Jump to content
jaxman

Another system freezing with latest update - 7x64

Recommended Posts

37 minutes ago, TempLost said:

Yes, all four protection modules on... 

Any other Windows software installed? In my case are Office 2016,  Silverlight, Visual Studio 2013?

 

Share this post


Link to post
Share on other sites

Hello TempLost,

Good for you not experiencing this "Bug". I went as long as a week PC on full time no problems. Thought it was  not affecting me, but alas it did.The random nature of this thing is insidious.

Continued good luck with this Bug not affecting you

 

Share this post


Link to post
Share on other sites

I am very disappointed that Malwarebytes is not owning this from a communication standpoint and that it takes forum members to keep each other updated.  Thank goodness for forum member support!  I expected at a minimum that Malwarebytes would would be pinned something acknowledging that there is an issue, they are working on a solution, etc..  There is nothing here: https://forums.malwarebytes.com/forum/41-malwarebytes-3-support-forum/

It is as if there is an internal policy that they can never let the public know they messed up.  I for one appreciate honesty and can be accepting of some rare issues as long as I see the ownership and the communication is out quickly.  I can't imagine how many individuals without knowledge of this forum have spent countless hours trying to identify the source of the issue, lost documents they were working on, re-installed the OS only to see the issue re-occur, etc.

There are Norton haters out there and I am not promoting Norton, but at least they will own an issue.  They will pin the issue here, in the case of Norton Security: https://community.norton.com/en/forums/norton-security

And an example of a thread with clear involvement from Staff supporting identification of issues leading towards resolution: https://community.norton.com/en/forums/hot-issues-and-fixes

This may be the 2nd or 3rd major issue I've witnessed with Malwarebytes and I can't think of a time where they owned the communication letting users know of the issue, that they are working on a fix, and finally that the fix was out.  If I am incorrect, feel free to point out an example I may have missed where they communicated quickly from beginning to end.

Share this post


Link to post
Share on other sites

Sorry for the lack of response so far. Our engineering teams have been working hard to try and replicate this issue so we can understand what's going on and get a solution in place. This issue looks to affect a very small subset of users (less than 1%), couple that with the nature of the issue (the entire machine locking up), and this is a very difficult issue for us to reproduce and understand exactly what's causing. That being said, even though it's only happening to a small number of users, we obviously still want to find a solution for those users who are impacted. As such, if you have not already provided logs, can you please follow the instructions below to gather some logs for us so we can try to understand what is happening:

  1. Download and run the Malwarebytes Support Tool
  2. Do not click on Start Repair
  3. Click on Advanced on the left side and then click Gather Logs
  4. This process will take a few minutes and once completed, it will put a zip file on your desktop named mbst-grab-results.zip
  5. Please upload that zip file in your response

While we have logs from our users so far, getting logs from multiple users helps us see what similarities there are between these computers to understand what's going on. Thanks in advanced, and we will do our best to make sure we're staying more responsive.

Share this post


Link to post
Share on other sites
7 minutes ago, dcollins said:

This issue looks to affect a very small subset of users (less than 1%)

How do you know that is less than 1% ???  It seems like whoever is on the forum is complaining somehow about this....

Share this post


Link to post
Share on other sites

Great question @loco!  I can't tell you how many forums I review where this is a pact response, "only less than 1%"....

@dcollins, I do appreciate your involvement now and hope you will keep us updated on a frequent basis.  There are too many threads open, so perhaps you can create one pinned location and direct us all there.  I'll see what I logs I can get to you, but the fact you are requesting logs at this time, as weeks have gone by now with complaints,  is disappointing.  Is the team struggling trying to find a solution?  

Share this post


Link to post
Share on other sites
14 minutes ago, dcollins said:

... As such, if you have not already provided logs, can you please follow the instructions below to gather some logs for us so we can try to understand what is happening...

I was waiting for that :)

mbst-grab-results.zip

Currently  Web and Ransomware protection is off...

Share this post


Link to post
Share on other sites

Thank you for the logs. There is another set of logs that would help as well if possible, but it's a bit more involved.

  1. Download and extract the attached RUNME.zip
  2. Right click on RUNME.bat inside the extracted folder and choose Run as Administrator
  3. Choose Option 1 and press Enter
    1. This will enable driver verifier for our web protection module and turn on a complete memory dump instead of just a kernel memory dump
  4. Reboot 
  5. Turn on Web Protection, and use your computer as normal until it freezes again.
  6. Once the computer freezes, it should cause a blue screen.
  7. After rebooting, copy C:\Windows\memory.dmp to your desktop.
  8. Right click on memory.dmp on your desktop and choose Send to -> Compressed (Zipped) folder. This should create a file named memory.zip
  9. Upload the zip file to wetransfer.com and provide the link in your response
  10. Once completed, you can then redo steps 2, 3 and 4, but this time choose Option 2 to change things back to default

RUNME.zip

Share this post


Link to post
Share on other sites

Thanks. I understand that second set of logs will require some work and not everyone will be comfortable with purposefully causing their computer to lock up again. Any information we can gather at this point will help a lot.

Share this post


Link to post
Share on other sites

There is no BSOD. Just what amounts to a screenshot just before the freeze. No mouse,no keyboard,no ctrl/alt/del. Then only choice is hard reboot.

Share this post


Link to post
Share on other sites
1 hour ago, dcollins said:

Thanks. I understand that second set of logs will require some work and not everyone will be comfortable with purposefully causing their computer to lock up again. Any information we can gather at this point will help a lot.

Devin

I cannot find mwac.sys in my system32/drivers folder...

So this line in your script AFAIUnderstand will fail:

verifier /standard /driver mwac.sys > NUL 2>&1

 

Share this post


Link to post
Share on other sites
24 minutes ago, bashbish said:

There is no BSOD. Just what amounts to a screenshot just before the freeze. No mouse,no keyboard,no ctrl/alt/del. Then only choice is hard reboot. 

It is true, but the script in the Devin's file will supposedly triggers windows into creating _full_ memory dump with BSOD. We will see.

Share this post


Link to post
Share on other sites
41 minutes ago, bashbish said:

There is no BSOD. Just what amounts to a screenshot just before the freeze. No mouse,no keyboard,no ctrl/alt/del. Then only choice is hard reboot.

The script I provided should cause a blue screen instead of a system freeze.

17 minutes ago, torus_ot said:

Devin

I cannot find mwac.sys in my system32/drivers folder...

So this line in your script AFAIUnderstand will fail:


verifier /standard /driver mwac.sys > NUL 2>&1

 

You will need Web Protection to be enabled inside of Malwarebytes for mwac.sys to be there

1 hour ago, boombastik said:

it is possible that the freeze exist with nics that have driver protocol ndis< 6.30?

This is one of the things we've been trying to research (specific drivers, NIC cards, etc) and haven't been able to reproduce so far

Edited by dcollins

Share this post


Link to post
Share on other sites

Devin

a) enabled Web and Ransomware protection (yes, mvac.sys has appeared in system32/drivers folder)

b) run your script, rebooted

c) and left computer running (outlook 2016, scype, etc)

But in the morning computer was in freeze state, no responses to keyboard or mouse and NO BSOD!

I hard rebooted and check windows folder, just in case, - no memory.dump file.

I do understand this type of bug is very hard to find, 'cause I do this for living...  PM sent

 

Share this post


Link to post
Share on other sites

Thanks for the feedback, we weren't 100% sure this would cause a BSOD or a memory dump. Hopefully a few more people can chime in and provide feedback before we rule this method out entirely, but we'll keep researching for alternatives as well.

Share this post


Link to post
Share on other sites

I do not allow Microsoft Win 7 pro 64 updates to my system as a matter of policy after three separate auto updates bricked my system.

However I do allow MSE updates... and the freezes on my system started after the MSE virus definitions were updated.

I don't know if this is significant, but thought I should report it.

Share this post


Link to post
Share on other sites

Thanks for the added info, we are still looking for a solution at this time so any added info is helpful

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.