Jump to content

Mbambgnativemsg.exe problem


Recommended Posts

Hello

For a long time (now I have the latest version of Mbam Pro), if I have it closed, giving it to exit, multiple processes mbamBGnativeMsg.exe and CMD processes are generated at the same time, and conhost.exe also

If I open Mbam again these processes disappear, they will be generated if I close it and consume resources.

the problem seems to be in the malwarebytes extension for edge, because if I disable it the problem does not seem to occur, but if it is active and mban closed, every time I open edge a new process parks and is permanent

 

Best regards

Sin título.png

Edited by miguelgrado
Link to post
Share on other sites

  • Staff

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

  • For use when you are on the forums and need to provide logs for assistance
  • For use when you don't need or want to create a ticket with Malwarebytes
  • For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler
  1. Download Malwarebytes Support Tool
  2. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  3. Place a checkmark next to Accept License Agreement and click Next
  4. Navigate to the Advanced tab
  5. The Advanced menu page contains four categories:
    • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
    • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
    •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
    • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
  6. To provide logs for review click the Gather Logs button
  7. Upon completion, click OK
  8. A file named mbst-grab-results.zip will be saved to your Desktop
  9. Please attach the file in your next reply.
  10. To uninstall all Malwarebytes Products, click the Clean button.
  11. Click the Yes button to proceed. 
  12. Save all your work and click OK when you are ready to reboot.
  13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
  14. Select Yes to install Malwarebytes.
  15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler
 
 
 
 
Spoiler

 

 

01.png

02.png

03.png

04.png

05.png

06.png

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Link to post
Share on other sites

1 hour ago, miguelgrado said:

For a long time (now I have the latest version of Mbam Pro)

Please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

 

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thanks

Link to post
Share on other sites

The problem is the Malwarebytes extension in Edge, so I've tried.

If I deactivate that extension, there is no problem opening edge and having Malwarebytes closed.

if the extension is active and edge is opened the cmd and mbambgnativemsg processes open and do not close and each time edge is opened more and more are added

Link to post
Share on other sites

1 minute ago, miguelgrado said:

mbambgnativemsg

This is a Malwarebytes process not part of browser guard.

Lets use the same support tool and do a clean uninstall and reinstall.

image.png.c99dd4c023b591f932a0d0ca18e4599f.png

Please close all browsers and programs before running the tool. Right click and quit MB from the system tray also.

Once done it will attempt to reinstall both Malwarebytes and Privacy VPN.

Please say no and close the X button on the top right for Privacy if you do not have it.

 

 

Link to post
Share on other sites

It's already done.

Equal result.

If I open Edge with the extension enabled and Malwarebytes that active, the process is generated, but it closes when Edge closes.

If Malwarebytes is closed, opening Edge generates Cmd and the Mbam process, but these do not close when Edge closes and more and more are added every time I open it.

with the extension disabled no process is generated when opening edge whether mbam is active or not

 

Note: What is Privacy in clean install ( i close this window)?????

Edited by miguelgrado
Link to post
Share on other sites

17 minutes ago, miguelgrado said:

If I open Edge with the extension enabled and Malwarebytes that active, the process is generated, but it closes when Edge closes.

Uninstall Browser guard restart the browser and reinstall it.

18 minutes ago, miguelgrado said:

Note: What is Privacy in clean install ( i close this window)?????

It is the separate paid MB VPN.

The problem could still be Avast related.

Link to post
Share on other sites

Okay, but it is an important problem because those processes are not closed consuming resources even though Mbam is closed.

I close Mbam when I have to do certain tasks and to save resources, which do not involve riengos, and in this way, users who use Edge will fill the pc with inncessary processes.

These should be closed automatically, when closing Edge.

 

Note:

I have done the test and if I disable the option to hide duplicate warnings in the extension, the problem is not reproduced, that is, those processes are not generated.

But the problem is with the option enabled that those processes do not close after closing Edge

 

 

Thanks

Link to post
Share on other sites

10 minutes ago, miguelgrado said:

Note:

I have done the test and if I disable the option to hide duplicate warnings in the extension, the problem is not reproduced, that is, those processes are not generated.

But the problem is with the option enabled that those processes do not close after closing Edge

There is your solution for now.

Link to post
Share on other sites

I have checked, I guess possibly with the latest updates, that now the problem is also in Opera, Chrome, but in Firefox also, the process is generated if the option to hide in extension is enabled, the process closes when closing firefox (along with Cmd and Conhost, which are also closed)

Link to post
Share on other sites

Hi Advanced Setup:

I can reproduce this behavior and use I Microsoft Defender as my primary antivirus.  If I exit Malwarebytes Premium (i.e., right-click the system tray icon and choose Quit Malwarebytes) and then open and close MS Edge a few times times, Task Manager only shows one copy of  Windows Command Processor (cmd.exe) and Malwarebytes Native Message Service (MbamBGNativeMsg.exe) running under the main Microsoft Edge process in the Apps section (which I assume is expected) ...

667045232_Win10Prov21H2TaskManagerMSEdgev100_0_1185_50Processes23Apr2022.png.7c6c45bfbdb74a5cf82c15d960260e12.png

... but if I scroll further down Task Manager and look in the Background Processes section I can see another "orphaned" instance of cmd.exe and MbamBGNativeMsg.exe accumulate every time MS Edge is closed.

1748751279_Win10Prov21H2TaskManagerMSEdgev100_0_1185_50OrphanedWindowsCommandProcessorProcesses23Apr2022.png.47985d8ddcc51b90457d4081f46c7020.png

383168704_Win10Prov21H2TaskManagerMSEdgev100_0_1185_50OrphanedMBNativeMessenerServiceProcesses23Apr2022.png.6374daebfe3e6c29353b1b8f162eea6f.png

I currently have Malwarebytes Browser Guard for Chrome configured to "Hide Duplicate Warnings", so I'll run more tests later to see if I can reproduce this behavior with that setting turned off.  I normally use Firefox as my default browser so I'll also check if the same instances of cmd.exe and MbamBGNativeMsg.exe accumulate if I open and close Firefox multiple times after Malwarebytes Premium is closed.

1686175183_MSEdgev100_0_1185_50MBBrowserGuardv2_4_0ExtensionHideDupWarningsEnabled23Apr2022.png.3def8f82701c1cf686f60e830ad561e1.png

The attached logs were collected today while Malwarebytes Premium was running in real-time protection mode.

mbst-grab-results.zip

--------------
64-bit Win 10 Pro v21H2 build 19044.1645 * Microsoft Defender v4.18.2203.5-1.1.19100.5 * Malwarebytes Premium v4.5.8.191-1.0.1666 * Macrium Reflect Free v8.0.6635 * Firefox v99.0.1 * MS Edge v100.0.1185.50 * Malwarebytes Browser Guard (Chrome/Firefox) v2.4.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited by lmacri
Link to post
Share on other sites

  • Root Admin

Thank you @lmacri

I was hoping to do some testing on this myself but my wife had other ideas for me to spend time with her.
 

Other colleagues, say this behavior is normal and to be expected. I will try to look into it myself though in the next few days.

Cheers

 

Link to post
Share on other sites

14 hours ago, AdvancedSetup said:

....Other colleagues, say this behavior is normal and to be expected ...

Hi Advanced Setup:

It doesn't sound "normal" when processes like Windows Command Processor (cmd.exe) created by Malwarebytes Browser Guard for Chrome (with Hide Duplicate Warnings ENABLED and MB Premium closed) are left in memory after the MS Edge browser is closed.  I would have expected there would be some sort of cleanup routine to end these orphaned processes when MS Edge was closed.  Perhaps it's not something the developers have considered in their use cases since most Malwarebytes Premium users wouldn't typically stop their real-time protection by choosing "Quit Malwarebytes" from the system tray and then open and close their browser multiple times.

On 4/21/2022 at 11:40 PM, miguelgrado said:

... I have checked, I guess possibly with the latest updates, that now the problem is also in Opera, Chrome, but in Firefox also, the process is generated if the option to hide in extension is enabled, the process closes when closing firefox (along with Cmd and Conhost, which are also closed)...

Here's what happens when I repeat my test with Firefox v99.0.1 and ENABLE Hide Duplicate Warnings in my Malwarebytes Browser Guard for Firefox extension, re-start my machine, quit Malwarebytes Premium from the system tray icon, and open and close Firefox four or five times.  Unlike MS Edge, there is no Windows Command Processor (cmd.exe) or the Windows Console Host (conhost.exe) running under the main Firefox process in the Apps section...

631175876_Win10Prov21H2TaskManagerFirefoxv99_0_1ProcessesNocmd_exe24Apr2022.thumb.png.e92a17f52ce940c42f362653650b8265.png

.... and if I scroll further down Task Manager and look in the Background Processes section, I can't see any orphaned instances of Malwarebytes Native Message Service (MbamBGNativeMsg.exe) or Windows Command Processor (cmd.exe) accumulating in memory after Firefox is closed.

888159869_Win10Prov21H2TaskManagerFirefoxv99_0_1NoOrphanedMBNativeMessenerServiceProcesses24Apr2022.thumb.png.6b837800ea11565b35578cbc09c36ae0.png

 

Getting back to MS Edge, here's what I see when I DISABLE Hide Duplicate Warnings in my Malwarebytes Browser Guard for Chrome extension in MS Edge, re-start my machine, quit Malwarebytes Premium from the system tray icon, and open and close MS Edge four or five times.  Firstly, I don't see any instance of Malwarebytes Native Message Service (MbamBGNativeMsg.exe), Windows Command Processor (cmd.exe) or the Windows Console Host (conhost.exe) running under the main Microsoft Edge process in the Apps section like I did when Hide Duplicate Warnings was enabled (see yesterday's results <above>)...

82052677_Win10Prov21H2TaskManagerMSEdgev100_0_1185_50ProcessesHideDupWarningsDisabled24Apr2022.thumb.png.0e6ddf079282065e21896780a186f76a.png

.... but if I scroll further down Task Manager and look in the Background Processes section I can find one instance of MbamBGNativeMsg.exe but can't find cmd.exe or conhost.exe.  Like the OP miguelgrado, I can open and close MS Edge several times and don't see extra copies of MbamBGNativeMsg.exe accumulating as long as Hide Duplicate Warnings is DISABLED in my MS Edge / Chrome extension, but that one instance of MbamBGNativeMsg.exe persists even after MS Edge is closed.

1450399371_Win10Prov21H2TaskManagerMSEdgev100_0_1185_50ProcessesHideDupWarningsDisabledBackgroundsApps24Apr2022.thumb.png.69af7ba8f6d74bf7b2045272f82a5a9b.png

--------------
64-bit Win 10 Pro v21H2 build 19044.1645 * Microsoft Defender v4.18.2203.5-1.1.19100.5 * Malwarebytes Premium v4.5.8.191-1.0.1666 * Macrium Reflect Free v8.0.6635 * Firefox v99.0.1 * MS Edge v100.0.1185.50 * Malwarebytes Browser Guard (Chrome/Firefox) v2.4.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited by lmacri
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.