post.

Edited January 3, 2019 by LiquidTension

[arbrich]

Is there a way to know the date at which the component update was installed ??

As we have more and more people having this issue start I am trying to narrow it down to be the component update to see if the issues start after this latest auto update.

[exile360]

There should be a file called mbupdatr.log located under C:\ProgramData\Malwarebytes\MBAMService\logs that should show the date it was installed at the top if you open it.

[LiquidTension]

3 minutes ago, arbrich said:

Is there a way to know the date at which the component update was installed ??

As we have more and more people having this issue start I am trying to narrow it down to be the component update to see if the issues start after this latest auto update.

Hi arbrich,

You should find a file named mbupdatr.log in %programdata%\malwarebytes\MBAMService\logs. The modified date of the file will tell you when the components package was installed.

[Dave_H]

My system also has the Intel(R) 82579V Gigabit Network Connection.

ASUS P8Z77-V PRO, Intel CPU, Intel chipset.

But I can't disable the NIC, my accounting program uses the MAC as one of the hardware identifiers for activation.  I'm still closing out last year and can't go without it.

Dave

[COBKA]

12 hours ago, arbrich said:

Is there a way to know the date at which the component update was installed ??

As we have more and more people having this issue start I am trying to narrow it down to be the component update to see if the issues start after this latest auto update.

 

12 hours ago, LiquidTension said:

Hi arbrich,

You should find a file named mbupdatr.log in %programdata%\malwarebytes\MBAMService\logs. The modified date of the file will tell you when the components package was installed.

Having checked the log I see my update to component 1.0.508 was at 9:15 pm on the 11th Dec - 4 minutes after the WU Security Rollup completed! The first freeze was the next day - easy to see why either could have been blamed.

[LiquidTension]

1 hour ago, COBKA said:

Having checked the log I see my update to component 1.0.508 was at 9:15 pm on the 11th Dec - 4 minutes after the WU Security Rollup completed! The first freeze was the next day - easy to see why either could have been blamed.

Thank you for the information. To confirm, is that KB4471318?

If it is, would you be willing to temporarily uninstall this update and check if this has any impact on the freezing/lock ups? To do so:

• Click the Windows Start button. Type CMD in the search bar, right-click CMD and click Run as administrator.
• Copy and paste (right-click the Window + Paste) the following into the Command Prompt. Press Enter on your keyboard.
  
  wusa /uninstall /KB:4471318
   
• A Windows Update Standalone Installer window will appear and search for the update. You will either receive a message that states the update is not installed or be prompted to uninstall the update. If prompted to uninstall, please do so. When prompted to restart, please consent.
• After the restart, please monitor the computer and check if you continue to experience the freezing/lock ups.
   

KB4471318 can be manually reinstalled from the Windows Update Catalog:
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4471318

Edited January 4, 2019 by LiquidTension

[COBKA]

8 minutes ago, LiquidTension said:

Thank you for the information. To confirm, is that KB4471318?

If it is, would you be willing to temporarily uninstall this update and check if this has any impact on the freezing/lock ups? 

Yes to confirm that is the update.

At the moment I am running your batch file with Web Protection ON and after a couple of hours I have had no freezes. This is not necessarily unexpected as my problem has been very intermittent. My lock ups have been thus:-

12th Dec - twice , 20th Dec - once, 27th Dec - twice, 28th Dec - twice, 29th Dec - once - none since but with Web Protection OFF since 29th when I discovered MBAM could be part of the problem.

So you can see there have long periods without lock-ups anyway. I do shutdown the computer regularly but use it daily. 

For further information my wife's laptop froze yesterday for only the second time during this whole period and that is also used daily. It's at least 10 days since she experienced the problem and has never turned Web Protection OFF.

With respect to uninstalling the WU. Yes I would consider that option but given the intermittent periods between lock-ups (in my case) maybe that wouldn't tell us much in the short to medium term.

With respect to the batch file, I assume if no lock-ups during the period before shutdown, I simply x out of the CMD before shutdown and re-start the batch file after booting the PC back up?

 

 

[COBKA]

About 60 seconds after posting the previous message I had a freeze! Zip file attached. Hopefully it tells us something.

PSList-Output.zip

Interesting that there was probably about 20-30 seconds of disk activity after the freeze which I allowed to complete before re-booting.

[LiquidTension]

42 minutes ago, COBKA said:

Yes to confirm that is the update.

Thank you for confirming!
 

43 minutes ago, COBKA said:

For further information my wife's laptop froze yesterday for only the second time during this whole period and that is also used daily. It's at least 10 days since she experienced the problem and has never turned Web Protection OFF.

Does your wife's laptop also have KB4471318 installed?

If you don't mind sharing, what network adapters are installed on your computers? To check:

• Press the Windows Key + R on your keyboard at the same time. Type devmgmt.msc and click OK.
• Expand Network adapters.
   

50 minutes ago, COBKA said:

With respect to uninstalling the WU. Yes I would consider that option but given the intermittent periods between lock-ups (in my case) maybe that wouldn't tell us much in the short to medium term.

That's understandable. If you find the lockups become more frequent, we'd be very interested to hear the results of uninstalling KB4471318.
 

47 minutes ago, COBKA said:

With respect to the batch file, I assume if no lock-ups during the period before shutdown, I simply x out of the CMD before shutdown and re-start the batch file after booting the PC back up?

Yes, that's correct.
 

18 minutes ago, COBKA said:

Zip file attached. Hopefully it tells us something. 

Thank you very much!

[Ciff7]

Hi,

I have been running with the web protection module turned off, no system freezes since I did this, I turned it back back on to run your .bat file and within a minute or so the system froze, please find attached the file you requested, hope it helps,  

PSList-Output.zip

[COBKA]

1 hour ago, LiquidTension said:

Thank you for confirming!
 

Does your wife's laptop also have KB4471318 installed?

If you don't mind sharing, what network adapters are installed on your computers? To check:

• Press the Windows Key + R on your keyboard at the same time. Type devmgmt.msc and click OK.
• Expand Network adapters.
   

That's understandable. If you find the lockups become more frequent, we'd be very interested to hear the results of uninstalling KB4471318.
 

Yes, that's correct.
 

Thank you very much!

Ok there are 3 laptops in the family experiencing problems - all have the KB4471318 installed

1. Dell Precision M6600 for for which I sent the crash zip file has Intel (R) 82579LM Gigabit Network Connection, Intel (R) Centrino (R) Ultimate-N 6300 AGN and Microsoft Virtual WiFi Miniport Adapter - this has been the most affected and always connected by ethernet via Intel (R) 82579LM Gigabit Network Connection

2. Dell Precision M6700 has Intel (R) 82579LM Gigabit Network Connection, Intel (R) Centrino (R) Advanced-N 6205 and Microsoft Virtual WiFi Miniport Adapter - connected via Wifi Intel (R) Centrino (R) Advanced-N 6205 - 3 freezes on same network, 1 freeze on different network

3. Dell Latitude 3540 has Realtek PCIe GBE Family Controller, Dell Wireless 1705 802.11b/g/n , and Microsoft Virtual WiFi Miniport Adapter - connected via WiFi Dell Wireless 1705 802.11b/g/n - 2 freezes on different network.

[MajesticWi]

3 hours ago, LiquidTension said:

Thank you for the information. To confirm, is that KB4471318?

If it is, would you be willing to temporarily uninstall this update and check if this has any impact on the freezing/lock ups? To do so:

• Click the Windows Start button. Type CMD in the search bar, right-click CMD and click Run as administrator.
• Copy and paste (right-click the Window + Paste) the following into the Command Prompt. Press Enter on your keyboard.
  
  wusa /uninstall /KB:4471318
   

<snip>

Thanks for posting this information.  I will take the liberty of joining your test as well.  On my desktop it was intermittently locking up until 3 days ago when it started doing hard freeze once a day.  Yesterday it did it twice.  I have since uninstalled KB:4471318 and will let you know how it goes.

System:  Home built desktop.     MSI X99a Sli Plus motherboard  with Windows 7 Pro x64

No pattern to the freezes.  It has happened when I started a manual defrag, when opening FireFox to browse, after sitting idle (no suspend or hibernate, just screen saver) and when opening Windows Live Mail to name a few instances.

Thanks for your assistance!

 

[LiquidTension]

2 hours ago, Ciff7 said:

Hi,

I have been running with the web protection module turned off, no system freezes since I did this, I turned it back back on to run your .bat file and within a minute or so the system froze, please find attached the file you requested, hope it helps,  

PSList-Output.zip

Thanks!

Unfortunately, it looks like there's an issue with your system's performance counters.

Processor performance object not found

This needs to be fixed in order to utilise the PSList tool ran by the batch file. To do so:

• Click the Windows Start button. Type CMD in the search bar, right-click CMD and click Run as administrator.
• Copy and paste (right-click the Window + Paste) the following into the Command Prompt: lodctr /r
• Press Enter on your keyboard. Wait for the command to complete.
   

Once done, please delete the extracted PSList folder and try the earlier instructions again.

[LiquidTension]

2 hours ago, COBKA said:

Ok there are 3 laptops in the family experiencing problems - all have the KB4471318 installed

This is very helpful. Thank you once again!

[LiquidTension]

1 hour ago, MajesticWi said:

I have since uninstalled KB:4471318 and will let you know how it goes.

Great, thank you very much!

One other useful piece of information would be the names of the network adapters present. To check:

• Press the Windows Key + R on your keyboard at the same time. Type devmgmt.msc and click OK.
• Expand Network adapters.

[LiquidTension]

To anyone else in the topic - it would be a great help if you could provide the following information:

What network adapters are present on the affected machine? 

• Press the Windows Key + R on your keyboard at the same time. Type devmgmt.msc and click OK.
• Expand Network adapters.
   

Is the KB4471318 Windows Update installed on the affected machine?

• Press the Windows Key + R on your keyboard at the same time. Type cmd and click OK.
• Copy systeminfo | findstr KB4471318 and paste (right-click the window + Paste) into the Command Prompt window.
• Press Enter.
• If KB4471318 is printed back to the line below, the update is installed. If the line below is empty, the update is not installed.

For those willing, it would helpful to identify/rule out KB4471318 as the culprit by temporarily uninstalling the update from the machine. Instructions on how to so can be found below. Please let us know if this has any impact on the freezing/lock ups. Thank you!

• Click the Windows Start button. Type CMD in the search bar, right-click CMD and click Run as administrator.
• Copy and paste (right-click the Window + Paste) the following into the Command Prompt. Press Enter on your keyboard.
  
  wusa /uninstall /KB:4471318
   
• A Windows Update Standalone Installer window will appear and search for the update. You will either receive a message that states the update is not installed or be prompted to uninstall the update. If prompted to uninstall, please do so. When prompted to restart, please consent.
• After the restart, please monitor the computer and check if you continue to experience the freezing/lock ups.

[COBKA]

39 minutes ago, LiquidTension said:

For those willing, it would helpful to identify/rule out KB4471318 as the culprit by temporarily uninstalling the update from the machine. Instructions on how to so can be found below. Please let us know if this has any impact on the freezing/lock ups. Thank you!

• Click the Windows Start button. Type CMD in the search bar, right-click CMD and click Run as administrator.
• Copy and paste (right-click the Window + Paste) the following into the Command Prompt. Press Enter on your keyboard.
  
  wusa /uninstall /KB:4471318
   
• A Windows Update Standalone Installer window will appear and search for the update. You will either receive a message that states the update is not installed or be prompted to uninstall the update. If prompted to uninstall, please do so. When prompted to restart, please consent.
• After the restart, please monitor the computer and check if you continue to experience the freezing/lock ups.

Ok I am now running minus that update and Web Protection ON. I suspect that update will be superceded on patch Tuesday 08.01.2019 but will run a few days prior to that to see if I get a freeze regardless.

[Martholorax]

I am also experiencing this problem and I DO NOT have the KB4471318  installed.

[MajesticWi]

1 hour ago, LiquidTension said:

Great, thank you very much!

One other useful piece of information would be the names of the network adapters present. To check:

• Press the Windows Key + R on your keyboard at the same time. Type devmgmt.msc and click OK.
• Expand Network adapters.

My desktop uses the motherboard's network adapter which is.......

Intel(R) Ethernet Connection  I218-V 

 

Thanks again !

[JMac001]

1 hour ago, Martholorax said:

I am also experiencing this problem and I DO NOT have the KB4471318  installed.

Same here - that patch has not been installed on my computer. Since some do not have that patch installed it seems unlikely that could be the cause of the freezing.

Jim

[arbrich]

We ended up doing the following on a test system that was freezing consistently: I had listed this earlier in this thread and we were at 6 days.

We uninstalled the December Windows updates 

We installed a new NIC card (Realtech Chipset) in the machine
Loaded driver and made sure it worked online
I disabled the Intel Integrated NIC from the Windows 7 OS
I then uninstalled the same Intel NIC card from the Windows 7 OS being sure to check the box for deleting the driver
I then restarted the machine and went into the BIOS and System Configuration and Integrated NIC and Disabled it and restarted the system.

Our test system has been running now for almost 14 days without issue with MBAM (Component 1.0.508) fully activated, etc..

I have now switched back to the OLD Network Card (Intel I217-LM) - reinstalled the Windows updates for December and am running the PSLIST program to attempt to make it fail and collect logs.

I have another system same Model (Optiplex 9020) with same NIC card that has not locked up yet. - The only difference between systems is one is a Core I7 and the other is a Core I5 processor.

I will update all if I can make this thing freeze and get some data.

Of course all they systems that are freezing up now intermittently are in production with customers and I can't have them run the PSLIST capture program not to mention they are taking out entire small networks when the freeze is bad and the NIC card creates a network storm. So we are uninstalling Windows updates and MBAM Component Package to older version to see if that stops the problem. and they can keep working while I work with test systems.

This issue is affecting a lot more people that simply do not know what is going on with their systems yet. 

Thanks,

 

 

 

[plurple]

Win 7 64 bit  Malwarebytes Premium.

Having the same problem.   The Windows Security Rollup and Malwarebytes Component update both installed on December 12.  However I did not have the first freeze until December 17th or 18th.   Once it began it was several times a day.  After finding the threads on this issue, I turned off  Web Protection only  on December 19th.   Have not had a freeze since then.

[bashbish]

24 minutes ago, plurple said:

Win 7 64 bit  Malwarebytes Premium.

Having the same problem.   The Windows Security Rollup and Malwarebytes Component update both installed on December 12.  However I did not have the first freeze until December 17th or 18th.   Once it began it was several times a day.  After finding the threads on this issue, I turned off  Web Protection only  on December 19th.   Have not had a freeze since then.

FYI. I did not and will not Install the MS Roll-up .  Nevertheless, I have had the freezing issue since mid December. The freeze issue is very insidious. I have gone as long as a week without it and I have had it happen 5 times in a day and everything in between. My present strategy is to use Malwarebytes  only when I am on the internet or when I do a Scan. All other time I quit Malwarebytes  (right click and choose Quit Malwarebytes ). So far this has resulted in 1 or 2 freezes per day and sometimes none.

[arbrich]

8 minutes ago, bashbish said:

FYI. I did not and will not Install the MS Roll-up .  Nevertheless, I have had the freezing issue since mid December. The freeze issue is very insidious. I have gone as long as a week without it and I have had it happen 5 times in a day and everything in between. My present strategy is to use Malwarebytes  only when I am on the internet or when I do a Scan. All other time I quit Malwarebytes  (right click and choose Quit Malwarebytes ). So far this has resulted in 1 or 2 freezes per day and sometimes none.

Bashbish - if you have that many freezes please install the PSLIST Tool above and quoted bellow and follow the instructions and upload the data so they can try and figure out what is going on. That would be a great help to the community.

Thanks for your help.

 

23 hours ago, LiquidTension said:

Hi everyone,

Thanks for sharing your feedback with us! We're working hard towards finding a solution for this issue.

It'd be very helpful if the following instructions could be carried out on machines exhibiting the freeze/lock up. This will provide data on the state of the processes running up until the system freeze and help us track down the source of the issue.

• Please download PSList.zip using the link below.
  → https://malwarebytes.box.com/shared/static/jrbrzr4rpbu4rlstl4abq0ghglg24hov.zip
• Open your Downloads folder. Right-click  PSList.zip and click Extract All.... Ensure Show extracted files when complete is checked and click Extract.
• A folder will open. Open the PSList folder inside. Right-click PSList64.bat (use PSList.bat if you are running 32-bit Windows) and click Run as administrator.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A black console window will appear. Each second, a new text file will be written to the extracted PSList folder. 
• Please leave the console window open and wait for the machine to freeze/lock up.
• Once the machine has locked up, force a restart.
• After the machine has restarted, right-click the extracted PSList folder and click Send to followed by Compressed (Zipped) folder.
• Name the Zip file PSList-Output. Please attach PSList-Output.zip to a forum post.