Malwarebytes a publié ce Week End une mauvaise mise à jour logicielle pour Windows. Elle est à l’origine d’un bug provoquant une utilisation élevée du processeur. La défaillance concerne « mbamservice.exe ». Un update d’urgence est publié pour corriger le problème.
Il n’a pas fallu attendre bien longtemps avant que les rapports se multiplient. Malwarebytes a publié ce Week End une mise à jour problématique. Son installation est à l’origine d’un dysfonctionnement. Il provoque une utilisation intensive du processeur au point où certains ordinateurs deviennent inexploitables.
Malwarebytes et Windows, un correctif d’urgence est publié
Une solution est désormais disponible pour résoudre la situation. Il est recommandé aux utilisateurs d’installer les mises à jour les plus récentes et de redémarrer les ordinateurs. Malwarebytes indique que deux redémarrages du PC seront peut-être nécessaires.
Si cette procédure ne fonctionne pas, il y a une autre solution. Il est nécessaire de télécharger et exécuter MB-CLEAN. Enfin si cette seconde solution ne fait pas de différence, l’entreprise indique qu’il est nécessaire de prendre contact avec ses services.
A noter qu’une solution de contournement temporaire pour déployer la dernière mise à jour est de désactiver la protection Web. Il faut se rendre dans « Paramètres> Protection ». Il est possible aussi de tenter la mise à jour à partir du mode sans échec.
Procédure avec le MBMC
Enfin Malwarebytes détaille la procédure pour ses clients professionnels exécutant Malwarebytes Management Console (MBMC
For corporate customers running the on-premise Malwarebytes Management Console (MBMC)
In the Malwarebytes Management Console, edit the Policy and disable real-time protection Once real-time is protection is disabled and your clients can communicate, highlight the endpoints on the Client tab and click the Update Database button at the top. This should fix it for most endpoints. If any endpoints fail to get the update, you will have to force an update. This can be done locally on the endpoint or remotely over the network.
- Locally on the endpoint (logged in to the machine). You can point your endpoint users to do this themselves:
- Download and execute MBAM Rules Offline Updater
- Reboot the computer
- Remotely over the network
- Make sure your admin machine is on a non-blocked IP (i.e. 10.x.x.x or 192.x.x.x). Blocked IP ranges are from 128.x.x.x to 191.x.x.x.
- Download the following script and extract it to a folder on your computer
- Create a file named hostnames.txt in the same folder, adding one IP per line for each of your endpoint IPs
- If your internal DNS is not on a blocked IP range, you can feed hostnames.txt with hostnames instead of IPs
- Edit the script and type in the *LOCAL* admin username and password for endpoints (i.e. NOT the domain admin) in the first 2 lines
- Run the batch file, which will delete the faulty database file and schedule a reboot in 30 seconds
Once all the machines are updated, turn on real-time protection in the Management Console Policy settings.
For corporate customers running the cloud-based Malwarebytes Endpoint Protection (aka Malwarebytes Cloud Console)
In the Malwarebytes Cloud Console, go to Settings -> Policy and disable Web Protection and Self-Protection (if enabled). Do this for all the Policies On the Endpoints section, choose “select all” and choose “Check for Protection Updates” from the Actions button. This should fix it for most endpoints. If any endpoints fail to get the protection updates, you will have to force an update. This can be done locally on the endpoint or remotely over the network.Locally on the endpoint (logged in to the machine). You can point your endpoint users to do this themselves:
- Login to the machine and start a scan by right-clicking on the Malwarebytes traybar icon. This will force an update and fix the issue.
- Cancel the scan and reboot the machine. This should fix the problem in most cases.
- If the above doesn’t work or the machine is unresponsive, download mbep-fixer.exe to your Desktop:
- Copy it to your C:\Program Files\Malwarebytes\Anti-Malware\ directory (downloading directly to C:\Program Files\ folders won’t work)
- Execute mbep-fixer.exe. You will need to execute this as admin.
- Reboot.
- Remotely over the network
- Make sure your admin machine is on a non-blocked IP (i.e. 10.x.x.x or 192.x.x.x). Blocked IP ranges are from 128.x.x.x to 191.x.x.x.
- Download the following script and extract it to a folder on your computer
- Create a file named hostnames.txt in the same folder, adding one IP per line for each of your endpoint IPs
- If your internal DNS is not on a blocked IP range, you can feed hostnames.txt with hostnames instead of IPs
- Edit the script and type in the *LOCAL* admin username and password for endpoints (i.e. NOT the domain admin) in the first 2 lines
- Run the batch file, which will delete the faulty database file and schedule a reboot in 30 seconds
Once all machines are updated and connecting correctly, go to the Cloud Console, Settings, Policy, and enable Web Protection and Self-Protection again.
