Malwarebytes Native Message Service: Multiple Copies in Memory

[siliconman01]

The applies to Windows 10x64 Pro (21H2 (OS Build 19044.1620)) and Windows 11x64 Pro (21H2 (OS Build 22000.58) plus the latest version of MS Edge Chromium browser with Browser Guard V2.3.20 plus MBAM Beta V4.5.7.186, 1.0.1645.

If the main program Malwarebytes is not running in memory, every time MS Edge is opened to a website, an additional copy of Malwarebytes Native Message Service is added to memory.  Activating MBAM clears out these multiple copies.  I don't know if this has been occurring on previous beta versions because I haven't been looking for it.  

[1PW]

Hello @siliconman01 and welcome back:

The outstanding description, data and Task Manager snapshot are very valuable.

To begin, please do the following so staffers/devs may take a closer look at your installation for troubleshooting:

Important: It will be quite critical to capture the system's state while multiple instances of Malwarebytes Native Message Service are present as above. Please do not re-install anything or make system changes unless asked to do so.

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download a fresh copy of the Malwarebytes Support Tool. (MBST)
2. In the Windows Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control pop-up window, select Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, select Advanced.
6. In the Advanced Options, please select ONLY Gather Logs. A status diagram displays the tool is Getting logs from your machine. Please be very patient.
7. A .zip archive file named mbst-grab-results.zip will be written to the Windows desktop, please attach that file to your next reply.

Thank you.

Edited March 23, 2022 by AdvancedSetup
Corrected font issue

[siliconman01]

Here are the logs you requested

LOGS.zip

[1PW]

Hello @siliconman01:

Probably due to no fault of yours, the above mbst-grab was only partially complete. Please use the following procedure to obtain some of the missing data:

Please download the Farbar Recovery Scan Tool and save it to the computer's desktop.

Note: You will need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit.

1. Double-click to run it. When the tool opens, click Yes to disclaimer.
2. Select the Scan button.
3. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
4. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time.
5. Please attach the Addition.txt log to your reply as well.
6. On your next reply, you should be attaching FRST.txt and Addition.txt to your post.

Thank you.

Edited March 23, 2022 by 1PW

[siliconman01]

Here are the logs again.  

Please note:  If you examine my "signature", you will see that my primary security suite is Bitdefender Internet Security 2022.  Like some other suites, it dislikes having Malwarebytes and also Spywareblaster running.  Therefore I use MBAM as a daily backup scanner to cross check Bitdefender.  Until I discovered this "bug", I do not keep MBAM running...no offense :)  I only run it to perform the cross check scan.  I like Malwarebytes Browser Guard continuously running in MS Edge which is my default and only browser.  BD does not have an extension such as Malwarebytes Browser Guard...at least, not that I am aware of.  

 

Addition.zip mbst-grab-results.zip

Edited March 23, 2022 by siliconman01

[1PW]

Hello @siliconman01:

The last attachments should help staffers/devs begin their analysis.

Thank you.

cc: @AdvancedSetup

[AdvancedSetup]

I know the team is working on something for this but I don't think it will be available until the next beta

For now you'd probably need to uninstall Browser Guard, reboot and see if that corrects it.

 

[David27]

This is still an issue today.