MBAMService occassionally "breaks", help needed!

[re11ding]

So this is a very strange issue that no one else seems to be reporting on and seems exclusive to me. So, I figured I'd post here and get some much needed help.

To best describe what I mean by the title, something breaks in the MBAMService. Now, this isn't capable of happening at any given point. It seems to trigger in two instances: 1. The program starting up on boot (Delayed start in MB does not resolve the issue.) or 2. Waking from sleep mode without closing MB and in turn stopping MBAMService prior to entering sleep. The issue is not guaranteed to trigger under these circumstances, but they can and only will trigger during them, but not at other points.

When MBAMService reaches this broken state, it makes the internet not function (well, it does work, but it will take much, much longer to load anything. I'm talking 5 to 10 minutes to load a page if it doesn't time out first.), protection cannot be turned off as it loads indefinitely, and you cannot exit the MBAM tray application else you won't be able to reopen it because the MBAMservice in Services will, from that point, indefinitely be on "Stopping..." until you reboot. Rebooting is the only solution to this issue I have currently.

As you might imagine, this is a very frustrating issue. I had run the support tool and tried the repair option which unfortunately did not completely fix the result. I vowed to get logs as soon as it happened again and that day has finally come. Within the logs for MBAMService, go to 6/6/2020 and get to the first entry at 11:44 AM. This was me booting my PC this morning where the issue did trigger. I also compared it to the following boot, which failed to have most of the WARNINGS and ERROR logged messages that the one where MBAMService did break got them. I have attached the zip file as needed. If someone could help me fix this issue, I'd very much appreciate it, thank you!

mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Are you somehow terminating MBAMService manually, then putting the system to sleep which results in problems once the system is woken from sleep?  If so, the solution should be to simply stop terminating MBAMService manually as it is not designed to be terminated in any way other than exiting Malwarebytes (which can be done by right-clicking the Malwarebytes tray icon and selecting Quit Malwarebytes).

If you are not terminating MBAMService manually and are quitting Malwarebytes properly and the issue occurs then please test to see if disabling Web Protection corrects the problem when it occurs.  If it does, then you are likely experiencing the same issues described in this thread and will have to either revert to an earlier version of Malwarebytes which does not cause this issue, or keep Web Protection disabled until a version of Malwarebytes is released containing a fix.

Please let us know how it goes and provide additional details if the issue you are experiencing is different from the ones described above.

Thanks

[re11ding]

I am terminating the process properly by exiting Malwarebytes, do not worry. But alright, I will disable web protection for now and see if the issue persists. The issue I can't tell if it matches exactly, but it is somewhat similar to what I have been experiencing.

[Porthos]

14 minutes ago, re11ding said:

I am terminating the process properly by exiting Malwarebytes, do not worry.

How long do you wait to sleep after exiting Malwarebytes? It can take a few minutes for all of the drivers to unload after the tray icon goes off.

[re11ding]

3 minutes ago, Porthos said:

How long do you wait to sleep after exiting Malwarebytes? It can take a few minutes for all of the drivers to unload after the tray icon goes off.

Around a minute. Mind you I never have problems when exiting Malwarebytes and going into sleep mode. It's if I don't exit Malwarebytes and go into sleep mode that it has a chance of occurring. However, it's far more common to happen on boot instead of waking from sleep.

[Porthos]

3 minutes ago, re11ding said:

It's if I don't exit Malwarebytes and go into sleep mode that it has a chance of occurring.

I have those same symptoms on a client's Lenovo Laptop. Currently she is now actually shutting down instead of sleeping and since I disable fast start on all computer I service, The computer actually shuts fully down.

[exile360]

Thank you for the clarification.  Please try disabling fast startup as described here to see if that fixes the problem and let us know how it goes.

Thanks

[Porthos]

Just now, exile360 said:

Please try disabling fast startup

It is already off for this user. At least it says so in the logs.

[exile360]

Ah, I see.  I saw you'd mentioned it as possibly being the cause and didn't notice it was off already in the logs.  It likely is due to Web Protection then, at least that seems most likely to me.  Please chime in if you have any other ideas.

[Porthos]

4 minutes ago, exile360 said:

It likely is due to Web Protection then

I personally would go back to the working version before I would disable any feature of Malwarebytes on a clients computer.

Luckily, I only currently have ransomware protection off on my own computer because we both know how it works and I keep isolated image backups on a monthly basis anyway.

Edited June 7, 2020 by Porthos

[exile360]

Do you have a link to the working version without this issue?  If so, would you please post it?

Thanks

[re11ding]

I am unfortunately unaware of a version where this doesn't exist as the current version is my first one.

[Porthos]

54 minutes ago, exile360 said:

Do you have a link to the working version without this issue?  If so, would you please post it?

Thanks

Same version I have been posting all over.

Quote

You also have the option of reverting to an earlier component package version, which will allow you to keep Web Protection enabled.
You can download this from here: https://malwarebytes.box.com/s/z6cravnwptrzx5tyjw36jq6zt6c7apsx

Once installed, you will need to disable the two update options found in Settings -> General -> Application updates to prevent the product from updating back to the affected version.

I suggest using the following clean install guide.

Please do the following Uninstall and reinstall using the Malwarebytes Support Tool

Please have lots of patience with the tool.  The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up.   Please be patient and have faith.  Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install. Say no and use the download from my above link and install the old version and disable the update before you do anything else.

 

[exile360]

Thanks Porthos, I wasn't certain if that applied to this particular issue or not.  @re11ding, please install the version linked by Porthos above and you should be able to keep all protection enabled, then upgrade once this issue has been resolved.  A member of the staff will likely respond to this thread to notify you once the problem has been fixed, otherwise keep an eye on the forums here for news in the pinned topics about new versions and see the posted release notes to see if the issue has been addressed so that you may upgrade to the latest version.

Edited June 7, 2020 by exile360

[re11ding]

Sounds good exile, thank you. And thank you for the version, Porthos!

[exile360]

You're welcome, we're glad to help

I thank you as well for providing the solution Porthos  

[pal1000]

This issue is far from being unique to you @re11ding, there are plenty of threads on both Malwarebytes for Windows beta and this forum about slow DNS resolution, it just happened for you to notice that service is hanging on stop when issue is in effect which I was aware of for a long time. I personally believe every single component update of MB4 is affected, including initial beta releases. I don't know why, but I recall experiencing this issue once with MB 4.0.4 CU 1.0.750 as well.

This issue has many potential triggers that I noticed which makes it hard to avoid:

- full Windows shutdown with Malwarebytes running in any form (this includes shutdown with fast startup disabled, fast startup override with SHIFT key on showdown and restart operations);

- any kind of Malwarebytes scan (it doesn't matter if it's manual or scheduled or what type of scan is);

- component updates or full software updates.

I didn't know about sleep as I never use it. I prefer hibernation which doesn't trigger this issue.