Local NAS

[Pluto]

Currently running 4.2.1.89 with component pack 1.0.1070 under Windows 10 (2004). Unless I disable Web Protection, my local NAS does not show up in the "computer" category under "Network". It might be useful to note that another machine on the same network running Windows 7, using MB component package 1061 did not suffer from this issue until I allowed it to update to component 1070, at which time it developed the same problem as described above.

If I knew how to retrograde to component package 1061 I would check the behaviour on the Windows 10 machine but, alas, I do not. So right now, it looks as though this is an issue with component package 1070.

 

Edited October 16, 2020 by AdvancedSetup
corrected font issue

[exile360]

Greetings,

Thank you for reporting this issue.  We will pass this info on to the Product team for analysis.

I noticed a somewhat similar issue being reported here as well and I suspect they have the same cause:

In the meantime, if you would please provide the following logs from at least one of the affected machines it may prove helpful to the Devs for troubleshooting and replication purposes:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
   

Thanks

[Pluto]

Log package as requested attached. I would concur that the “similar issue” you cited is likely to be related.

Is there a simple way I can revert to component package 1061 as a workaround?

 

Edited October 28, 2020 by AdvancedSetup
log removed per request

[exile360]

I don't know of anywhere it can be downloaded from, but I'll ask a staff member to check.

@AdvancedSetup is there a download link for CU 1061 as requested?

[exile360]

By the way, if System Restore is enabled on your system (which it should be by default), then perhaps you can use that to revert to an earlier restore point prior to CU 1070 being installed, then disable the two highlighted options to prevent it from being updated until the issue is resolved (you'll still receive signature/database updates):

To access those settings click the small gear icon in the upper right in Malwarebytes and they are the first two items listed under the first tab.

[Pluto]

4 minutes ago, exile360 said:

By the way, if System Restore is enabled on your system (which it should be by default), then perhaps you can use that to revert to an earlier restore point prior to CU 1070 being installed

Whooahh! That has the potential to have far too many consequences; had the 1070 install been an hour old, perhaps. But not when it's the best part of a week old 👎

Thinking about it, for β testers not to be able, reasonably easily, to revert to older versions of the thing they are testing isn't awfully helpful.

[exile360]

If it were a beta version it would be much easier, but unfortunately CU 1070 was released as the final build recently.  I'm sure AdvancedSetup will be able to locate an installer for the previous build so we'll just need to wait on him or someone else who can get hold of a copy, then you'll be able to install 1061.

[Bertil78]

On 10/16/2020 at 2:31 PM, Pluto said:

Currently running 4.2.1.89 with component pack 1.0.1070 under Windows 10 (2004). Unless I disable Web Protection, my local NAS does not show up in the "computer" category under "Network". It might be useful to note that another machine on the same network running Windows 7, using MB component package 1061 did not suffer from this issue until I allowed it to update to component 1070, at which time it developed the same problem as described above.

If I knew how to retrograde to component package 1061 I would check the behaviour on the Windows 10 machine but, alas, I do not. So right now, it looks as though this is an issue with component package 1070.

 

same issue

[AdvancedSetup]

No, I'm sorry. I don't have a download link for the previous version. You would need to probably revert back to 4.1.2 and disable program update checks.

The older version 4.1.2 is located here
https://malwarebytes.box.com/s/xlmxytma7g3ntj9ge98rrafwg5pgp3x8

Again, you'd need to go to Settings, General and disable program checks right away. Then reboot to prevent the program from updating to the latest version.

I have submitted your logs for review

Thank you

 

[Hardhead]

I have mb4-setup-consumer-4.2.1.179-1.0.1045-1.0.29939.exe but don't have access to Malwarebytes Box because you have to be employee.

[AdvancedSetup]

The previous version is not recommended. If you can workaround this via disabling Web Protection or dropping back to 4.1.2 and disabling program updates that would probably be best until we investigate this issue further.

You can use Malwarebytes Browser Guard and uBlock Origin to help prevent Web attacks until this issue is resolved.

uBlock Origin

Firefox
Chrome
 

 

 

 

[exile360]

I've been in communication with a member of the Product Management team who is investigating this issue with the Developers and he asked that you try disabling Exploit Protection instead of Web Protection to see if that alleviates the issue.

Please let us know how it goes.

Thanks

[Pluto]

No. Disabling Exploit Protection does NOT alleviate. I have confirmed once again that disabling Web Protection does.

[exile360]

Excellent, thank you for confirming that.  I will be sure to let them know so that the Developers will know where to look in the code.

I just re-checked your logs and noticed that FRST didn't run as part of the Malwarebytes Suppoort Tool the way it is supposed to and also noted a couple of excluded detections that might be cause for concern.  Those issues may be totally unrelated to the issue with Web Protection, however I wouldn't want you to continue using a system which might possibly be infected thinking that it is clean.  To address these issues I would recommend allowing one of our malware removal specialists to take a look just to make certain the system isn't infected with anything.  To do so, please follow the instructions in this topic, skipping any steps you are unable to complete, then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking and cleaning your system of any threats.

Again, it may be totally unrelated to the issue with Web Protection, but it would be irresponsible of me not to point out when a system might be infected as it could risk the stability of your system and your data.

[Pluto]

There is no evidence that I am harboring an infection. Likewise, I have two machines exhibiting this issue, different O/S, both of which are scanned regularly and both were fine with component pack 1061 and when 1070 was installed, problem! The second machine has very little Internet contact (used for playing internet radio only) so the chances of both machines having contracted an infection with identical symptoms but no other indication of a problem, seem very low. The excluded detections are samples I keep for study, were placed there by me and are no cause for concern. So I am not going to get paranoid about them as the time I have available to explore this is limited.

I thank you for your concern about the stability of my system but right now the evidence suggests that we are looking for a good old-fashioned software bug, especially as you have had other reports of the same issue, coincident with the release of pack 1070. It is also interesting to note that the reported issue only appears to inhibit initial detection of the NAS at its root. When Web Protection is turned off and the NAS discovered, Web Protection may then be re-enabled and while this again prevents the root of the NAS being found when Network is run, it does not inhibit the use of folders further down the NAS tree.

[exile360]

Yes, as I mentioned, I doubt any possible infection has anything to do with the NAS issue; I was simply pointing it out as it's our responsibility to do so.  It's up to you whether or not to get the system checked.  Also, none of this explains why FRST didn't download/run with the Malwarebytes Support Tool.  It happens of course, but there's always a reason.  It doesn't necessarily mean the system is infected by any means, but something went wrong.

[Pluto]

1 hour ago, exile360 said:

Also, none of this explains why FRST didn't download/run with the Malwarebytes Support Tool.

Probably because I didn't allow the Malwarebytes Support Tool through my firewall! To be fair, I would have done had I noticed the firewall alert, but I didn't. Mystery solved, at least that part of it.

[exile360]

Ah, gotcha, no worries then

[exile360]

This issue may be resolved in the latest Malwarebytes Beta.  If you wish to give the beta a try please refer to this post for details about the beta and instructions on installing it, otherwise you may wait for the new version to be released once beta testing is completed with the release expected to be a week from now to see if it fixes the issue.

[Bertil78]

same problem with

4.2.2.95 component package 1.0.1091

 

turning off web protection and networkdrives/shares work again

[exile360]

Thank you for testing and reporting.  I will be sure to pass this info on to the team for further analysis and testing.

[AdvancedSetup]

Thank you again for your feedback. We're looking into this and we are able to duplicate the issue for network discovery. Hopefully we'll be able to debug and get this fixed soon.

NAS specifically though is not  necessarily supported though some models do work, many do not.

 

 

[Pluto]

21 minutes ago, exile360 said:

This issue may be resolved in the latest Malwarebytes Beta

I'm afraid I concur that it is not. But it is useful to know that the devs. are able to duplicate the problem.

Fight on!

[ratumikaele]

I am having same problems. Network discovery is not working with web protection turned on with latest version.

Client is Windows 10 build 190941.

Cannot see other computers or NAS (QNAP) on network but can access them using IP address.

Tried lots of solutions prior to identifying this as issue, including reconfiguring master browser and even a network reset ☹️ I wonder how many other customers are wasting hours on problem identification.

This is a serious issue as backups to NAS have also been failing as a result - path not found.

Have reverted to previous version.

 

The lack of resolution of this problem is a concern. The lack of identification in testing or ability to recreate issue is an even bigger worry. Especially when the recommended workarounds are revert to old version or switch off protection. Why hasn't Malwarebytes communicated the problem and (if unable to immediately resolve) not issued a new release which is in fact just previous version since ability to revert to older version is not an official offering? I realise this is a forum discussion. What is the official process of escalation?

[Porthos]

14 minutes ago, ratumikaele said:

I realise this is a forum discussion. What is the official process of escalation?

This is official support for Malwarebytes (not just a forum) and the issue is being worked on.