Jump to content

Hanging at Welcome Screen.

RTL434

By RTL434
in Malwarebytes 4.x Beta

 Share

Recommended Posts

RTL434

RTL434

Posted
Posted

Have been having problems with my main PC when powering on. After I enter my PIN, it sits at the Welcome Screen with the "5 spinning dots". I then press reset and it boots up and runs with no problems. I had noticed at least on two occasions that the system time was wrong in the tray and corrected it. Date was fine and no other BIOS settings were being lost or altered. 

Yesterday I replaced the motherboard battery--old one was 2.58V. Problem still exists. Didn't expect that to fix it but eliminated it anyway.

I then set the boot log option. I booted the PC at 18:54, waited and then reset. It now came up O.K. Looking at the log it showed the last entry as being:-

\??\C:\WINDOWS\system32\DRIVERS\mbam.sys.

I then used the PC with no problems. I also set the "Enhanced Event Log Data" in MWB before powering off.

Today, I powered up at 07:34. I left it for 1 minute before I pressed the reset. It came up O.K. after that and I am currently using it. Have run the Support Tool to gather the logs and am also attaching the bootlog file.

Before I try other things, my next step would be to revert to MWB 3.8.3 but will hold fast until I hear back from you.

My other two desktops and laptop are fine. One desktop and laptop are connected via the same Netgear Gigabit Switch to the Router as this PC. Am also currently running this PC with Fast Startup off. The problem existed with it on but I'm getting lots of Windows being not shut down properly and wanted to see if that was fixed by the option being off.

 

mbst-grab-results.zip ntbtlog.txt

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted (edited)

Hi @RTL434,

Have you confirmed Malwarebytes version 4 is responsible by disabling it from starting up with Windows?

Please try the following:

  • Open Malwarebytes.
  • Click Settings.
  • Click Security.
  • Scroll down to Windows Startup.
  • Turn the, "Launch Malwarebytes in the background..." setting off.

If you've since turned Fast Startup back on, please exit out of Malwarebytes completely by right-clicking the tray app (in the Notification Area/System Tray) and clicking Quit Malwarebytes.

Reboot the computer and check if the delay/hang at the welcome screen is still exhibited.

Edited by LiquidTension
Link to post
Share on other sites
RTL434

RTL434

Posted
  • Author
Posted

Fast Startup is still off.  I had an appointment earlier and had to go out. When I powered up the PC on my return at 12:44, I couldn't enter my PIN.  I reset the PC and it came up as usual.  Then I got the email to say you had responded.  Did as you requested and after disabling MB4 I rebooted the PC. Came up right away. Attaching the bootlog file.  

System Tray.png

ntbtlog_1339.txt

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Thanks for confirming. Please reverse the change you made to the startup setting in Malwarebytes.

Let's see if we can narrow down the culprit as it is likely a Real-Time Protection module (e.g. Ransomware Protection) is responsible.

  • Open Malwarebytes.
  • On the Dashboard, turn the four Real-Time Protection modules off.
  • Reboot the computer.
  • Is the login delay still exhibited?
  • If it isn't, return to Malwarebytes and enable one of the Real-Time Protection modules.
  • Repeat until the culprit is identified.


Please let me know which Real-Time Protection module is responsible (if any).

Link to post
Share on other sites
RTL434

RTL434

Posted
  • Author
Posted

Tried earlier to find the module but was getting varied results---losing internet, hanging etc. Anyway had a fresh attempt at 19:00  Looks like it is the Malware Protection module that is causing the problem.  I have attached my findings in the attached zip file.  Hope it makes sense!! Have left the Malware Protection module OFF for the time being.

RTL_MWB_Problem.zip

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted (edited)

Thanks very much for the information, @RTL434. If you don't mind troubleshooting further, it would be helpful to collect some additional data on the issue.

Please re-enable the enhanced event log data setting in Malwarebytes.
Run Process Monitor and configure it to capture a boot log. Instructions can be found here: https://support.malwarebytes.com/docs/DOC-1515

Reproduce the issue. Afterwards, please provide the following data:

  • A new mbst-grab-results.zip generated by the Malwarebytes Support Tool log gathering.
  • The PML log files generated by Process Monitor. Please zip these files up and attach the zip file (or upload to a file hosting service of your choice).
  • System, Application and Security event logs (instructions below).
    • Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
    • Expand Windows Logs.
    • Right-click Application and click Save All Events As.... Name the file application and click OK.
    • Repeat for Security and System.
    • Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
    • Name the Zip file EventLogs.zip and attach the file in your next reply.

 

-----

After providing the above data, it would also help to identify if the cause of this is related to interaction between Malwarebytes and other software you have installed.
Please see what impact a clean boot has. Instructions can be found here: https://support.microsoft.com/en-gb/help/929135/how-to-perform-a-clean-boot-in-windows

When disabling services, ensure Malwarebytes Service is left enabled (checked) and Malware Protection is enabled in the user interface. Then reboot the machine and check if the delay/hang still occurs.

Edited by LiquidTension
Link to post
Share on other sites
RTL434

RTL434

Posted
  • Author
Posted

Have done as requested and files are attached.  As a matter of interest, on the 24th. August I installed MWB 4.0.1.31. On the 27th. August I updated Macrium Reflect from 7.2.4235 to 7.2.4440. I can't say for definite when my problem arose but all machines are on these same levels. Only this one is exhibiting the problem but it is the one I use most.  Anyway, I will now try a Clean Boot  and report back.

Seems there is a limit for uploading a file.  Will need to create a shared folder either using OneDrive or BT Cloud.  Will PM you the link for the  Proc Mon Zip file.

Troubleshooting sequence.docx EventLogs.zip.zip mbst-grab-results.zip

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hi @RTL434,

Thanks for the information.
 

Quote

I know it says that you can do an update to the beta from 3.8.3 but was thinking of trying this again but this time do a Clean first with the tool and remove 3.8.3. Then install the beta.  What do you think?

It wouldn't hurt to try, but will most likely not make a difference.

Could you try the delay Real-Time Protection setting and see what impact this has:

  • Open Malwarebytes.
  • Click Settings.
  • Click Security.
  • Click Advanced under Windows Startup.
  • Turn on the, "Delay Real-Time Protection..." setting.
  • Try out different time settings (15 seconds, 30 seconds, etc).
Link to post
Share on other sites
RTL434

RTL434

Posted
  • Author
Posted
7 hours ago, LiquidTension said:

Could you try the delay Real-Time Protection setting and see what impact this has:

  • Open Malwarebytes.
  • Click Settings.
  • Click Security.
  • Click Advanced under Windows Startup.
  • Turn on the, "Delay Real-Time Protection..." setting.
  • Try out different time settings (15 seconds, 30 seconds, etc).

@LiquidTension Hello,well I tried it several times and it started to come up but then the mouse froze! On one occasion I left it sitting there and suddenly it burst into life. Icons I had clicked on earlier fired up. The time lag was in minutes!!  I had set the delay at various settings but was currently at 60 secs.  Using my phone, I had started a video when I  hit the Enter key.    This was at 20:26.  I was double-clicking the following icons after the Protection had come on and obviously before the mouse freezing:- CCleaner, Nextbase and Procexp64. You'll see from the video up until the mouse froze.  The picture after that was the jobs now fired up.  I took another video at 21:40 with the delay at 30 seconds. Came up and eventually the Protection was enabled. I then clicked on the same icons as before, None of them fired up and at 1 min 54 secs. into the video, the freeze occurs. Left it. At approximately 4 mins. 18 secs. into the video it all comes good. Am attaching the logs and will PM you a link to the videos.  In the videos, I kept going to the MWB icon and you'll see it going from "Protection Disabled"  to Enabled.  

     Once it's up I don't have any problems--so far.

mbst-grab-results.zip

Link to post
Share on other sites
RTL434

RTL434

Posted
  • Author
Posted

@LiquidTension  I think I hit a wrong key!!    Anyway I think I have found what my problem is.  Yesterday I tried removing  startup items to see if they were the culprit but at one stage I couldn't set MP ON. Could reset the others and set them back on. Could change various options but got an error when I tried to scan. At that stage I took an image after running the logs so that I could return there later. Tonight, I restored back to it. I then did a Clean with the tool and 3.8.3 got loaded. Had to activate my licence but that went o.k.  Adjusted my scan schedule time and ran a scan. Then I updated to 4.0.1. and changed the language to U.K.  Also set Event Log.  Ran a scan. AOK.

Then I removed some more Startup items but the problem persisted.  Looking at my notes, I noticed that a couple of times after a Power Down the PC came back up o.k.  It was only after a restart that it had the problem that needed a reset before it came up. Now  3.8.3 worked fine like that, MWB doesn't seem to like a restart---at least on this machine.

I have done a sequence of Pwr/Down then up four times with success. I then did a Restart and it needed a reset to come up. After it came up, I then did a further 3 Pwr/Down then up ---all successful.

I'll run the log in case it helps before I restore back to my setup at 18:00.   Will attach the logs for Sept. 10th in case you want to see why  I couldn't set MP. (Windows has obviously been installing updates while I've been playing with this as it just threw a notification  out about a restart which I will ignore.)

Fast Startup is currently ON but it was happening with it off as well. Also I knocked off the Delay Real Protection and it worked fine.

Right that's me, am going to restore back.

              

mbst-grab-results_10th_Sept.zip Files.zip mbst-grab-results.zip

Link to post
Share on other sites
RTL434

RTL434

Posted
  • Author
Posted

@LiquidTension    Restored  back to normal.  Updated Windows and did an "Update & Shutdown" as opposed to a Restart,  Came up and now at 18352.356. Set MP ON. Powered off and then on. Came up fine.  Did a further two and no problems. Did a Restart and the problem is there. Reset and it came up. Did a further two PD/PU's and they were fine.

So it definitely looks like a Restart is what screws it up-----only on 4.0.1!    Will do further checks tomorrow as time is getting on. Didn't bother running the tool for the logs as the previous entry logs should have the data.

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hi @RTL434,

Thanks again for the latest information.

Have you tried a scenario where Malware Protection is on, only Malwarebytes Service is enabled as a startup item and the machine is restarted? Do you still see the hang with this scenario?

It will be useful for us to obtain a memory dump captured when the machine is in the hung state. We can accomplish this by forcing a blue screen.
Start by ensuring complete/full memory dumps are enabled: https://www.tenforums.com/tutorials/5560-configure-windows-10-create-minidump-bsod.html

Then proceed with the steps below.

  • Download enable_forced_bsod.reg using the link below:
    → https://malwarebytes.box.com/s/8rxpxrwm4jmdz95dg5p1kudymdl4vtzm
  • Open your Downloads folder or location of the downloaded enable_forced_bsod.reg file.
  • Double-click enable_forced_bsod.reg and click Run followed by Yes if prompted by AVOiBNU.jpg User Account Control.
  • Click Yes when prompted to continue.
  • Click OK.
  • Restart your computer.
     

Once the machine is in the hung state, hold down the rightmost Ctrl key on your keyboard and press the Scroll Lock key twice.

This will force your machine to blue screen. After the computer has rebooted, open the C:\Windows folder and verify a file named MEMORY.dmp is present.
Right-click MEMORY.dmp and click Send to followed by Compressed (zipped) folder. If prompted to save the file to your Desktop, click Yes.
Upon completion, upload the Zip file to a file hosting service of your choice and provide a download link in your next reply.

Link to post
Share on other sites
RTL434

RTL434

Posted
  • Author
Posted

Update.  On Saturday 14th. Sept. I removed 4.0.1 and reverted to 3.8.3 as I wasn't sure what would happen in the meantime if I received Windows Updates and they got screwed up because of the restart problem.  Ran like that until the 20th.---no problems. On Friday the 20th. a new version was shared in private and that fixed the problem.  Still running on it and restarted numerous times.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.