Jump to content

Another system freezing with latest update - 7x64

jaxman
 Share

Recommended Posts

  • Replies 92
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

mkaz

mkaz

Posted
Posted

I am very disappointed that Malwarebytes is not owning this from a communication standpoint and that it takes forum members to keep each other updated.  Thank goodness for forum member support!  I expected at a minimum that Malwarebytes would would be pinned something acknowledging that there is an issue, they are working on a solution, etc..  There is nothing here: https://forums.malwarebytes.com/forum/41-malwarebytes-3-support-forum/

It is as if there is an internal policy that they can never let the public know they messed up.  I for one appreciate honesty and can be accepting of some rare issues as long as I see the ownership and the communication is out quickly.  I can't imagine how many individuals without knowledge of this forum have spent countless hours trying to identify the source of the issue, lost documents they were working on, re-installed the OS only to see the issue re-occur, etc.

There are Norton haters out there and I am not promoting Norton, but at least they will own an issue.  They will pin the issue here, in the case of Norton Security: https://community.norton.com/en/forums/norton-security

And an example of a thread with clear involvement from Staff supporting identification of issues leading towards resolution: https://community.norton.com/en/forums/hot-issues-and-fixes

This may be the 2nd or 3rd major issue I've witnessed with Malwarebytes and I can't think of a time where they owned the communication letting users know of the issue, that they are working on a fix, and finally that the fix was out.  If I am incorrect, feel free to point out an example I may have missed where they communicated quickly from beginning to end.

Link to post
Share on other sites
dcollins

dcollins

Posted
Posted

Sorry for the lack of response so far. Our engineering teams have been working hard to try and replicate this issue so we can understand what's going on and get a solution in place. This issue looks to affect a very small subset of users (less than 1%), couple that with the nature of the issue (the entire machine locking up), and this is a very difficult issue for us to reproduce and understand exactly what's causing. That being said, even though it's only happening to a small number of users, we obviously still want to find a solution for those users who are impacted. As such, if you have not already provided logs, can you please follow the instructions below to gather some logs for us so we can try to understand what is happening:

  1. Download and run the Malwarebytes Support Tool
  2. Do not click on Start Repair
  3. Click on Advanced on the left side and then click Gather Logs
  4. This process will take a few minutes and once completed, it will put a zip file on your desktop named mbst-grab-results.zip
  5. Please upload that zip file in your response

While we have logs from our users so far, getting logs from multiple users helps us see what similarities there are between these computers to understand what's going on. Thanks in advanced, and we will do our best to make sure we're staying more responsive.

Link to post
Share on other sites
mkaz

mkaz

Posted
Posted

Great question @loco!  I can't tell you how many forums I review where this is a pact response, "only less than 1%"....

@dcollins, I do appreciate your involvement now and hope you will keep us updated on a frequent basis.  There are too many threads open, so perhaps you can create one pinned location and direct us all there.  I'll see what I logs I can get to you, but the fact you are requesting logs at this time, as weeks have gone by now with complaints,  is disappointing.  Is the team struggling trying to find a solution?  

Link to post
Share on other sites
dcollins

dcollins

Posted
Posted

Thank you for the logs. There is another set of logs that would help as well if possible, but it's a bit more involved.

  1. Download and extract the attached RUNME.zip
  2. Right click on RUNME.bat inside the extracted folder and choose Run as Administrator
  3. Choose Option 1 and press Enter
    1. This will enable driver verifier for our web protection module and turn on a complete memory dump instead of just a kernel memory dump
  4. Reboot 
  5. Turn on Web Protection, and use your computer as normal until it freezes again.
  6. Once the computer freezes, it should cause a blue screen.
  7. After rebooting, copy C:\Windows\memory.dmp to your desktop.
  8. Right click on memory.dmp on your desktop and choose Send to -> Compressed (Zipped) folder. This should create a file named memory.zip
  9. Upload the zip file to wetransfer.com and provide the link in your response
  10. Once completed, you can then redo steps 2, 3 and 4, but this time choose Option 2 to change things back to default

RUNME.zip

Link to post
Share on other sites
torus_ot

torus_ot

Posted
Posted
1 hour ago, dcollins said:

Thanks. I understand that second set of logs will require some work and not everyone will be comfortable with purposefully causing their computer to lock up again. Any information we can gather at this point will help a lot.

Devin

I cannot find mwac.sys in my system32/drivers folder...

So this line in your script AFAIUnderstand will fail: 

verifier /standard /driver mwac.sys > NUL 2>&1

 

Link to post
Share on other sites
torus_ot

torus_ot

Posted
Posted
24 minutes ago, bashbish said:

There is no BSOD. Just what amounts to a screenshot just before the freeze. No mouse,no keyboard,no ctrl/alt/del. Then only choice is hard reboot. 

It is true, but the script in the Devin's file will supposedly triggers windows into creating _full_ memory dump with BSOD. We will see.

Link to post
Share on other sites
dcollins

dcollins

Posted
Posted (edited)
41 minutes ago, bashbish said:

There is no BSOD. Just what amounts to a screenshot just before the freeze. No mouse,no keyboard,no ctrl/alt/del. Then only choice is hard reboot.

The script I provided should cause a blue screen instead of a system freeze.

17 minutes ago, torus_ot said:

Devin

I cannot find mwac.sys in my system32/drivers folder...

So this line in your script AFAIUnderstand will fail: 


verifier /standard /driver mwac.sys > NUL 2>&1

 

You will need Web Protection to be enabled inside of Malwarebytes for mwac.sys to be there

1 hour ago, boombastik said:

it is possible that the freeze exist with nics that have driver protocol ndis< 6.30?

This is one of the things we've been trying to research (specific drivers, NIC cards, etc) and haven't been able to reproduce so far

Edited by dcollins
Link to post
Share on other sites
torus_ot

torus_ot

Posted
Posted

Devin

I 

a) enabled Web and Ransomware protection (yes, mvac.sys has appeared in system32/drivers folder)

b) run your script, rebooted

c) and left computer running (outlook 2016, scype, etc)

But in the morning computer was in freeze state, no responses to keyboard or mouse and NO BSOD!

I hard rebooted and check windows folder, just in case, - no memory.dump file.

I do understand this type of bug is very hard to find, 'cause I do this for living...  PM sent

 

Link to post
Share on other sites
robhab

robhab

Posted
Posted

I do not allow Microsoft Win 7 pro 64 updates to my system as a matter of policy after three separate auto updates bricked my system.

However I do allow MSE updates... and the freezes on my system started after the MSE virus definitions were updated.

I don't know if this is significant, but thought I should report it.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.