Malwarebytes Native Message Service Stopped Working

[NewTricks]

The reliability monitor reported a "Critical Event": Malwarebytes native message service stopped working." This was nearly simultaneous with a morning power on which (curiously) included a "reminder" from MB to set a scan schedule. My scan schedule is scan during idle times-that happens daily. I also scan when I feel like it-daily.

QUESTIONS:

Is a scan during idle time considered a "scheduled" scan?

Is it normal to occasionally see these pop up reminders when I first turn on the computer in the morning?

Is the critical event really CRITICAL?

 

MB shows me a 100% protected icon/message, with the words You're crushing it 😆 I like that. 👍

Thank you in advance.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[NewTricks]

Thank you.

mbst-grab-results.zip

[lmacri]

Hi NewTricks:

I can confirm that I've had the same error logged ~ 10 to 15 min after boot-up in my Win 10 Reliability Monitor (Problem Event Name: BEX64, see attached .txt file) starting 01-Sep-2023. The error logged by my Reliability Monitor on 26-Aug-2023  for invcol.exe (Inventory Collector) is for an executable associated with my Dell Update application and has nothing to do with Malwarebytes.

 

I don't know if it's relevant, but my Malware Browser Guard for Firefox browser extension updated to v2.6.9 on 31-Aug-2023 and since then I've seen multiple problems on my computer, including the problem reported by cage22 on 01-Sep-2023 at Malwarebytes Browser Guard 2.6.9 Prevents Intel Driver Support Assistant where my Intel DSA v23.3.25.6 will not run in my Firefox browser even if I disable my Malwarebytes Browser Guard v2.6.9 extension and disable the Web Protection module in Malwarebytes Premium v4.6.1.

I also noticed that my Microsoft Defender received the 30-Aug-2023 platform / engine updates (Platform: 4.18.23080.2006 | Engine: 1.1.23080.2005 - see release notes <here>) some time around 31-Aug-2023 or 01-Sep-2023.  I can view my current MS Defender platform / engine versions by clicking the Windows Security icon in my system tray and selecting Settings (gear icon) | About.  Note that Settings | Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center is DISABLED in my Malwarebytes Premium settings.

mbst-grab-results lmacri 02 Sep 2023.zip

Win 10 Pro v22H2 Reliability Monitor mbambgnativemsg_exe Error 02 Sep 2023.txt

----------
64-bit Win 10 Pro v22H2 build 19045.3324 * Microsoft Defender v4.18.23080.2006-1.1.23080.2005 * Malwarebytes Premium v4.6.1.280-1.0.2117 * Macrium Reflect Free v8.0.7279 *  Dell Inspiron 5583/5584 BIOS v1.22.1 * Firefox v117.0.0 * Malwarebytes Browser Guard for FF v2.6.9
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited September 2, 2023 by lmacri

[NewTricks]

Thank you @lmacri for referencing your experience, cage's topic and the release notes. I happened to read the topic about BrowserGuard, but it never occurred to me it might be a relevant to me, albeit with many different elements.  I read your posts and follow your instructions, so I know that MB is disabled in the Windows Security Center. I also turned out my rootkit scan setting, but that's a different question/issue.

Your answer allows me to feel less concerned, because my first thought is to assume I have done something to destablize my system. Although this has not been solved, per se, over time, I am confident of a future discovery.

P.S. I'm jealous of your clean reliability report image! One day I'll get there too.

[AdvancedSetup]

I'll try to check the logs on Tuesday but have reported this to our internal team

Thank you

 

[SPDIF]

Yes same on my computer and from clients, every day you start have one fault like this. It seems that if you disable Ransomware protection the problem disappears. At least on my systems there are no faults anymore. So i did advice my clients to disable this until there is an solution, after that no faults seen anymore.

The problem happens on either Windows 10 or 11 systems.

 

 

Edited September 3, 2023 by SPDIF

[lmacri]

1 hour ago, SPDIF said:

Yes same on my computer and from clients, every day you start have one fault like this. It seems that if you disable Ransomware protection the problem disappears. At least on my systems there are no faults anymore. ...

Hi SPDIF:

Thanks for the feedback.  Good to know others are seeing this error as well.

If open my Task Manager after launching my Firefox or MS Edge browser I often see an instance of MbamBgNativeMsg.exe running under those browsers (i.e., in addition to the background instance of MbamBgNativeMsg.exe shown in the second image below).  I could be wrong, but I've always assumed this service has something to do with communication between the Web Protection feature of my Malwarebytes Premium and the Malwarebytes Browser Guard extensions in my browsers.

I don't know if it's a bug or expected behaviour, but I also noticed today that the "Hide Dulplicate Warnings" setting is no longer present in my Malwarebytes Browser Guard v2.6.9 settings. It's possible that setting isn't required anymore in newer versions of Malwarebytes Browser Guard, but here's an old screenshot of my Malwarebytes Browser Guard v2.4.0 settings that I captured on 24-Apr-2022.  

I'm not sure what triggers these Malwarebytes Native Message Service errors that are logged in my Reliability Monitor and Event Viewer, but I ran several tests yesterday both with and without Malwarebytes Premium v4.6.1 and/or Firefox v117 running the background and couldn't reproduce the error, and this error hasn't been logged (yet?) on my system today (03-Sep-2023) since I powered on my system.

On 9/2/2023 at 10:07 AM, lmacri said:

...I don't know if it's relevant, but my Malware Browser Guard for Firefox browser extension updated to v2.6.9 on 31-Aug-2023 and since then I've seen multiple problems on my computer, including the problem reported by cage22 on 01-Sep-2023 at Malwarebytes Browser Guard 2.6.9 Prevents Intel Driver Support Assistant where my Intel DSA v23.3.25.6 will not run in my Firefox browser even if I disable my Malwarebytes Browser Guard v2.6.9 extension and disable the Web Protection module in Malwarebytes Premium v4.6.1....

Just need to make a correction to my comment <above>. I did more testing and can confirm that Intel DSA v23.3.25.6 will run in my default Firefox browser if I disable Malwarebytes Browser Guard for FF v2.6.9 at Tools | Add-ons and Themes (i.e., even if Web Protection is turned on in MB Premium v4.6.1), but as soon as I re-enable this browser extension Intel DSA fails to run in my browser.

----------
64-bit Win 10 Pro v22H2 build 19045.3324 * Microsoft Defender v4.18.23080.2006-1.1.23080.2005 * Malwarebytes Premium v4.6.1.280-1.0.2117 * Macrium Reflect Free v8.0.7279 *  Dell Inspiron 5583/5584 BIOS v1.22.1 * Firefox v117.0.0 * Malwarebytes Browser Guard for FF v2.6.9
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited September 3, 2023 by lmacri

[lmacri]

Hi @AdvancedSetup :

Just an FYI that SIRMAGICUS reported a similar problem in their 26-Aug-2023 thread Conflict but no one has replied in that thread since the OP posted their requested Malwarebytes Support Tool (mbst-grab-results.zip) diagnostic logs.  In that case SIRMAGICUS was able to stop their Malwarebytes Native Message Service error by disabling the Malwarebytes Browser Guard extension in their browsers.
----------
64-bit Win 10 Pro v22H2 build 19045.3324 * Microsoft Defender v4.18.23080.2006-1.1.23080.2005 * Malwarebytes Premium v4.6.1.280-1.0.2117 * Macrium Reflect Free v8.0.7279 *  Dell Inspiron 5583/5584 BIOS v1.22.1 * Firefox v117.0.0 * Malwarebytes Browser Guard for FF v2.6.9
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[NICK ADSL UK]

Just to confirm, i too am receiving this message after a period of activity when the computer is off. It appears on the desktop coming out of sleep 

[SPDIF]

I did just tested this out, as soon as i enable Ransom protection in MWB, the error occurs.

Further al systems have another problem the same time, if you click the three dot's in MWB browser guard, you see small locks. When you click it, it says; Only for Premium users available, but i HAVE Premium!

Edit; Okay that problem is away now, i disabled and enabled Browser Guard and it doesn't show this anymore. Not sure if it has something to do with this current problem.

Edit 2; I did do another test, i enabled Ransom protection, error from the service stopping, if you at this moment check Browser Guard, it says you don't have Premium. So yes something is going wrong with the connection from MWB to Browser Guard if i enable Ransom protection. If i leave the protection OFF then everything works good as it should.

Edited September 4, 2023 by SPDIF

[AdvancedSetup]

@lmacri

Please note the following shows up in your logs. I would recommend you check up on your drive for possible indication of drive failure

System errors:
=============
Error: (08/29/2023 01:43:17 PM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR9.

 

[SPDIF]

No problems seen anymore with me or clients, and Ransom Protection Disabled. We all have an backup these day's, i guess... Anyway this fixes the problem at moment.

In the mean time i did buy some new subscriptions! Thanks Malwarebytes for your ongoing hard work!

Edited September 5, 2023 by SPDIF

[lmacri]

On 9/3/2023 at 12:19 PM, lmacri said:

... I'm not sure what triggers these Malwarebytes Native Message Service errors that are logged in my Reliability Monitor and Event Viewer, but I ran several tests yesterday both with and without Malwarebytes Premium v4.6.1 and/or Firefox v117 running the background and couldn't reproduce the error, and this error hasn't been logged (yet?) on my system today (03-Sep-2023) since I powered on my system...

2 hours ago, SPDIF said:

No problems seen anymore with me or clients, and Ransom Protection Disabled. We all have an backup these day's, i guess... Anyway this fixes the problem at moment.

Hi AdvancedSetup:

Just an FYI that I haven't seen another "Malwarebytes Native Message Service - Stopped Working" error since 02-Sep-2023 @ 6:33 AM and all my protection modules are enabled in Malwarebytes Premium.  Only guessing, but I ran various tests on 02-Sep-2023 to see if I could trigger one of these errors (I couldn't) so if Malwarebytes didn't fix the problem on their end then it's possible the following sequence of events I tried got my message service back in sync:

1. Disabled Malwarebytes Premium setting at Security | Windows Startup | Launch Malwarebytes in the Background When Windows Starts.
2. Disabled Malwarebytes Browser Guard in all browsers (for Firefox, enter about:addons in adress bar; for MS Edge enter edge://extensions in address bar).
3. Re-started computer to prevent Malwarebytes Premium from loading at boot-up.
4. Re-enabled Malwarebytes Browser Guard in all browsers.
5. Re-enabled Malwarebytes Premium setting at Security | Windows Startup | Launch Malwarebytes in the Background When Windows Starts.
6. Re-started computer to allow Malwarebytes real-time protection to load at boot-up.

I power off my system every night and power on the next morning so I should have seen an error logged by now if they were triggered by a system restart as I originally suspected. I'll post back if I see these error messages re-appear in my Reliability Monitor.
----------
64-bit Win 10 Pro v22H2 build 19045.3324 * Microsoft Defender v4.18.23080.2006-1.1.23080.2005 * Malwarebytes Premium v4.6.1.280-1.0.2117 * Macrium Reflect Free v8.0.7279 *  Dell Inspiron 5583/5584 BIOS v1.22.1 * Firefox v117.0.0 * Malwarebytes Browser Guard for FF v2.6.9
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[lmacri]

21 hours ago, AdvancedSetup said:

@lmacri

Please note the following shows up in your logs. I would recommend you check up on your drive for possible indication of drive failure

System errors:
=============
Error: (08/29/2023 01:43:17 PM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR9.

Hi AdvancedSetup:

Thanks for the heads up. I checked those intermittent errors in my Event Viewer and they all appear to be associated with HardDisk1.  According to Disk Management (Start | Windows Administrative Tools | Computer Management | Storage) my internal Toshiba SSD is HardDisk0 and HardDisk1 is only detected if I plug in an external USB drive, so I suspect the controller error is for a USB port or an old Verbatim 500 GB USB 2.0 external backup drive with a spinning HDD platter I purchased several years ago that I occasionally plug in.

In the mean time can you suggest some sort of stress test that would be appropriate for an internal NVMe SSD? HWiNFO, ClearDIskInfo and Crystal Disk Info didn't find any obvious problems with my SSD, and the ePSA (enhanced Pre-boot System Assessment) hardware test I ran from my Dell BIOS didn't report any issues, but none of these diagnostics are very robust.
----------
64-bit Win 10 Pro v22H2 build 19045.3324 * Microsoft Defender v4.18.23080.2006-1.1.23080.2005 * Malwarebytes Premium v4.6.1.280-1.0.2117 * Macrium Reflect Free v8.0.7279 *  Dell Inspiron 5583/5584 BIOS v1.22.1 * Firefox v117.0.0 * Malwarebytes Browser Guard for FF v2.6.9
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[AdvancedSetup]

No, sadly I cannot recommend a better product. The vendors themselves have really almost walked away from providing good solid tools to test modern SSD, NVMe drives

The external USB as you said - depending, could be due to the port if this is a Laptop as those often wear out quickly, or it could be the drive.

You can plug the USB drive in and then issue a FULL disk check so that way it will mark any bad data areas and no longer report them. Bellow, assuming it comes up as the D: drive. Adjust as needed.

CHKDSK D: /R

 

[NewTricks]

My two cents. I have not disabled anything, but left everything as it was for a 3 days.  This is a new file, run just now, in case something had changed.

Thanks. I'm hoping for a sanctioned "fix."

mbst-grab-results.zip

Edited September 12, 2023 by NewTricks
hoping to copy file

[Porthos]

I do not have any of the errors on my Win 10 system.

[AdvancedSetup]

Thank you for the report and log @NewTricks

We are actively investigating the issue. Hopefully we'll find the root cause and get a fix soon

 

[beahaven]

This is happening to both my computers. I am a senior with only basic computer knowledge. Is there anything I can do besides wait for Malewarebytes to correct some error?

[Porthos]

3 minutes ago, beahaven said:

Is there anything I can do besides wait for Malewarebytes to correct some error?

Please do the following so that we may take a closer look at your system.

Please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply
  
   

Thank you

[beahaven]

mbst-grab-results.zip Here is the file.

[AdvancedSetup]

Thank you for the log @beahaven

I will submit it to our internal team for review

 

[SPDIF]

@AdvancedSetup I will try to get some logs for you, but i am out of time at moment with my father being in the hospital. I know the more logs, the more information you have to find the problem.

Have a nice day, Ron

 

Edited September 5, 2023 by SPDIF

[AdvancedSetup]

Thank you @SPDIF but no rush. We have several from the help desk as well.

Take care of you and father and family first. All these annoying computer issues in our lives can come later

Hope all is well and a good recovery if the case may be