Jump to content

Mbamservice.exe crashes - LesH2


Recommended Posts

Same problem  here.. Crashes/restarts 6 times per second all day long at frequent intervals on three different Windows 10 (1803) PCs...

Have reinstalled latest version but no change.

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: mbamservice.exe
P2: 3.2.0.704
P3: 5b9acf90
P4: MwacLib.dll
P5: 3.1.0.519
P6: 5bf5a81f
P7: c0000005
P8: 000000000003d28d
P9:
P10:

and

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: mbamtray.exe
P2: 3.1.0.1662
P3: 5c070ada
P4: Qt5Core.dll
P5: 5.11.1.0
P6: 5bd23201
P7: c0000005
P8: 001a86be


And the diagnostics file is attached...

Thanks in advance.

Les

mb-check-results.zip

 

Just to add that I had Kaspersky running I think in the data above but have subsequently disabled it but this has had no effect. I'll add the exclusions list I found on your site.

Les

 

I also notice that on my main PC every time the long list of crashes starts the very first entry at the same time is:

Fault bucket , type 0
Event Name: MoOsMitigation
Response: Not available
Cab Id: 0

Problem signature:
P1: Microsoft.MicrosoftEdge_42.17134.1.0_neutral__8wekyb3d8bbwe
P2: praid:MicrosoftEdge
P3: 11.0.17134.1
P4: 6b6a1aef
P5: StackHash_6017
P6: 0.0.0.0
P7: 00000005
P8: PCH_5A_FROM_win32u+0x00000000000021A4
P9: c000001c
P10: 000000000000008c

 

Link to post
Share on other sites

Hi Les,

Thank you for reporting the issue.

It looks like you used our legacy MB-Check tool to generate the diagnostic file. Please could you run the latest version of Malwarebytes Support Tool and provide the generated mbst-grab-results.zip.

Instructions here: https://forums.malwarebytes.com/topic/190532-having-problems-using-malwarebytes-please-follow-these-steps/

Link to post
Share on other sites

Hi

Thanks.

Well I used the tool from the top of this post if that is now 'Legacy'? May I suggest you remove that info to avoid others wasting their time using it?

Since I posted I've added the exclusions to Kaspersky and restarted the machine but still happening frequently...

The latest version is now attached.

Les

mbst-grab-results.zip

Link to post
Share on other sites

This topic is from 2017; in the future I'd recommend creating a new topic of your own, even if it seems like the same issue because often times completely different issues/circumstances can cause seemingly identical symptoms/problems, especially since there have been many Malwarebytes versions released since this topic was created over a year ago.  I understand you were just expressing the fact that you seem to be dealing with the same issue and seeking help, but unfortunately the solutions for each may be very different.

Normally an automated reply would respond asking for logs using the correct/latest version of the support tool, however it only replies when you create a new topic in this area, so because you responded to another user's thread, the bot did not reply to you.

Link to post
Share on other sites

Well Dec 26th 2017 so only a year ago..... 😉

So do I need to post it yet again as a new topic then?

I just spotted on a Win 8.1 PC here that runs 24/7 that there were 126 instances of MBAM running in task manager! They were all suspended and unkillable, command line or otherwise. No other indication that anything was wrong though. I'd guess that it's been like that for about 32 days. Restarted machine and all is okay (I'm not reporting that as a problem tho unless it happens again) and I'll post it as a new topic if so.

Thanks

Les

Link to post
Share on other sites

No, there's no need for a new topic, I just meant in the future if any other issue comes up.  The fact that this topic is so old is why the outdated version of the tool is linked to in the posts above, because they pre-date the latest support tool.  LiquidTension will take care of you and should be able to help you resolve or at least work around the issue you're having with the software.

As for the other issue you mentioned, all those instances, that's a new one on me.  Maybe somehow a scheduled task ran away or something executing tons of instances into memory trying to initiate an update or scan, but it's definitely a unique one to me as I don't recall ever hearing about an issue like that with Malwarebytes before.  Whatever caused it, hopefully it was a one-off and won't happen again, but yes, definitely report it if it does happen again.

Link to post
Share on other sites

Thank you for the information.
 

Quote

I just spotted on a Win 8.1 PC here that runs 24/7 that there were 126 instances of MBAM running in task manager! They were all suspended and unkillable, command line or otherwise.

Is this machine also running a Kaspersky product? If so, Kaspersky is likely the cause. For this machine, could you try performing the workaround listed in the following article linked and check if the issue persists or not: https://support.malwarebytes.com/docs/DOC-2324

-----


On the Windows 10 machine with mbamservice.exe crashing, let's obtain a crash dump. Please do the following:

Ky7CZ60.png Disable Malwarebytes Self-Protection Module

  • Open Malwarebytes.
  • Click the Settings menu.
  • Click the Protection tab.
  • Scroll down to Startup Options and turn the Enable self-protection module setting GOWNe2m.png Off.
     

MgeHyNE.png ProcDump (Crash Dump)

  • Please download procdump.zip using the link below.
    https://malwarebytes.app.box.com/s/7gdfv6it0xsgu1mzbt3dbbyjcg7kguep
  • Open your Downloads folder.
  • Right-click HSPwQfy.png procdump.zip and click Extract All... followed by Extract.
  • Open the extracted procdump folder inside your Downloads folder.
  • Right-click CX41PDv.png 4 - mbamservice_crash.bat and select AVOiBNU.jpg Run as administrator to run the file.
  • Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
  • A black Command Prompt window should appear.
  • Reproduce the issue if possible or wait for mbamservice.exe to crash. Once mbamservice.exe crashes, the Command Prompt will close.
  • Return to the procdump folder. Inside you should now find a file with a .dmp extension.
  • Right-click the .dmp file and click Send to followed by Compressed (zipped) folder.
  • This will create a ZIP file in the folder. Please attach the Zip file in your next reply.
Edited by LiquidTension
Link to post
Share on other sites

I notice that event manager reports the process as mbamservice.exe  and not MBAMService.exe. Task Mgr says MBAMService.

When I tried to kill off the processes on the other machine it had to be MBAMService else it couldn't find it as mbamservice.

The cmd window says waiting for process named mbamservice.exe.

Probably not relevant but...

The original exceptions have just appeared again in the monitor window. They do not coincide with any crashes...

Les

 

Link to post
Share on other sites

Still no dump file despite continuing crashes/restarts. I did try mbamservice_kernel.bat and that does work as expected generating two dump files. I doubt they will help you as the system was running normally at the time. Modifying the case of the process has no beneficial effect in mbamservice.bat

Les

Link to post
Share on other sites

For LiquidTension

I think I may have to abandon MBAM  on this machine (Dell T5610 2 Proc 40 effective cores, 48GB memory) if there are no suggestions on sorting this problem out. My 'best' set of crashes as reported here so far is over 200 in a contiguous  40 second period.. It has a detrimental effect on performance  now.

I have tried running after a reboot with as  little loaded as possible but it still happens.

The monitoring program always gives the not found errors which is presumably why it never gets kicked off.

Are the crash dumps not of any use?

Thanks

Les

 

Link to post
Share on other sites

Hi Les,

Thanks for your patience. We're taking a look at the dump files you provided.

In the meantime, please could you add the Kaspersky exclusions and apply the settings change referenced in the earlier link if you've yet to do so:
https://support.malwarebytes.com/docs/DOC-2324

Reboot the computer afterwards (ensure you use the Restart option; not Shut down) and check if there is any change.

Link to post
Share on other sites

2 minutes ago, LiquidTension said:

Hi Les,

Thanks for your patience. We're taking a look at the dump files you provided.

In the meantime, please could you add the Kaspersky exclusions and apply the settings change referenced in the earlier link if you've yet to do so:
https://support.malwarebytes.com/docs/DOC-2324

Reboot the computer afterwards (ensure you use the Restart option; not Shut down) and check if there is any change.

I assume you mean the other machine where MBAM hung - I did that at the the time and it's been running fine ever since.

Thanks for any upcoming ideas on solving the current problems!

Les

Link to post
Share on other sites

Hi Les,
 

Quote

I assume you mean the other machine where MBAM hung - I did that at the the time and it's been running fine ever since.

I was referring to the Windows 10 machine (named JUPITER) that the mbst-grab-results.zip from post #3 belongs to. Have Kaspersky Internet Security exclusions been configured along with the configuration change on this machine? If not, please start with this and check if there is any change after a reboot.

Link to post
Share on other sites

Sorry, yes I that was all done a while back as I think I said.  Probably not before those crash dumps and for a while I had stopped Kaspersky anyway but I assume you can see whether it was running at the time of those dumps. Unless the problem with the batch file can be solved I have no way of inducing a dump though.

Just checked and there was another crash dump made this morning but that wasn't induced by the bat process as it isn't running.

Les

MBAMService_exe.10284.dmp

Link to post
Share on other sites

Thanks Les. The crash dumps provided point to a Web Protection module as the culprit. We've had issues various issues with Web Protection in components package version 1.0.508.

To confirm if this is the case, please could you revert to the previous components package version.

  • Download the setup file from the following link: https://malwarebytes.box.com/s/xq78v2de2k893g1h41upzbtqmsc6t375
  • Run the downloaded setup file to over-the-top install the earlier version. This will remove the current version and install the earlier.
  • Note: Once installed, verify Malwarebytes Premium is activated by confirming "Malwarebytes Premium" is displayed on the Dashboard.
  • To prevent the program from automatically updating to the latest affected version, do the following:
    • Open Malwarebytes for Windows and click Settings.
    • Ensure the Application tab is selected.
    • Under Application Updates, toggle the 'Automatically download and install application component updates' setting off.


After carrying out the steps above, please check if MBAMService continues to crash or not.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.