Malwarebytes Tray App Crashing

[Eyetap]

Seems the same happens to me as well - and I could notice this on more than one machine.

So far I usually managed to observe this behavior after starting Malwarebytes, initiating a scan right away and closing Malwarebytes again afterwards via the system tray icon. Still this doesnt show up always - and I haven't found when or when not.

Having tried to repair via the Malwarebytes Support tool (at the other machine) this didn't help for long at least.

Please find attached the logs gathered through the Malwarebytes Support tool as well as a generated Dump.

Here what the Windows Application log tells:

-

System

- Provider       [ Name] Application Error

- EventID 1000       [ Qualifiers] 0

Level 2

Task 100

Keywords 0x80000000000000

- TimeCreated       [ SystemTime] 2020-03-08T09:38:53.378470600Z

EventRecordID 16595

Channel Application

Computer WSCDBAK

Security

-

EventData

mbamtray.exe

4.0.0.577

5e505ac1

Qt5Core.dll

5.14.1.0

5e4172be

c0000005

0000000000219d05

1594

01d5f52d5eb1d482

C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll

05908203-b2ad-499e-91be-6cf1269d924f

 

Thanks a lot for your help!

 

Chris

 

NB: I havent the license activated as I do want to run Malwarebytes as a second line protection to Windows Defender and havent yet found how to achieve this running Malwarybytes as Premium...(just mentioning in case this matters)

 

mbamtray.exe.10812.dmp mbst-grab-results.zip

[exile360]

I'll leave the crash analysis to the Malwarebytes staff, however I can help you with running the Premium version as an on-demand scanner if that is what you want (though just be aware that we have many users running Malwarebytes Premium alongside Windows Defender in real-time without any issues and you can do the same if you wish simply by disabling the option for Malwarebytes to register in the Windows Security Center under settings as described in this support article).  To use Malwarebytes Premium without any of its protection active simply activate Premium via your license and toggle the option for each of the 4 protection layers off; this can be accomplished either via the menu in the Malwarebytes tray icon's right-click context menu or through the Real-Time Protection area of the main dashboard in the Malwarebytes UI, then disabling the option for Malwarebytes to notify you when any real-time protection modules are turned off located under the Notifications tab in settings.

You may also disable Malwarebytes' self-protection Chameleon driver.  The option to do so is under the Advanced sub-menu under the Windows startup section of the Security tab in settings.

You may delete the default scheduled scan if you wish as well.  To do so, click the link indicating the next scheduled scan time on the main dashboard in the Scanner section then hover your mouse over the scheduled scan and click the trash can icon to delete it.

Those steps will allow you to run Malwarebytes Premium as an on-demand scanner, however each time you are done using it you should right-click the Malwarebytes tray icon and select Quit Malwarebytes then click Yes to the User Account Control prompt, otherwise Malwarebytes will continue to run in the tray in the background.

[Eyetap]

Thanks for this guidance, highly appreciated!

Based on this I activated my license and disabled the option for Malwarebytes to register in the Windows Security Center.

Subsequently I removed the scheduled scan.

The automatic start with Windows was disabled already.

The rest I left alone in order to not changing the situation too much for the crash analysis...

 

42 minutes ago, exile360 said:

...however each time you are done using it you should right-click the Malwarebytes tray icon and select Quit Malwarebytes then click Yes to the User Account Control prompt, otherwise Malwarebytes will continue to run in the tray in the background.

.. and this is exactly what I did - and what often leads to the crash described above.

I checked if running Malwarebytes as Premium changed anything in this regard - but was able to trigger the crash again.

I'm attaching the related dump again...

 

BTW - I ran

Dism /Online /Cleanup-Image /ScanHealth

and

sfc /scannow

just to ensure being safe on this side - no issues have been reported...

 

mbamtray.exe.13712.dmp

[Eyetap]

Is this actually read by the Malwarebytes staff?

[AdvancedSetup]

Hello @Eyetap

You posted to another user's post that was a bit old already. I've split your topic off to it's own new topic and have alerted someone from our team to review but due to the late notice they probably will not access and review your topic until at least Monday or Tuesday.

You could also try the following clean removal and reinstall while waiting

Uninstall and reinstall using the Malwarebytes Support Tool

If that does not help then please gather the following logs to also submit for review

Upload Malwarebytes Support Tool logs manually

Thank you

 

[Eyetap]

Thanks a lot!

Do I have to look for the new topic elsewhere? If so could you please give me an hint where to find it - I sadly didnt succeed...

I tried the Malwarebytes Support tool already - didnt really change anything.

Having uplaoded the logs and the files already - should I again pass it on to you by attaching it to the support ticket confirmation mail?

BTW - just tested with the latest version - the problem still persists...

Thanks a lot!

 

mbamtray.exe.12056.dmp

[AdvancedSetup]

You're all set here in this topic. No need to look or post elsewhere. The support team will get to you but as said it will probably take a few days.

 

[AdvancedSetup]

Since you say the issue is still here after a reinstall please upload your logs here in this post.

Upload Malwarebytes Support Tool logs manually

 

[Eyetap]

Sent via mail as well now..

But here we go...

 

mbst-grab-results.zip mbamtray.exe.12056.dmp

[AdvancedSetup]

OH, I'm sorry. Did you mean you have an open support ticket with our Support Team already?  What is your ticket #

 

 

[Eyetap]

No worries - I just opened it a little time before as I had the impression this wouldn't be read by others than (still very mature - so no offense please) users.

The Ticket Number is 2944764...

[AdvancedSetup]

Thank you. I will alert the Team to your ticket.

 

[LiquidTension]

Hi @Eyetap,

When you initially launch Malwarebytes, is this just a case of opening the UI or is the service being launched as well? To tell, is Malwarebytes tray app already running when your launch Malwarebytes.

Once the scan has completed, how soon after do you use the tray app to 'Quit Malwarebytes'?
Do you see a notification indicating the scan has completed?
Does the crash occur in Safe Mode?
What happens if you launch Malwarebytes, wait 5+ minutes, launch the scan, wait 5+ minutes after it has completed and then use the 'Quit Malwarebytes' option?

[Eyetap]

49 minutes ago, LiquidTension said:

When you initially launch Malwarebytes, is this just a case of opening the UI or is the service being launched as well? To tell, is Malwarebytes tray app already running when your launch Malwarebytes.

I am using Malwarebytes only on demand - so the service is being launched as well - it's set to start type=manual

 

51 minutes ago, LiquidTension said:

Once the scan has completed, how soon after do you use the tray app to 'Quit Malwarebytes'?
Do you see a notification indicating the scan has completed?

I quit Malwarebytes via the tray app after the scan has been completed and I closed the respective Window

- so I certainly see the result before quitting...

 

1 hour ago, LiquidTension said:

Does the crash occur in Safe Mode?

I tried now 4 times and it did not happen in safe mode so far.

I have to point out though, that in safe mode I also don't get a UAC popup asking for permit for Malwarebytes to make changes to the system.

 

1 hour ago, LiquidTension said:

What happens if you launch Malwarebytes, wait 5+ minutes, launch the scan, wait 5+ minutes after it has completed and then use the 'Quit Malwarebytes' option?

 

With 5+ minutes I didn't have a crash - but with something between 3 and 5 minutes I still had repeatedly.

Not sure if there is a big difference between 3 or 5 minutes though.. or not having a crash with 5+ minutes was just good luck.

Please let me underline though that I couldn't and can't put too much time into double checking with this approach repeatedly - so not sure to which extent these results are very reliable.

 

Thanks for your help!

 

[LiquidTension]

Thank you for that information.

We haven't been able to reproduce this crash using the steps provided. Given the Safe Mode results, it may be something environmental that's causing this.
When you have a chance, could you try a clean boot and see if the crash is still exhibited: https://support.microsoft.com/en-gb/help/929135/how-to-perform-a-clean-boot-in-windows (leave Malwarebytes Service as enabled/checked when configuring)

Edited March 17, 2020 by LiquidTension

[Eyetap]

Phewww.... quite some heavy testing for hours...

OK, so I did follow those instructions for a clean boot and wasn't able to clearly reproduce those crashes.
I tried to slowly reenable the Applications listed in the startup (task manager) and it seemd like the crashes would happen again if OneDrive and the Windows-Desktopgadgets were running (no services having been reenabled though).

Saying seemd as I also had a case where it looks like neither of both was running - but this situation wasn't perfectly clear and I can't be more precise in this regards.
Having only one of both running I wasn't able to reproduce the crash either...

Please find attached again 2 dmp files - one named "None_running_mbamtray.exe.7932.dmp" - which represents the questionable case described above.

mbamtray.exe.8484.dmp None_running_mbamtray.exe.7932.dmp

[Eyetap]

Quick Question - what is telemetry.malwarebytes.com?

Could the unavailibility of this cause such issues?

[Eyetap]

Further Input:

Noticed that Windows-Desktopgadgets were a rather old version - so updated the same. No improvement though from this.

I also tried to cross check - sadly not very successful:

1.) Disabled OneDrive and the Windows-Desktopgadgets - still experienced a crash

2.) Disabled all entries from the startup tab @ task manager - still experienced a crash

 

Sorry fo not having better news...

 

[LiquidTension]

Thank you for this information. We're looking into whether this will help reproduce the crash along with the new crash dumps provided. Once we have an update, I'll respond back.

In the meantime, if you wish to workaround the issue, I would suggest adding a longer delay between the scan completing and the "Quit Malwarebytes" option being used.

[Eyetap]

Some more input from Testing:

I did try to applicationwise disable Services and related Startup items. The result was that after disabling the following Services:

AcronisActiveProtectionService

Acronis Managed Machine Service Mini

Acronis Mobile Backup Server

Acronis Mobile Backup Status Server

Acronis Nonstop Backup Service

Acronis Scheduler2 Service

Acronis Sync Agent Service

 

and subsequently disabling the following Autostart entries:

 

Acronis Scheduler Service Helper

Acronis TIB Mounter Monitor

Acronis TIB Mounter Monitor

 

The likelyhood for crashes reduced significently. Not none but very little. - So it seems to me to be a really weird combination of various things...

 

To double check I ran the same on my notebook - but wasn't able to reproduce there - until I activated my Malwarebytes license.

Once I did, the same crash happened there as well...

 

Maybe this helps a bit as well...

 

[Eyetap]

Received the following directive from the Malwaresupport via mail:

"I would ask you to update the forum with the information that crashes are not appearing after adding a longer delay between the scan completing and the "Quit Malwarebytes" option being used. In such a way, our engineers will be notified and be back to you as soon as possible."

I reported the same already in post #14...

 

[exile360]

Thanks, I'll be sure to inform the Product team.