Jump to content

Recommended Posts

Please try disabling the Ransomware Protection component to see if that helps.  If it does not, then please open Malwarebytes and navigate to Settings>Protection and toggle the option Enable self-protection module under Startup Options to Off and see if that eliminates the issue.

Apologies, I just saw that you already tried disabling self-protection so you may ignore that part of my instructions.

Anyway, if none of the instructions so far have helped, then please try performing a clean installation by following the instructions below:

  1. Download and run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here

You should also verify that fast startup is disabled.  Details on how to do so may be found here and here.  The fast startup feature in Windows 10 has been known to cause issues with Malwarebytes and other software due to how Microsoft implemented it.

Please let us know how it goes and if the issue persists.

Thanks

Edited by exile360
Link to post
Share on other sites

Thanks.

Has no effect though. I think I have reinstalled before this way as the clean up tool was on my machine from 10th.

The only thing I haven't done before is disable Fast Startup. It adds 20secs to startup time now.

At the moment MBAM is running with everything at default settings and Fast Startup disabled.

I noticed the Windows Event log lists MwacLib.dll as the source. But you probably already know that.

I tried the process monitor bat file again but now it will not run, appears to just exit out. Not generating a dump. Difficult to tell visually but appears to exit on
START %PD_EXE% %PD_SWITCH% %MB_EXE% and then wait for a key press

I've since disabled self protected, rootkit scan and ransomware protect. Hasn't worked though.

Les

 

Link to post
Share on other sites

OK, that helps.  MwacLib.dll is a file component of the Web Protection module, so at least that helps to further isolate where the issue is, so if you haven't yet, I'd recommend trying disabling Web Protection to see if that eliminates the issue assuming disabling fast startup didn't correct it (though it may have as we have seen many issues with protection/startup related to that before which is why we so often mention it).

Please keep us posted on how things are going and I'm sure LiquidTension will have further instructions for you soon.

Link to post
Share on other sites

Well yes as I have said many times in these posts, that's what I am watching - usually 49-98 at a time every 15-20 mins or so. I posted one and explained what happened in my very first post here but no one has asked to see them before!

 

Link to post
Share on other sites

Hmm, it sounds like maybe it's happening as a consequence of some automated background task given the frequency.  That makes me suspect Kaspersky, as I don't know of any background task that Malwarebytes performs at that interval (updates are set to the default hourly rate according to your logs for Malwarebytes).  Have you already followed the instructions in this support article to see if that corrects the problem?  If not, then please do so.  I'm also aware of this support article which recommends removing Kaspersky completely, however I do not believe that is necessary any longer as I know of several users running Kaspersky alongside Malwarebytes without any issues (though they likely have exclusions configured between the two as you now do).

Link to post
Share on other sites

I think you need to go back and read previous posts else all I am doing is repeating myself over and over. Again, KAS has been disabled and removed several times but makes no difference.  And I cannot locate any processes that occur at the same time as the errors.

Les

Link to post
Share on other sites
3 hours ago, exile360 said:

Sorry, I saw where you mentioned it had been disabled, but I didn't see where you said you'd removed it.  My apologies.

Just to be sure I have uninstalled it again, restarted, and its hasn't been running for some hours now. Crashes continue unabated though...

Link to post
Share on other sites

OK, thanks.  It might help to get some of the Event Viewer logs just in case there's one or more related issues happening as it might give them a clue as to what might be causing this so please do the following if you wouldn't mind; this tool will grab some of your most recent Event Viewer logs:

Post Event Logs:

  • Please download VEW by Vino Rosso from here and save it to your desktop
  • Right-click the file and select Run as administrator and click Continue or Allow at the User Account Control Prompt.
  • Click the check boxes next to Application and System located under Select log to query on the upper left
  • Under Select type to list on the right, click the boxes next to Error, Warning, and Critical (not XP)
  • Under Number or date of events select Number of events and type 20 in the box next to 1 to 20 and click Run
  • Once it finishes it will display a log file in notepad

  • Please copy and paste its entire contents into your next reply, or if you prefer you may save the text file to a convenient location and zip and attach it instead

Thanks

Link to post
Share on other sites

Nope, not really.  It just prints out the last few of them to one of its logs.  The tool I posted above is much more comprehensive.

It also may prove helpful to have Malwarebytes output its verbose logs when the issue is occurring to see if it reveals anything helpful.  To enable it, open Malwarebytes and navigate to Settings>Application and toggle the option under Event Log Data to On then restart the system and wait for at least one crash to occur, then run the Malwarebytes Support Tool again to have it gather the logs then attach the archive to your next reply:

  1. Download and run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

I'm hoping that it will be able to log more details about what's going on with the service/drivers etc. when the crash is happening which might help the Devs in figuring out the cause and possibly help LiquidTension as well in troubleshooting further.

Link to post
Share on other sites

Ok tried that but fails after nearly 5 minutes of running saying it can't find the file it was supposed to create. It won't show the entries I have been referring to though as they are all informational. Plus as I said earlier, I clear the application log every morning so there will only be today's.

Link to post
Share on other sites
9 minutes ago, exile360 said:

Nope, not really.  It just prints out the last few of them to one of its logs.  The tool I posted above is much more comprehensive.

It also may prove helpful to have Malwarebytes output its verbose logs when the issue is occurring to see if it reveals anything helpful.  To enable it, open Malwarebytes and navigate to Settings>Application and toggle the option under Event Log Data to On then restart the system and wait for at least one crash to occur, then run the Malwarebytes Support Tool again to have it gather the logs then attach the archive to your next reply:

 

  1. Download and run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

 

I'm hoping that it will be able to log more details about what's going on with the service/drivers etc. when the crash is happening which might help the Devs in figuring out the cause and possibly help LiquidTension as well in troubleshooting further.

That request sounds very familiar and I have already done this!! See posts #31-#33 but not the other change you are requesting, Will do  but this is all very disruptive to my workflow....

Les

 

Link to post
Share on other sites

He asked for a screenshot of Event Viewer but I don't believe you ever provided it, and besides, that tool I posted above will collect much more than just those particular events so it could be far more helpful diagnostically speaking.

You can take your time and do it whenever you have a free moment.  You don't need to interrupt anything important for this.  I'm just trying to help get the problem figured out and solved.

Edited by exile360
Link to post
Share on other sites

I'm now getting these new events today I know not why. MBAM itself isn't showing any errors with everything running. KIS is not running. Current version reinstalled a couple of days ago with defaults

And these are actual errors, not advisories like all the others. They are marked Kernel-EventTracing

Session "MBAMWebProtection" failed to start with the following error: 0xC0000035

Session "MBAMSwissArmy" failed to start with the following error: 0xC0000035

The Malwarebytes Service service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Faulting application name: mbamservice.exe, version: 3.2.0.704, time stamp: 0x5b9acf90
Faulting module name: MwacLib.dll, version: 3.1.0.519, time stamp: 0x5bf5a81f
Exception code: 0xc0000005
Fault offset: 0x000000000003d28d
Faulting process ID: 0x1efc
Faulting application start time: 0x01d4af0e580fcd6b
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe

Session "MBAMSwissArmy" failed to start with the following error: 0xC0000035

The Malwarebytes Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

The Malwarebytes Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

and so on...

The advisories continue as before

I think I'll just give up....

Les

Link to post
Share on other sites

A new beta build was just released which includes fixes for issues related to protection, in particular Web Protection.  That may be worth a try to see if it corrects the problem if you're willing to give it a shot.  If so, it can be found here.

Link to post
Share on other sites

Well that's a bummer :(

It was worth a try anyway.  Hopefully the memory dumps and data that LiquidTension collected for the Developers will prove helpful.  I'm sorry that we haven't been able to solve this problem so far.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.