Jump to content

Scan File System keep running

kcarlasc
 Share

Recommended Posts

  • Staff
Malwarebytes

Malwarebytes

Posted
  • Staff
Posted

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  1. Download Malwarebytes Support Tool
  2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
  3. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  4. Place a checkmark next to Accept License Agreement and click Next
  5. You will be presented with a page stating, "Get Started!"
  6. Click the Advanced tab on the left column
    0. UI.png
  7. Click the Gather Logs button
    17. Advanced.png
  8. A progress bar will appear and the program will proceed with getting logs from your computer
    19. System Repair Progress.png
  9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
  10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
     notify me.jpeg  

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

mb_attach.jpg.220985d559e943927cbe3c078b
 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

Link to post
Share on other sites
exile360

exile360

Posted
Posted

Greetings,

Thank you for reporting this issue.  Multiple users have reported this problem recently and the team is investigating the issue.  Hopefully they will find a solution soon, but in the meantime you can try running a scan in Safe Mode to see if it is able to complete that way.

Also, if you suspect that you may be infected you may try running ADWCleaner as well as Malwarebytes Anti-Rootkit and if signs of infection still persist you should read and follow the instructions in this topic and then create a new topic in the malware removal area including the requested logs and info by clicking here and one of our malware removal specialists will assist you in checking and clearing your system of any remaining threats.

I hope this helps, and if there is anything else we might assist you with please let us know.

Thanks

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted (edited)

Hi @kcarlasc,

Could you try disabling Windows hibernation, reboot and then check if this has any impact or not.
https://support.microsoft.com/en-gb/help/920730/how-to-disable-and-re-enable-hibernation-on-a-computer-that-is-running

What type of scan are you running and with what scan configuration? If you run a different type of scan, does it also hang?

-----

Please do the following:

  • Open Malwarebytes.
  • Click Settings.
  • Enable the Event Log Data setting.
     

MgeHyNE.png Generate MBAMService Memory Dump

  • Please download run_procdump.bat using the link below.
    → https://malwarebytes.box.com/s/e127cj2ppb2lq6njf67li2gls3kbfz24
  • Open your Downloads folder.
  • Double-click CX41PDv.png run_procdump.bat. Click Yes if prompted by AVOiBNU.jpg User Account Control.
  • Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
  • A blue window will appear.
  • When prompted to reboot, type Y into the window and press Enter on your keyboard.
  • After your computer has rebooted, please do the following:
    • Reproduce the scan hang and wait until it's clear the scan has hung.
  • Once done, open your Downloads folder and double-click the run_procdump.bat file once more.
  • Upon completion, a file named HSPwQfy.png memorydump.zip will be saved to your Desktop. Please attach the file in your next reply.
  • Note: If the file is too large, you will be provided instructions to upload the file to a file hosting website (wetransfer.com).


Afterwards, please run the Malwarebytes Support Tool once more. Click Advanced, followed by Gather Logs and attach the new mbst-grab-results.zip.

Edited by LiquidTension
Link to post
Share on other sites
exile360

exile360

Posted
Posted

Self-protection should prevent you from terminating the service manually (it's also highly unstable to stop a service that way by force terminating it).  I'm not sure why the dump isn't working, and I don't think it needs to stop the service to do so as it should just be copying the process's contents from memory to a dump file which can be done while a process is still active and continues running (I've verified this by creating process dumps using Task Manager on active running services and processes, including MBAMService.exe), though the service's hung state might be hanging up other processes and that may be why the dump creation is failing.

Is there any sort of error message when the dump process fails?

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted (edited)

@kcarlasc It sounds like you're reproducing the scan hang and then running the batch file for the first time. This won't work as MBAMService is already in the hung state.

The batch file needs to be run when Malwarebytes is fully functional. You will then be prompted to reboot. After the reboot, you need to reproduce the scan hang and then run the batch file for a second time, which will generate the dump for you.

Task Manager cannot be used in Windows 10 due to MBAMService running as a protected service.

Edited by LiquidTension
Link to post
Share on other sites
exile360

exile360

Posted
Posted
40 minutes ago, LiquidTension said:

Task Manager cannot be used in Windows 10 due to MBAMService running as a protected service.

Interesting, I was not aware of this.  I guess since clicking 'Show processes from all users' has been replaced with the new 'Users' menu, it doesn't provide the option or any way to show processes that run under the SYSTEM user/account like MBAMService.exe does.  I guess I get why from a security perspective, but that's a real downer for anyone trying to fully monitor and manage all tasks and processes on their systems.

Oh well, thanks for the info :) 

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted (edited)
16 hours ago, exile360 said:

Interesting, I was not aware of this.  I guess since clicking 'Show processes from all users' has been replaced with the new 'Users' menu, it doesn't provide the option or any way to show processes that run under the SYSTEM user/account like MBAMService.exe does.  I guess I get why from a security perspective, but that's a real downer for anyone trying to fully monitor and manage all tasks and processes on their systems.

Oh well, thanks for the info :) 

The option is still present in Task Manager. Processes running under the context of the SYSTEM account can be seen in the Processes and Details tab.

The issue is that on Windows 10, tools such as Task Manager, Process Explorer, ProcDump, etc do not sufficient privileges to open MBAMService in normal circumstances and therefore cannot generate a memory dump.

Edited by LiquidTension
Link to post
Share on other sites
arbrich

arbrich

Posted
Posted

Have had same issue with several PCs I am running into for customers when doing system maintenance. Could not stop the scan. Ended up restarting the computers and the one just ran the scan and was fine.

The other is very old so will check back later for that one.

Will keep checking and see if I see any patterns.

 

Link to post
Share on other sites
arbrich

arbrich

Posted
Posted

It was both Windows 7 and Windows 10 machines.

I do not have anytime access to the machines as they are in production. If I can reproduce the problem when doing maint I will run the tool and send to you.

Like I said above after a restart things seemed to go back to normal - I think it may be something to do with malwarebytes updating it self (" Install Application updates") - That is just a guess.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.