PROGRAM_ERROR_LOAD_DATABASE

[Gators]

I have a server with windows server 2003 that had some folders set to invisible mode, something I've noticed malwares doing recently. So I decided to run a malwarebytes scan. But I absolutely cannot get Malwarebytes to run at all.

The error I consistently get is:

An error has occurred. Please report this error code to our support team.

PROGRAM_ERROR_LOAD_DATABASE (8, 8, CreateSKD)

Not enough storage is available to process this command.

Here's what I've done.

I've run a Symantec antivirus scan, nothing turned up.

I've uninstalled and reinstalled, it fails when doing a definitions update.

I've deleted the rules.ref file, it tries to update, and fails.

I've tried copying an updated rules.ref from another server, I still get the same error.

How do I resolve this issue?

[Firefox]

As a licensed reseller, affiliate, corporate\business, non-profit or government user or tech shop, your current inquiry is eligible for Malwarebytes’ Corporate support. To qualify for business support services, you MUST HAVE a valid annual subscription and able to provide the following information for verification purposes.

Cleverbridge Order Reference Number:

Organization name:

Approved Contact name:

To contact our Corporate Support Team, please send an email with the above requested information to the following address:

corporate-support@malwarebytes.org or by going to the Malwarebytes Commercial Support site Right HERE

[Gators]

I'm not asking as a business, I'm asking as a user.

[exile360]

Greetings Gators

Please do the following:

Create a DebugView Log:

• Download DebugView by Microsoft Sysinternals from here and save it to your desktop
  
• Double-click on DebugView.exe to run it Note: If using Windows Vista or Windows 7 you must right-click on it and choose Run as administrator
  
• Click on Capture at the top and click once on each of the following so that they are checked:
  
  • Capture Win32
    
  • Capture Global Win32
    
  • Capture Kernel
    
  • Enable Verbost Kernel Output
    
  • Pass-Through
    
  • Capture Events
    

  [*]Click on File at the top and select Log to File As...

  [*]In the box that pops up, click on the ... button to the right of where it says Log File:

  [*]Browse to your Desktop and name the log MBAM Debug and click on Save

  [*]Make certain that Unlimited Log Size is selected and click on OK

  [*]Replicate the error message by trying to open/update MBAM and click on OK to the error message

  [*]Once that is complete, close DebugView and right-click on the MBAM Debug.log file now located on your desktop and hover your mouse over Send to and choose Compressed (zipped) folder

  [*]Attach the MBAM Debug.zip file you just created to your next reply

Thanks

[Gators]

Here it is.

[Gators]

I suppose it would help if after browsing for the file, I actually clicked the attach this file button.MBAM Debug.zip

[exile360]

Thanks Gators

I've submitted your log to the developers for analysis, hopefully it will help us to figure out why this is happening so we can get it resolved.

[exile360]

Hello again. It seems there's no output from MBAM in that DebugView log.

Please try the process described here once more, this time making sure not to open Malwarebytes' Anti-Malware until DebugView is already open and logging.

Thanks

[Gators]

I did as instructed again, and here is how it happened:

I do the save as, the log window stays blank.

I go to run the malwarebytes program through the start menu, the first 6 lines of the log are created. I wait a while for the program to actually open. This is a long wait.

This time I decided to open the task manager to watch the mbam.exe process. It is sitting there, the amount of memory it is using continues to grow. It got past 900,000 k before it failed.

I then get the error message. I click ok. Error message goes away, that's that.

I close the debug tool, this time my log file is smaller than the last. Only those 6 lines.

[\\SLZTS4]

00000001 0.00000000 [4408] SNACNP::NPGetCaps::WNNC_NET_TYPE

00000002 0.00010162 [4408] SNACNP::NPGetCaps::WNNC_USER

00000003 0.00020087 [4408] SNACNP::NPGetCaps::WNNC_CONNECTION

00000004 0.00029937 [4408] SNACNP::NPGetCaps::WNNC_ENUMERATION

00000005 0.00039789 [4408] SNACNP::NPGetCaps::WNNC_ADMIN

00000006 0.00049620 [4408] SNACNP::NPGetCaps::WNNC_DIALOG

I am doing as you ask, and this is the log you get from the process you instructed me to do.

To further troubleshoot and help you, so that I can try to give you more to go on, I'm going to delete rules.ref, and repeat the procedure.

It finds the database isn't there and tries to download a new one.

It downloads, 6.99 MB

Nothing shows up in the log through all of this.

Then it downloads 9.40 MB

In installs the latest version. Was there a recent update? I could have sworn I installed the latest version a few days ago when I did an uninstall, clean, and reinstall.

After the install, those same 6 log lines appear again.

Stuck again, black rectangle in the middle of the screen.

This time, there are 3 processes running in the task manager, mbam.exe, mbam-setup.exe, and mbam-setup.tmp. But there isn't a steady growth of memory use for any of them.

Still waiting...

Holy crap, woot bag of crap is up (not related to case)

Can't get buy page for the crap to load (still not related to case)

Memory is starting to grow for the mbam.exe process, up to 400,000 K.

Memory got over 950,000 K, suddenly drops.

Idling at 82,020 K.

At some point while the memory was growing, the same 6 lines were logged again, so 12 lines of log now.

Oh, there it is....error message shows up again, under the log program. Same error as always.

I click ok, the setup in the task bar goes away, all is closed.

Log once again is:

[\\SLZTS4]

00000001 0.00000000 [5100] SNACNP::NPGetCaps::WNNC_NET_TYPE

00000002 0.00009991 [5100] SNACNP::NPGetCaps::WNNC_USER

00000003 0.00020006 [5100] SNACNP::NPGetCaps::WNNC_CONNECTION

00000004 0.00029933 [5100] SNACNP::NPGetCaps::WNNC_ENUMERATION

00000005 0.00039865 [5100] SNACNP::NPGetCaps::WNNC_ADMIN

00000006 0.00049789 [5100] SNACNP::NPGetCaps::WNNC_DIALOG

00000007 506.15301514 [3128] SNACNP::NPGetCaps::WNNC_NET_TYPE

00000008 506.15313721 [3128] SNACNP::NPGetCaps::WNNC_USER

00000009 506.15322876 [3128] SNACNP::NPGetCaps::WNNC_CONNECTION

00000010 506.15328979 [3128] SNACNP::NPGetCaps::WNNC_ENUMERATION

00000011 506.15341187 [3128] SNACNP::NPGetCaps::WNNC_ADMIN

00000012 506.15350342 [3128] SNACNP::NPGetCaps::WNNC_DIALOG

00000013 740.25268555 [5620] SNACNP::NPGetCaps::WNNC_NET_TYPE

00000014 740.25280762 [5620] SNACNP::NPGetCaps::WNNC_USER

00000015 740.25286865 [5620] SNACNP::NPGetCaps::WNNC_CONNECTION

00000016 740.25292969 [5620] SNACNP::NPGetCaps::WNNC_ENUMERATION

00000017 740.25305176 [5620] SNACNP::NPGetCaps::WNNC_ADMIN

00000018 740.25311279 [5620] SNACNP::NPGetCaps::WNNC_DIALOG

Sorry I can't provide you with a more useful log, but hopefully with this info we can determine what to do next to continue troubleshooting.

[exile360]

OK, now that version 1.51.2 (the update) is installed, please reboot your computer, delete rules.ref, and try the process you described above once more and post back the results. The new version has additional debugging capabilities so hopefully it will show some info in DebugView.

Thanks

[Gators]

Ok. Only 2 new lines this time.

[\\SLZTS4]

00000001 0.00000000 [5720] SNACNP::NPGetCaps::WNNC_NET_TYPE

00000002 0.00010929 [5720] SNACNP::NPGetCaps::WNNC_USER

00000003 0.00021536 [5720] SNACNP::NPGetCaps::WNNC_CONNECTION

00000004 0.00032298 [5720] SNACNP::NPGetCaps::WNNC_ENUMERATION

00000005 0.00042906 [5720] SNACNP::NPGetCaps::WNNC_ADMIN

00000006 0.00053504 [5720] SNACNP::NPGetCaps::WNNC_DIALOG

00000007 212.33447266 [928] LUMan: Client has a LU schedule

00000008 212.33505249 [928] LUMan: Client has a LU schedule

[exile360]

Thanks

For the next step, let's try exclusions in Symantec. I'm not sure which version you're using, but a guide to setting exclusions for many AV's can be found in our FAQ here.

Primarily, you want to make certain that mbam.exe is fully excluded from your AV and any software firewall you might be using.

[Gators]

Ok, did that. Same results. No change.

[exile360]

Unfortunately I'm a bit out of my element on this one. I'm not familiar with Server versions of Windows, and I'm guessing you're also using a corporate version of Symantec Antivirus (since you didn't call it Norton Antivirus, though I could be mistaken) which I'm also not too familiar with.

On that note, please contact corporate-support@malwarebytes.org and they should be better equipped to assist you in getting this issue resolved.

Thanks

[Gators]

But that's a pay service.

That's not going to help me in this case.

If I can't get help resolving this issue, then at least hide this thread from view until I can come back here with a resolution. There's nothing I hate more than finding a forum thread with my problem, only to find it end without a solution, and I don't want to cause that frustration for others.

[exile360]

corporate-support@malwarebytes.org is not a paid service, they are our support team for corporate customers and they deal with Server versions of Windows so they will be best equipped to assist you.

[Gators]

I got the impression they are since they are asking for an order reference number.

[exile360]

No, a reference number is simply a number provided you after you've purchased Malwarebytes' Anti-Malware. It will be contained in the email you received from CleverBridge when you made your purchase, though if necessary, they can look it up for you as well .

[AdvancedSetup]

Hello Gators,

I have already replied to your email on the corporate help desk.

The reason we ask for a Cleverbridge reference number is to confirm your license order is correct.

We often find corporate customers that have purchased the consumer version which is not the same and we can then have sales work with you to obtain the proper licensing and program version.

Windows Server 2003 is not a consumer operating system either.

If you have other issues or concerns I can address them for you in your support ticket. I will go ahead and close this topic now as you are now being assisted on the help desk.

Thank you.