Malwarebytes Enterprise Update Issue

[forkies]

Hi all,

 

A heads up for anyone using Malwarebytes Enterprise Anti-Malware protection (MBAM) Just had all my servers stop working properly (I am at working sorting out my kitchen cupboard).

 

I have managed to identify that our Malwarebytes Enterprise has updated with Database version v2018.01.27.03 (Dated 2018/01/27 15:38:31 GMT).

 

This update appears to flag most server services and is blocking incoming connections for DNS and Exchange etc...

 

If you can get onto your server (I had to go through vSphere as all remote connections are blocked) and you manage to login, you can launch the Malwarebytes app, right click on the tray icon and untick "Website Blocking" which appears to fix the issue almost immediately.

 

I am raising a case with Malwarebytes Enterprise support as I type this.

 

Thanks,

Tom

[forkies]

Managed to get into the MBAM support forum and they have just raised the issue and a Dev has replicated the issue so working on a fix.

 

Link to forum post on MBAM support: https://forums.malwarebytes.com/topic/219923-issue-with-malwarebytes/

[Arthur]

Temporary fix...

 

Malwarebytes update causes severe rapid RAM leak

 

The Malwarebytes forum already has a large number of threads complaining about the issue, with one thread already over 17 pages long in just an hour. Some users also mention that it is maxing out the processor and disk usage, mainly due to it consuming the available virtual memory (disk swap file).

 

When Malwarebytes restarts, the web service disables itself and will no longer start. At present it also displays an error that it cannot contact the licence server. This is likely due to the server being overloaded from the large number of customers affected with the product restarting and crashing in a loop.

 

For those affected, the only way to stop the issue is to either uninstall Malwarebytes or disable its service.

 

To disable the Malwarebytes service, go into the Windows Services (Press the Windows Key + ‘R’, type in “services.msc” and click ‘OK’). Look for the Malwarebytes service, right-click it and go into ‘Properties’. Change the ‘start-up type’ field to disabled:

 

 

Open up the Windows Task Manger (Press Shift + Ctrl + ESC) and sort by memory usage. Right-click the RAM hogging Malwarebytes service and click ‘End Task’:

 

 

When Malwarebytes fixes the issue, just re-enable the service by following above steps, but change the ‘Startup type:’ back to ‘Automatic’. Then right-click the service and select ‘Start’. Then immediately perform a “Check for updates” from its task tray icon:

 

[forkies]

Thanks, already applied this fix to all servers. Updated client policies to have Web protection off. Unfortunately in testing I uninstalled MBAM from one server and it is still not working properly, I think it autoquarantined some services files and now having to potentially do a restore of system files.

[forkies]

Database update v12 fixes the issue! So if you have the latest update you are now ok.

[AJWhite1970]

Thanks for this, just got home to discover the MBAM logs on my Exchange server going nuts, thought my server had been compromised. Manually forcing an update now

[southhamster]

Updated info from malwarebytes re: this problem;

https://support.malwarebytes.com/

 

Going in early tomorrow to see what state our servers and admin pc's are in :-(

 

Always been a big fan of malwarebytes for finding and fixing things that other AV doesn't but I hope this mess-up is a one-off.

[forkies]

Updated info from malwarebytes re: this problem;

https://support.malwarebytes.com/

 

Going in early tomorrow to see what state our servers and admin pc's are in :-(

 

Always been a big fan of malwarebytes for finding and fixing things that other AV doesn't but I hope this mess-up is a one-off.

 

Well this is the second major issue I have had from them, the one before was the clash between Malwarebytes and Microsoft Endpoint which effectively killed all of our clients.