44 replies to this topic

[Swandog46]

We need your help.

We are trying to track down an issue where some users report Malwarebytes' Anti-Malware freezes during a scan. We think it may have to do with interference by the ZoneAlarm firewall.

If you are experiencing this problem, we would appreciate it greatly if you would gather some information for us, and then post it here. This is the the information we are looking for:

• Tell us if you are experiencing this problem, and describe it in detail please.
  
• Tell us if you have ZoneAlarm installed, and if it is enabled.
  
• Does the MBAM scan freeze always on the same file/object? If so, which one?
  
• Then please try the following debugging steps:
  
  • Open MBAM, go into the Settings tab and uncheck "Always scan memory objects".
    
  • Run a scan, and tell us if it still freezes.
    
  • Go back into Settings, and re-check "Always scan memory objects."
    
  • Then please uninstall ZoneAlarm completely, if you have it. Make sure to reboot afterwards!
    
  • Run an MBAM scan again, and tell us if it still freezes.
    
  • You can reinstall ZoneAlarm after completing the entire process.

Thank you very much. Help us to help you!

[Swandog46]

I repeat: please post in this thread only if you have this problem, have followed the steps in my first post, and have information to provide to us. Thank you!

[Husmusen]

I’ve problems with, I think Antivirus 360 and my broadband connection goes up and down. I read at some sites that Malwarebytes' Anti-Malware could do the trick. I downloaded the free version and tried to perform a full scan two times, both ended up whit a blue screen after 30 to 45 sec. I found this post then I checked this forum, and followed it. I’ve ZoneAlarm Internet security suite and it was enabled. Both times I got the blue screen it appeared for 2-4 sec so I didn’t see. After that I uncheck "Always scan memory objects". New scan and the computer restarted again after 30 to 45 sec. Re-checked "Always scan memory objects". Unistalled ZA and rebooted. New scan and the computer restarted again after 30 to 45 sec, now I think without the blue screen. My question is what I’m going to do now?

[Swandog46]

Husmusen, you have a different problem, one likely related to the malware you are infected with. This thread is only for people reporting the freezing bug I described. Can you please start a thread of your own in the Malware Removal forum? (Please read the pinned threads first to tell you where to start.) Thanks.

[i-dont-like-da-virus]

Yes, mine freezes on a Trojan.Fakealert file (C:/WINDOWS/TEMP/tmp4.tmp) when i click on the quarantine/delete thing after scanning, i have no zonealarm

[Swandog46]

i-dont-like-da-virus, did you follow all the steps in my first post? I am not sure this is the same problem. Yours freezes *after* the scan?

[toolboxx]

I've been experiencing this exact same problem with v1.31 when scanning different machines; all of which have ZA Integrity Agent v4.5 installed.
Just ran into this thread...glad someone is looking into this, MBAM rocks!

1) Anyway, the freeze issue would start about 5-10 seconds into the scan until a reboot is required/
2) It would hang on a different file every time, usually in C:\Windows\System32
3) Our platform is locked down for most users; only seems to freeze on users that have Admin rights (most have developer tools & tons of apps)
4) Unchecking "Always scan memory objects" makes no difference
5) On one machine - uninstalled ZA, rebooted, unchecked scan memory and scan extra & heuristics objects = still freezes with 12/12 rules.
6) All machines are XP SP2 with Symantec Corp. 10.1
7) The freeze causes MBAM hang as well as explorer, taskmgr, etc.
8) Eventually, the machine becomes completely unresponsive, WMI across the network fails, etc. and have to hit the power button.

I work for an extremely large enterprise and have been running MBAM mostly for Trojan.Vundo removal.

Hope this helps!
BTW, 1st post!

[AdvancedSetup]

Thanks for sharing.

You might be able to use Windows Perfmon and/or Process Monitor from Microsoft to help track it down since you seem to be able to duplicate it and as a Corporate Support you may have access to similar machines with this issue.
Process Monitor

[Swandog46]

I don't think Process Monitor will help. toolboxx, we're working on it and will get back to you -- perhaps you would be willing to help us debug? / run a debugging version to gather some information, when we have one?

[Blue-chan]

Hello everyone,

I decided to join this forum in order to reply to this topic; hopefully I'm not too late. It seems that I'm not the only one who experiences a problem with Malwarebytes' Anti-Malware freezing during a full scan.

Here's a complete (enough, I hope) detail on my error:

• I'm using ZoneAlarm Firewall, the free version.
  

  .

• Apparently MBAM doesn't only freeze in on one file. Over multiple attempted full scans, I've had it freeze at the following files:
  
  
  • C:\Psfonts\Pfm\ENGRTT__.PFM
    
  • C:\Psfonts\Pfm\Jazzet__.PFM
    
  • D:\Zone Labs\ZoneAlarm\MailFrontier\resources\otzaenu.dll
    
  • D:\Zone Labs\ZoneAlarm\repair\ (some hexadecimal name).key <--- it froze on one of the four *.key files, but I don't remember which and I couldn't get it to scan and freeze there again.

• When it freezes, it doesn't affect other parts of the computer. Only the MBAM window is frozen (it becomes white if I ever switch to other windows), and I can still do anything else normally.
  

  .

• Once I hit the "X" to close the window when it freezes, it comes up with the "This program is not responding". Hit "End now" and it'll come up with "Would you like to report this error to Microsoft?".

Hopefully that's helpful enough!

[acooldozen]

Which version of Zone Alarm Free are you using?

[Swandog46]

Blue-chan, did you try the debugging steps in my first post? Could you try them please and let us know if any work?

[Ernie B.]

[quote name='Swandog46' date='Dec 5 2008, 11:40 AM' post='38250']
We need your help.

We are trying to track down an issue where some users report Malwarebytes' Anti-Malware freezes during a scan. We think it may have to do with interference by the ZoneAlarm firewall.

If you are experiencing this problem, we would appreciate it greatly if you would gather some information for us, and then post it here. This is the the information we are looking for:
-----------------------------------------------------------------------------------------------
Windows 2000 Pro, 512 Mbytes RAM.

1. Tell us if you are experiencing this problem, and describe it in detail please.

Yes. The full scan freezes MBAM 20 minutes, 28 seconds into the scan, 75828 objects scanned. C:\Program Files\zone labs\repair\vsinit.dll is being scanned when it freezes. When MBAM freezes a buzzing sound is heard, apparently from a hard drive.

When things freeze up other windows may be opened but not closed. MBAM cannot be terminated, is non-responsive. Task manager shows that MBAM is "Not Responding" but "End Task" shows "Program cannot be closed..." The Process Manager will not end mbam.exe, shows "Access Denied". It is necessary to reset the computer

2. Tell us if you have ZoneAlarm installed, and if it is enabled.

Yes, both installed and enabled.

3. Does the MBAM scan freeze always on the same file/object? If so, which one?

The problem appeared the other day, didn't record the file it was scanning when it froze. The elapsed time was about the same.

4. Then please try the following debugging steps:
* Open MBAM, go into the Settings tab and uncheck "Always scan memory objects".

Done.

* Run a scan, and tell us if it still freezes.

Done. Did not freeze up. Log exerpt:

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 125845
Time elapsed: 24 minute(s), 23 second(s)

* Go back into Settings, and re-check "Always scan memory objects."

Done.

* Then please uninstall ZoneAlarm completely, if you have it. Make sure to reboot afterwards!

Done. ZA version:

ZoneAlarm version:7.0.483.000
TrueVector version:7.0.483.000
Driver version:7.0.483.000

* Run an MBAM scan again, and tell us if it still freezes.

Yes, MBAM freezes again. Same symptoms as above. It froze after 20 minutes, 54 seconds while scanning C:\Program Files\Winzip\WZCab3.dll. It had not found any infected files to that point.

[acooldozen]

ZoneAlarm 7.0.337.000 (free) installs a software called 'MailFrontier', (not sure if it is in the above version or not, but worth checking) which in turn installs a scanner & toolbar in Outlook. I am not sure if everybody wants that - I certainly don't!
Unlike with 7.0.302.000, there is no uninstaller in Add/Remove Programs. However, there is still a way to uninstall it:
Close Outlook
Windows Explorer, open C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier
Double-click UNWISE.EXE
When prompted for the install.log file, use C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\INSTMLF.LOG
on the MailFrontier uninstall panel, select Automatic [Next>], then [Finish]

[acooldozen]

Latest ZoneAlarm Free is ZoneAlarm Free 8.0.065.0 available at file Hippo.

[Ernie B.]

acooldozen, on Dec 16 2008, 03:47 PM, said:

ZoneAlarm 7.0.337.000 (free) installs a software called 'MailFrontier', (not sure if it is in the above version or not, but worth checking) which in turn installs a scanner & toolbar in Outlook. I am not sure if everybody wants that - I certainly don't!
Unlike with 7.0.302.000, there is no uninstaller in Add/Remove Programs. However, there is still a way to uninstall it:
Close Outlook
Windows Explorer, open C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier
Double-click UNWISE.EXE
When prompted for the install.log file, use C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\INSTMLF.LOG
on the MailFrontier uninstall panel, select Automatic [Next>], then [Finish]

Thanks. I found a MailFrontier folder, even though I opted not to install the toolbar when I reinstalled ZA. I don't use Outlook so the toolbar has never been an issue, but the less junque the better.

[Ernie B.]

acooldozen, on Dec 16 2008, 03:50 PM, said:

Latest ZoneAlarm Free is ZoneAlarm Free 8.0.065.0 available at file Hippo.

Yeah, I know. That version won't install on Windows 2000, requires XP or Vista. Bummer!

[Swandog46]

Thank you Ernie B. We are working on it!

[RubbeR DuckY]

Yes, thanks to everyone! Additional information helps us resolve this issue.

[Dennis9900]

1. Tell us if you are experiencing this problem, and describe it in detail please.
2. Tell us if you have ZoneAlarm installed, and if it is enabled.
3. Does the MBAM scan freeze always on the same file/object? If so, which one?
4. Then please try the following debugging steps:
* Open MBAM, go into the Settings tab and uncheck "Always scan memory objects".
* Run a scan, and tell us if it still freezes.
* Go back into Settings, and re-check "Always scan memory objects."
* Then please uninstall ZoneAlarm completely, if you have it. Make sure to reboot afterwards!
* Run an MBAM scan again, and tell us if it still freezes.
* You can reinstall ZoneAlarm after completing the entire process.

1.
- Experienced lockup during full scan using Malwarebytes Anti-Malware (MBAM) with database 1507
- MBAM stopped responding while showing:
Currently scanning:
C:\System Volume Information\MountPointManagerRemoteDatabase
- I ran the full scan because earlier in the day NTBackup froze and did not complete backup on the same file
- Since posting last night I used Microsoft KB30951 to gain access to C:\System Volume Information
- MountPointManagerRemoteDatabase is a 0 byte file used by System Restore
- PC is Dell GX270, XP Pro SP3, ZoneAlarm as described below
- Ran MBAM full scan on another PC (HP ze4900 laptop) running same MBAM and ZoneAlarm with no problem.
- Ran MBAM quick scan on another PC (Compaq 2175 laptop) running same MBAM and ZoneAlarm (I have a 3-user pack) with no problems.

2.
- ZoneAlarm Security Suite version 8.0.059.000
- TrueVector security engine version 8.0.059.000
- Driver version 8.0.059.000
- Anti-virus engine version 6.0.2.678, DAT file version 965821969
- Anti-spywre engine version 5.0.202.0, DAT file version 01.200812.5015
- AntiSpam version 5.0.61.9957

Note: ZoneAlarm was shut down during this run and the network cable was unplugged.

3. No, MBAM stops at a different spot this time.

4.1 Unchecked "Always scan memory objects".
4.2 Ran a full scan, still freezes on a different file yet.
4.3 Re-checked "Always scan memory objects".
4.4 Uninstall ZA. Not yet. Before uninstalling I need to make sure all my firewall rules and settings are preserved.

Thanks,
Dennis