MalwareBytes 4 messing with IPv6 ping

bdg2 · February 8, 2020

A few weeks ago both my 64 bit Windows 7 PCs lost the ability to ping external IPv6 addresses.

For a while I blamed my ISP until I discovered IPv6 ping worked fine from a Linux machine.

Now I have investigated and discovered that MBAMService.exe is the cause of the problem.

If I kill MBAMService.exe I can ping until MBAMService.exe finishes automatically restarting when IPv6 ping stops working again.

Please can this be fixed.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved

C:\Users\Brian G>cd \

C:\>
C:\>
C:\>
C:\>ping -t -6 one.one.one.one

Pinging one.one.one.one [2606:4700:4700::1111] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from 2606:4700:4700::1111: time=7ms          <---- I killed MBAMService.exe with task manager a moment before this point
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=6ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Reply from 2606:4700:4700::1111: time=7ms
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Malwarebytes · February 8, 2020

This is an automated reply

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

Download Malwarebytes Support Tool
Once the file is downloaded, open your Downloads folder/location of the downloaded file
Double-click mb-support-X.X.X.XXXX.exe to run the program
- You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
Place a checkmark next to Accept License Agreement and click Next
You will be presented with a page stating, "Get Started!"
Click the Advanced tab on the left column
Click the Gather Logs button
A progress bar will appear and the program will proceed with getting logs from your computer
Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK
Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:

Click "Reveal Hidden Contents" below for details on how to attach a file:

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

mb_attach.jpg.220985d559e943927cbe3c078b

One of our experts will be able to assist you shortly.

If you are having licensing issues, please do the following:

Spoiler

For any of these issues:

Renewals
Refunds (including double billing)
Cancellations
Update Billing Info
Multiple Transactions
Consumer Purchases
Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/hc/en-us/articles/360038523934

Thanks in advance for your patience.

-The Malwarebytes Forum Team

bdg2 · February 8, 2020

Results from support tool mb-support-1.5.4.760.exe attached:

mbst-grab-results.zip

Porthos · February 8, 2020

46 minutes ago, bdg2 said:

If I kill MBAMService.exe I can ping until MBAMService.exe finishes automatically restarting when IPv6 ping stops working again.

What happens when you just disable web protection. It seems to be a known issue and a fix is being worked on from what I read.

Could you run the following batch file as Administrator and provide the generated output (saved to the Desktop) please?

-----

If your testing indicates that Web Protection is likely the culprit, it would be useful to generate some additional troubleshooting data.

Open Malwarebytes > Settings > Enable the Event log data setting.
Enable Web Protection.
Wait for the issue to occur.
Once the issue has occurred:
- Rerun the batch file from earlier and attach the file.
- Run the Malwarebytes Support Tool and gather logs.
- Make a note of any significant events/actions that took place prior to the issue occurring.

Edited February 8, 2020 by Porthos

bdg2 · February 8, 2020

Yes!

Switching Web Protection off fixes the problem.

Output from your batch file is attached.

The output is completely independent of whether or not Web Protection is enabled.

Just the line with the current time of day in it changes.

ipconfig_result.txt ipconfig_result.txt

Porthos · February 9, 2020

2 hours ago, bdg2 said:

Output from your batch file is attached.

I will tag @LiquidTension and @nikhils to examine your logs.

bdg2 · February 9, 2020

Extra information:

When it's not working it's as if the TTL on the outgoing pings is changed to a really low value.

I can ping things on my LAN by their public IPv6 address but not anything out on the Internet.

Porthos · February 9, 2020

@bdg2 Until a fix is released, you can turn off notifications so you do not get bugged all the time.

Also I suggest if you have not already, install the browser guard for Firefox and Chrome based browsers.

Edited February 9, 2020 by Porthos

LiquidTension · February 10, 2020

Thank you for the report. We have a defect filed for this issue and hope to have a fix available in the future.

Regarding workarounds, you also have the option of reverting to an earlier component package version, which will allow you to keep Web Protection enabled.
You can download this from here: https://malwarebytes.box.com/s/z6cravnwptrzx5tyjw36jq6zt6c7apsx

Once installed, you will need to disable the two update options found in Settings -> General -> Application updates to prevent the product from updating back to the affected version.

DiReis · February 19, 2020

I have the same issue, I even submitted a support ticket. This is manifesting on two computers at home and the symptoms are pretty much the same, except it also breaks a lot of web pages for me, I believe the browser tries to open the page using IPV6 and it never completes the connection. disabling web protection fixes the issue.

when I have WebProt enabled IPV6 pings to external addresses don't work.

bdg2 · February 20, 2020

9 hours ago, DiReis said:

I have the same issue, I even submitted a support ticket. This is manifesting on two computers at home and the symptoms are pretty much the same, except it also breaks a lot of web pages for me, I believe the browser tries to open the page using IPV6 and it never completes the connection. disabling web protection fixes the issue.

when I have WebProt enabled IPV6 pings to external addresses don't work.

Interesting. I'm not aware of much else failing. I'm running dual stack so I might not notice if some websites can't connect via IPv6 because the fallback to IPv4 is fairly quick with most browsers.

Maybe you're on an IPv6 only network with NAT64 and DNS64 or a similar arraignment outside your network providing your access to IPv4. AIUI in that case there is normally no fallback to IPv4 when IPv6 fails.

DiReis · February 20, 2020

10 hours ago, bdg2 said:

Interesting. I'm not aware of much else failing. I'm running dual stack so I might not notice if some websites can't connect via IPv6 because the fallback to IPv4 is fairly quick with most browsers.

Maybe you're on an IPv6 only network with NAT64 and DNS64 or a similar arraignment outside your network providing your access to IPv4. AIUI in that case there is normally no fallback to IPv4 when IPv6 fails.

From what I understand I'm using Dual Stack also. I've done those ipv6 test pages and all came up correctly.

my guess is it is messing with the packages but most gets through.. that's why not ALL my pages fail to load, but it very frequently.

for pings though.. all gets dropped.. no replies just like your case.

LiquidTension · February 20, 2020

Hi all,

Thank you for your patience with this issue. We are still working on this and hope to make a fix available in a future update.

In the meantime, if you would prefer not to leave Web Protection disabled, you can revert to an earlier version of Malwarebytes that does not contain this issue. See this post for details.

bdg2 · February 29, 2020

On 2/20/2020 at 1:09 PM, LiquidTension said:

Hi all,

Thank you for your patience with this issue. We are still working on this and hope to make a fix available in a future update.

In the meantime, if you would prefer not to leave Web Protection disabled, you can revert to an earlier version of Malwarebytes that does not contain this issue. See this post for details.

Will you post here when the fix is available?

Or will something about IPv6 pings appear in the "change log" in the post announcing the new version?

LiquidTension · March 2, 2020

Hello,

The forum announcement will mention IPv6. However, I will still post here to let you know when it's available.

Note that before we release to all users, it will most likely be made to beta update users first and announced in the forum section linked below.
https://forums.malwarebytes.com/forum/251-malwarebytes-4x-beta/

You can enable beta updates in Settings -> General.

Edited March 2, 2020 by LiquidTension

moraga695 · March 22, 2020

Hello,

I'm running MBAM Premium, version 4.1.0.56, update package 1.0.21200, component package update 1.0.854. When Web Protection is turned on IPv6 pings still do not work. If I turn off Web Protection, IPv6 pings work as expected. Note, MBAM Web Protection is only blocking IPv6 pings. IPv4 pings work ok. In addition, other IPv6 traffic does not appear to be affected. I can connect to sites on the Internet that use IPv6 ok and the Xfinity Speed Test, which from my network defaults to testing via IPv6, works too.

This isn't a new issue. The first post about this problem appeared on the Forum almost two months ago. I hope that Malwarebytes will fix this soon.

bdg2 · March 25, 2020

Seems to be a low priority for them 😒

DiReis · March 25, 2020

I had to disable IPV6 on my network to make sure it worked fine. I preferred doing that instead of disabling web protection.

Daggerheart · March 26, 2020

I've been a big fan of mbam for a while, and certainly don't like that I have to disable web protection for ipv6, I certainly hope this gets addressed sooner rather than later, hopefully that priority list is getting closer to addressing this issue.

bdg2 · March 27, 2020

Just disable program updates and run the MB version linked in this message:

LiquidTension · March 31, 2020

On 3/26/2020 at 5:57 PM, Daggerheart said:

I've been a big fan of mbam for a while, and certainly don't like that I have to disable web protection for ipv6, I certainly hope this gets addressed sooner rather than later, hopefully that priority list is getting closer to addressing this issue.

Thank you for your patience. We hope to have this issue addressed as soon as possible.

We'll provide an update to the forum once we have more information to share.

MallocArray · April 28, 2020

Still an issue here. Been having trouble with IPv6 pings and thought it was my ISP until I realized it was only my primary computer. Started turning off programs until I narrowed it down to MalwareBytes Web Protection. Just opened a support case and then searched around to find this thread.

LiquidTension · May 1, 2020

Hello,

Thank you for the feedback. We apologise for the issue you're experiencing.

At this current time, the only known workaround is to keep Web Protection disabled. Once a fix is available, we will notify this thread.

bdg2 · May 2, 2020

Beginning to lose my patience here.

You seem to be fixing new bugs before you fix this

Porthos · May 2, 2020

17 hours ago, bdg2 said:

Beginning to lose my patience here.

You seem to be fixing new bugs before you fix this

I would actually try the beta and see if it helps. If it does not...

Your only options are to keep web protection off or revert to an older build that does not have the issue.

But first I would like you to do a clean install with the Support tool. Just in case it will help.

Please do the following Uninstall and reinstall using the Malwarebytes Support Tool

Please have lots of patience with the tool. The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up. Please be patient and have faith. Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install.

You also have the option of reverting to an earlier component package version, which will allow you to keep Web Protection enabled.
You can download this from here: https://malwarebytes.box.com/s/z6cravnwptrzx5tyjw36jq6zt6c7apsx

Once installed, you will need to disable the two update options found in Settings -> General -> Application updates to prevent the product from updating back to the affected version.

I suggest using the above clean install guide posted above if you want to go this route.

MalwareBytes 4 messing with IPv6 ping

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

***This is an automated reply***

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information

This is an automated reply