Jump to content
bdg2

MalwareBytes 4 messing with IPv6 ping

Recommended Posts

A few weeks ago both my 64 bit Windows 7 PCs lost the ability to ping external IPv6 addresses.

For a while I blamed my ISP until I discovered IPv6 ping worked fine from a Linux machine.

Now I have investigated and discovered that MBAMService.exe is the cause of the problem.

If I kill MBAMService.exe I can ping until MBAMService.exe finishes automatically restarting when IPv6 ping stops working again.

Please can this be fixed.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved

C:\Users\Brian G>cd \

C:\>
C:\>
C:\>
C:\>ping -t -6 one.one.one.one

Pinging one.one.one.one [2606:4700:4700::1111] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from 2606:4700:4700::1111: time=7ms          <---- I killed MBAMService.exe with task manager a moment before this point
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.

 

Share this post


Link to post
Share on other sites

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  1. Download Malwarebytes Support Tool
  2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
  3. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  4. Place a checkmark next to Accept License Agreement and click Next
  5. You will be presented with a page stating, "Get Started!"
  6. Click the Advanced tab on the left column

    mbst_get_started.jpg
     
  7. Click the Gather Logs button

    mbst_advanced_gather_logs.jpg
     
  8. A progress bar will appear and the program will proceed with getting logs from your computer

    mbst_getting_logs.jpg
     
  9. Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK

    mbst_log_saved_desktop.jpg
     
  10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:

     notify me.jpeg  

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

mb_attach.jpg.220985d559e943927cbe3c078b
 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/hc/en-us/articles/360038523934

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

Share this post


Link to post
Share on other sites
46 minutes ago, bdg2 said:

If I kill MBAMService.exe I can ping until MBAMService.exe finishes automatically restarting when IPv6 ping stops working again.

What happens when you just disable web protection. It seems to be a known issue and a fix is being worked on from what I read.

Could you run the following batch file as Administrator and provide the generated output (saved to the Desktop) please?

-----

If your testing indicates that Web Protection is likely the culprit, it would be useful to generate some additional troubleshooting data.

  • Open Malwarebytes > Settings > Enable the Event log data setting.
  • Enable Web Protection.
  • Wait for the issue to occur.
  • Once the issue has occurred:
    • Rerun the batch file from earlier and attach the file.
    • Run the Malwarebytes Support Tool and gather logs.
    • Make a note of any significant events/actions that took place prior to the issue occurring.
Edited by Porthos

Share this post


Link to post
Share on other sites

Yes!

Switching Web Protection off fixes the problem.

Output from your batch file is attached.

The output is completely independent of whether or not Web Protection is enabled.

Just the line with the current time of day in it changes.

 

ipconfig_result.txt ipconfig_result.txt

Share this post


Link to post
Share on other sites

Extra information:

When it's not working it's as if the TTL on the outgoing pings is changed to a really low value.

I can ping things on my LAN by their public IPv6 address but not anything out on the Internet.

Share this post


Link to post
Share on other sites

@bdg2 Until a fix is released, you can turn off notifications so you do not get bugged all the time.

Also I suggest if you have not already, install the browser guard for Firefox and Chrome based browsers.

Turn off notifications.png

Edited by Porthos

Share this post


Link to post
Share on other sites

Thank you for the report. We have a defect filed for this issue and hope to have a fix available in the future.

Regarding workarounds, you also have the option of reverting to an earlier component package version, which will allow you to keep Web Protection enabled.
You can download this from here: https://malwarebytes.box.com/s/z6cravnwptrzx5tyjw36jq6zt6c7apsx

Once installed, you will need to disable the two update options found in Settings -> General -> Application updates to prevent the product from updating back to the affected version.

Share this post


Link to post
Share on other sites

I have the same issue, I even submitted a support ticket. This is manifesting on two computers at home and the symptoms are pretty much the same, except it also breaks a lot of web pages for me, I believe the browser tries to open the page using IPV6 and it never completes the connection. disabling web protection fixes the issue.

when I have WebProt enabled IPV6 pings to external addresses don't work.

Share this post


Link to post
Share on other sites
9 hours ago, DiReis said:

I have the same issue, I even submitted a support ticket. This is manifesting on two computers at home and the symptoms are pretty much the same, except it also breaks a lot of web pages for me, I believe the browser tries to open the page using IPV6 and it never completes the connection. disabling web protection fixes the issue.

when I have WebProt enabled IPV6 pings to external addresses don't work.

Interesting. I'm not aware of much else failing. I'm running dual stack so I might not notice if some websites can't connect via IPv6 because the fallback to IPv4 is fairly quick with most browsers.

Maybe you're on an IPv6 only network with NAT64 and DNS64 or a similar arraignment outside your network providing your access to IPv4. AIUI in that case there is normally no fallback to IPv4 when IPv6 fails.

Share this post


Link to post
Share on other sites
10 hours ago, bdg2 said:

Interesting. I'm not aware of much else failing. I'm running dual stack so I might not notice if some websites can't connect via IPv6 because the fallback to IPv4 is fairly quick with most browsers.

Maybe you're on an IPv6 only network with NAT64 and DNS64 or a similar arraignment outside your network providing your access to IPv4. AIUI in that case there is normally no fallback to IPv4 when IPv6 fails.

From what I understand I'm using Dual Stack also. I've done those ipv6 test pages and all came up correctly.

my guess is it is messing with the packages but most gets through.. that's why not ALL my pages fail to load, but it very frequently.

for pings though.. all gets dropped.. no replies just like your case.

Share this post


Link to post
Share on other sites

Hi all,

Thank you for your patience with this issue. We are still working on this and hope to make a fix available in a future update.

In the meantime, if you would prefer not to leave Web Protection disabled, you can revert to an earlier version of Malwarebytes that does not contain this issue. See this post for details.

Share this post


Link to post
Share on other sites
On 2/20/2020 at 1:09 PM, LiquidTension said:

Hi all,

Thank you for your patience with this issue. We are still working on this and hope to make a fix available in a future update.

In the meantime, if you would prefer not to leave Web Protection disabled, you can revert to an earlier version of Malwarebytes that does not contain this issue. See this post for details.

Will you post here when the fix is available?

Or will something about IPv6 pings appear in the "change log" in the post announcing the new version?

Share this post


Link to post
Share on other sites
Posted (edited)

Hello,

The forum announcement will mention IPv6. However, I will still post here to let you know when it's available.

Note that before we release to all users, it will most likely be made to beta update users first and announced in the forum section linked below.
https://forums.malwarebytes.com/forum/251-malwarebytes-4x-beta/

You can enable beta updates in Settings -> General.

Edited by LiquidTension

Share this post


Link to post
Share on other sites

Hello,

I'm running MBAM Premium, version 4.1.0.56, update package 1.0.21200, component package update 1.0.854. When Web Protection is turned on IPv6 pings still do not work. If I turn off Web Protection, IPv6 pings work as expected. Note, MBAM Web Protection is only blocking IPv6 pings. IPv4 pings work ok. In addition, other IPv6 traffic does not appear to be affected. I can connect to sites on the Internet that use IPv6 ok and the Xfinity Speed Test, which from my network defaults to testing via IPv6, works too.

This isn't a new issue. The first post about this problem appeared on the Forum almost two months ago. I hope that Malwarebytes will fix this soon.

Share this post


Link to post
Share on other sites

Seems to be a low priority for them 😒

Share this post


Link to post
Share on other sites

I had to disable IPV6 on my network to make sure it worked fine. I preferred doing that instead of disabling web protection.

Share this post


Link to post
Share on other sites

I've been a big fan of mbam for a while, and certainly don't like that I have to disable web protection for ipv6, I certainly hope this gets addressed sooner rather than later, hopefully that priority list is getting closer to addressing this issue.

Share this post


Link to post
Share on other sites

Just disable program updates and run the MB version linked in this message:

 

Share this post


Link to post
Share on other sites
On 3/26/2020 at 5:57 PM, Daggerheart said:

I've been a big fan of mbam for a while, and certainly don't like that I have to disable web protection for ipv6, I certainly hope this gets addressed sooner rather than later, hopefully that priority list is getting closer to addressing this issue.

Thank you for your patience. We hope to have this issue addressed as soon as possible.

We'll provide an update to the forum once we have more information to share.

Share this post


Link to post
Share on other sites

Still an issue here.  Been having trouble with IPv6 pings and thought it was my ISP until I realized it was only my primary computer.  Started turning off programs until I narrowed it down to MalwareBytes Web Protection.  Just opened a support case and then searched around to find this thread.

Share this post


Link to post
Share on other sites

Hello,

Thank you for the feedback. We apologise for the issue you're experiencing.

At this current time, the only known workaround is to keep Web Protection disabled. Once a fix is available, we will notify this thread.

Share this post


Link to post
Share on other sites

Beginning to lose my patience here.

You seem to be fixing new bugs before you fix this :(

Share this post


Link to post
Share on other sites
17 hours ago, bdg2 said:

Beginning to lose my patience here.

You seem to be fixing new bugs before you fix this :(

I would actually try the beta and see if it helps. If it does not...

Your only options are to keep web protection off or revert to an older build that does not have the issue.

But first I would like you to do a clean install with the Support tool. Just in case it will help.

Please do the following Uninstall and reinstall using the Malwarebytes Support Tool

Please have lots of patience with the tool.  The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up.   Please be patient and have faith.  Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install.

You also have the option of reverting to an earlier component package version, which will allow you to keep Web Protection enabled.
You can download this from here: https://malwarebytes.box.com/s/z6cravnwptrzx5tyjw36jq6zt6c7apsx

Once installed, you will need to disable the two update options found in Settings -> General -> Application updates to prevent the product from updating back to the affected version.

I suggest using the above clean install guide posted above if you want to go this route.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.