Malwarebytes Service Freezing Computers

[forkies]

Hi all,

 

Bit of an issue today. We have Malwarebytes Enterprise for anti-malware protection on all of our staff machines. This morning I have had complaints about staff laptops and desktops freezing and becoming unusable, some have recovered after 10-20 minutes. If I boot without the "MBAMService" running it works perfectly, I have logged a support ticket with Malwarebytes but hoping someone on here might have some ideas. This is affecting a growing number of computers like it is spreading.

 

As a precaution I have disabled the staff network completely to stop anything potentially spreading, my initial thoughts are either a virus is attacking the malwarebytes service or a bug in the malwarebytes service.

 

I have reinstalled the client on a laptop and it instantly starts freezing up again after completion. If I stop the service from starting up and then start it after 5-10 minutes the same happens so it is not a clash on services starting up. I have also disabled everything from starting up and just left MBAMService on and it happens.

 

Any thoughts or common problem solutions would be greatly appreciated while I wait for Malwarebytes support.

 

Thanks,

Tom

[thewarden]

Same issue here. occurring on 2.5% of the 10,000+ deployed with MBAM and MBAE. Been uninstalling left and right. People are pissed. Case with MB has been opened for several weeks. Thought it was a AE patch / version issue. We are checking / expanding our McAfee VSE file & process exclusions. Users have to hard shutdown, reboot, enter bit locker pw, leave the machine at CTRL+ALT+DEL. We issue an uninstall from the MB console and remotely disable bit locker and force a reboot.

Everything works after that but no MB protection installed at that point.

Let me know if you have further info or figure out.

Regards,

TW

Edited January 20, 2017 by thewarden

[forkies]

Yes. Sorry should have posted an update. So basically MS released a definitions update that conflicted with MBAM and still to date hasn't rectified their definitions.

 

To fix you have to add exclusions of various into both MBAM and MSE/SCEP, which is very easy if you have SCCM and MB Enterprise console however your clients have to be responsive enough to pick up the update too, so for us it took about a day or two for it to filter down. As a work around to waiting you can boot into safe mode and disable MBAM from starting (SCEP starts even if you disable it, or at least it did on ours so no point) then load the exclusions to that machine using an exported Registry file and then start the service automatically again and give it a restart.

 

The link to the updated exclusions page (it was out of date before which is why it affected people even with the exclusions suggested in place) is here:

To be excluded in SCEP/MSE or other: https://support.malwarebytes.com/customer/portal/articles/1986791-what-exclusions-should-i-add-for-my-antivirus-when-using-malwarebytes-endpoint-secuirty-?b_id=6520

 

The support forum article about this issue as it happened: https://forums.malwarebytes.com/topic/190771-malwarebytes-and-microsoft-security-essentials-conflicts/

 

I would also suggest adding your SCEP or equivalent to the MBAM exclusions to stop a lockup conflict.

 

Hope this helps.

Tom

[kevin_lane]

Glad I haven't brought MalwareBytes as was going to

[AJWhite1970]

I've got several machines crashing on mbam.exe today, will be going through those forum posts tonight...

 

Thanks for the heads-up

[thewarden]

In all fairness to MB, their products are great. There are some road bumps but for the most part, impressed with the scans and quarantined items MB caught but McAfee VSE & HIPs did not catch. The console is a bit klunky and needs a little work. We dont have MS Security essentials installed but i'm blaming McAfee.

[forkies]

Glad I haven't brought MalwareBytes as was going to

 

I am completely for MB their products are great and beat any other products we have used in the past. This issue is purely down to other companies products conflicting after definitions updates and their support quickly identified the issue and posted openly their updates on their forum.

 

I would strongly recommend MB.

[kevin_lane]

Sorry it wasn't a dig at MB just that I was going to purchase MB for the school but wow expensive isn't the word I know MB is good just a shame this has happened to some of you