MBAM updating on XP Pro x64 crash

[Jim-1]

Data base updates after 10/15/2010 cause MBAM to crash with a database error on my computer running XP Pro x64. That error was reported in the thread below:

http://forums.malwarebytes.org/index.php?showtopic=65154

After much wasted time (both mine and MBAM tech support) and troubleshooting effort, I found an older MBAM database update from 10/15/2010 on a different computer and I copied that database file (Rules.Ref) to my XP Pro x64 computer. With the older Rules.Ref database file (version 4844), MBAM now works well again. If I try to update to a later database file, however, I get the same database error and MBAM stops working until I restore Rules.Ref to 10/15/2010 or earlier.

The database versions after 10/15/2010 (version 4844) must contain defective code that crashes MBAM on systems running XP Pro x64. Hopefully, the MBAM staff will find and correct that error so I can update my database once again.

[Haider]

Hello Jim-1:

Did you follow exile360 directions in previous thread. With due apologies your statement "The database versions after 10/15/2010 (version 4844) must contain defective code that crashes MBAM on systems running XP Pro x64" is incorrect it must be something else, you are not the only user running MBAM on Windows XP 64-bit i.e. so far I haven't seen any complaints

I'd suggest if you are being helped by tech support please continue with them, else follow what exile360 has mentioned. In the meantime please provide following information someone will help you:

1. What is your system locale
   
2. Installed Security Product(s) including Firewall
   

You need to add following exclusions in your AV for MBAM to avoid conflict if any

• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\SysWOW64\drivers\mbamswissarmy.sys
  

Note: If using a third part software firewall then you also have to exclude MBAM.EXE from it

Should you have any other question(s) please post back using button

[Jim-1]

Hello Jim-1:

Did you follow exile360 directions in previous thread.

Thanks for your quick reply. Yes. I followed the instructions to scrub MBAM traces out of my computer. Then I reinstalled MBAM to the default location. MBAM crashed again with a database error immediately after completing the download of the current rules.ref file.

With due apologies your statement "The database versions after 10/15/2010 (version 4844) must contain defective code that crashes MBAM on systems running XP Pro x64" is incorrect it must be something else, you are not the only user running MBAM on Windows XP 64-bit i.e. so far I haven't seen any complaints

You may be right, but it is very difficult for me to see how this could be a problem with my computer since MBAM continues to run perfectly now, as it has done for many months, with rules.ref dated 10/15/2010 or earlier. MBAM only crashes again with a database error immediately after completing the download of a later rules.ref file. That sure looks like a problem with the way the recent rules.ref does not work properly with my XP Pro x64 system. FYI, there were few souls brave enough to try the XP Pro x64 OS considering the problems most have had with software incompatibility. Most of the early XP Pro x64 users have already switched to Win 7, so there are likely to be very few XP pro x64 users remaining. Of those few x64 users, only a small number are likely to be using MBAM. Of that tiny data set, some may have experienced the same problem which began only on Saturday, but simply not yet reported it. Silence from the XP Pro x64 community (small as it is) is not the same as a positive statement from active XP Pro x64 users that all is well.

I'd suggest if you are being helped by tech support please continue with them, else follow what exile360 has mentioned. In the meantime please provide following information someone will help you:

1. What is your system locale
   
2. Installed Security Product(s) including Firewall
   

You need to add following exclusions in your AV for MBAM to avoid conflict if any

• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\SysWOW64\drivers\mbamswissarmy.sys
  

Note: If using a third part software firewall then you also have to exclude MBAM.EXE from it

Should you have any other question(s) please post back using button

I will continue to work with the tech service rep, but I doubt that the result will be a problem with my computer. Here is the information you requested above:

* My computer is currently located in Santiago, Chile.

*AVG 2011 anti virus and Outpost Firewall 2009

* As part of the initial troubleshooting process for this problem, I added the exclusions to AVG, even though MBAM worked perfectly for many months with no exclusions added.

[noknojon]

Hi Jim-1 -

This item has been found to repair the fault in an (05) error message item most times -

Please try it -

Show Hidden Files and Folders in Windows XP:

• Click Start and select My Computer
  
• Click the Tools item from the menu at the top of the window (if you don't see Tools press the Alt key on your keyboard and it will appear)
  
• Select Folder Options
  
• Click the View tab and make sure Show hidden files and folders is selected under Hidden files and folders
  
• Next, uncheck the box next to Hide protected operating system files (Recommended)
  
• Then, uncheck the box next to Hide extensions for known filetypes
  
• Click Apply then click OK
  

Then go to C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware and delete rules.ref.

Once you've done that, start MBAM and when it shows the error and asks to update, let it do so and see if that corrects it.

Reset Hidden Files and Folders in Windows XP:

• Click Start and select My Computer
  
• Click the Tools item from the menu at the top of the window (if you don't see Tools press the Alt key on your keyboard and it will appear)
  
• Select Folder Options
  
• Click the View tab and make sure Do not show hidden files and folders is selected under Hidden files and folders
  
• Next, check the box next to Hide protected operating system files (Recommended)
  
• Then, check the box next to Hide extensions for known filetypes
  
• Click Apply then click OK
  

Also in Control Panel , please check that you have the right settings for Regional and Language Settings -

Thank You -

[Jim-1]

Hi Jim-1 -

This item has been found to repair the fault in an (05) error message item most times -

Please try it -

Thanks for the suggestion. Rules.ref and I have had frequent encounters over the past two days of troubleshooting. I must have deleted rules.ref a dozen times. The result is always the same: When I replace a newer rules.ref with a copy of version 4844 (from 10/15/2010), MBAM is happy and it works great! When I update (or replace) rules.ref with a more recent version, I immediately get the same database error. Versions 4844 (from 10/15/2010) or earlier work AOK. Any more recent version of rules.ref crashes MBAM with a database error in my XP Pro x64 system. I continue to think there is a problem with updates of rules.ref after Friday 10/15/2010.

[noknojon]

I continue to think there is a problem with updates of rules.ref after Friday 10/15/2010.

Hi again -

Just a quick reply - There has been no other question/problem on this particular item so far in any amount -

I update every day without problems - There will be a fix and I will check back later -

Please note my item under the Rules.ref repair to check your settings for Regional and Language Settings in Control Panel -

Thank You -

[Jim-1]

Please note my item under the Rules.ref repair to check your settings for Regional and Language Settings in Control Panel -

I am not sure what to check for in Regional and Language Settings. I look at them, and they are still set to USA English, which is exactly what I have always used. On the off chance that it might matter, I added Chile Spanish too. I then tried to update MBAM, but it crashed again immediately after rules.ref loaded. Once again, MBAM returned to proper operation when I copied the 10/15/2010 rules.ref back again.

If there is anything I need to do with Regional and Language Settings, please tell me what to do and how to do it. Thanks!

[yardbird]

@ Jim-1

I sent you to the Malware Removal Forum on 10/17, you never went

[Haider]

*AVG 2011 anti virus and Outpost Firewall 2009

The real culprit in your case could be AVG2011 there is a known issue that is being worked on, hope this will help. In the meantime you may switch to anyone of the following free versions of AV (listed in alphabetical order):

1. avast
   
2. Avira
   
3. MSE
   

Please don't forget to add recommended exclusions and also allow mbam.exe in firewall

Kindly try above mentioned before reporting to HijackThis Logs. Please post back using button

[Jim-1]

@ Jim-1

I sent you to the Malware Removal Forum on 10/17, you never went

Sorry, but just like everyone else, I have limited time, so I need to limit my activities in areas that are not likely to be productive. I think there is a very low probability that my computer is infected. Even if my computer did have some form of malware, I think the probability is approximately zero that the malware would cause the MBAM database to crash only with versions of rules.ref that are more recent than 10/15/2010. I do not have time to do everything, so I will postpone a search for malware, which is not likely on my computer, at least until I see more evidence that malware is likely to be present.

[Jim-1]

The real culprit in your case could be AVG2011 there is a known issue that is being worked on, hope this will help. In the meantime you may switch to anyone of the following free versions of AV (listed in alphabetical order):

1. avast
   
2. Avira
   
3. MSE
   

Please don't forget to add recommended exclusions and also allow mbam.exe in firewall

Kindly try above mentioned before reporting to HijackThis Logs. Please post back using button

Thanks for the other AV programs. I will check them out when i have a problem with AVG 2011. Most of the free or paid AV programs do not support XP Pro x64, so I cannot use one of those. AVG seems to be working well on my computer for now, so I am not inclined to change to something else until I see a problem that needs to be fixed. The Outpost firewall asked about allowing MBAM when I first installed it, and it has exclusions for MBAM in place.

[Haider]

Hello Jim-1:

All of the above mentioned support Windows XP 64-bit. I am unsure how could you single out that the problem is with "MBAM updates after 10/15/10 crash on XP Pro x64", we would like to hear how you have isolated this problem i.e. this isn't AVG2011 or its updates

I would also suggest you to read AVG 2011 Free vs. Malwarebytes and AVG 2011 Resident Shield - File Exclude List Feature Removed! both from AVG Official Forums

Please post back using button

[noknojon]

Most of the free or paid AV programs do not support XP Pro x64, so I cannot use one of those.

Sorry to pick you up on this , but you will find that Most A/Virus programs will run on a fully updated XP SP3 -

I run M.S.E. (live link in my signature) also Avira and Avast both run on my system -

I also have friends with Kaspersky , CA Internet Security (I don't like it) , and several others -

A fully updated XP SP3 (did you ever say you have All current updates after 10/15/2010) will run all of these programs -

Do you have Automatic updates turned on ?? If not there has been many updates since then -

Thank You -

[YoKenny1]

noknojon

Please read:

64-Bit Windows XP Service Pack 3?

http://www.start64.com/index.php?option=com_content&task=view&id=1709&Itemid=98

Key comment

The Redmond company is currently cooking the third and final service pack for Windows XP, but just the 32-bit version of the operating system, the one made available all the way back in 2001. Users should not expect the Redmond company to release SP3 for Windows XP Professional x64 Edition by mid 2008, because that will definitely not be the case.

[Jim-1]

noknojon

Please read:

64-Bit Windows XP Service Pack 3?

http://www.start64.com/index.php?option=com_content&task=view&id=1709&Itemid=98

Key comment

Agreed, and thanks for the clarification. My computer is running XP Pro x64 SP2 as shown in the screenshot below.

[Jim-1]

Sorry to pick you up on this , but you will find that Most A/Virus programs will run on a fully updated XP SP3 -

No problem. I expect to be corrected when I make a mistake. I am not yet convinced, however, that I have made a mistake here. My search for a free antivirus program that would support XP Pro x64 found only Avast and AVG.

A fully updated XP SP3 (did you ever say you have All current updates after 10/15/2010) will run all of these programs -

Do you have Automatic updates turned on ?? If not there has been many updates since then -

Just to be sure that I am not mistaken about the updates, I ran Windows Update again just a few minutes ago. The result was zero High Priority updates available. The screenshot is copied below.

[Firefox]

Windows XP 64bit does not have SP3, it only has SP2....

You can find a small article about it HERE

[Jim-1]

I am unsure how could you single out that the problem is with "MBAM updates after 10/15/10 crash on XP Pro x64", we would like to hear how you have isolated this problem i.e. this isn't AVG2011 or its updates

Greetings again! Let me admit up front that I am not a rocket scientist. However, I am an Engineer with substantial experience in troubleshooting non-computer systems. My experience tells me that when everything works great, until one new thing is added, then there is likely to be a problem with that one new thing. On my computer, MBAM and AVG 2011 and Outpost played nice without problem, until MBAM updated their rules.ref on 10/16/2010. I have been able to restore rules.ref to the 10/15/2010 version, and everything works great on my computer again. In my mind, it is clear that MBAM changed rules.ref after 10/15/2010 in a way that makes MBAM crash with a database error on my computer. I can't say for sure that the problem is not related to AVG or to Outpost, or to my XP Pro x64 OS, but I can be sure that all of those worked well before the 10/16/2010 MBAM update to rules.ref, and all of them work well now (with the 10/15/2010 version of rules.ref). In my simple view, the rules.ref 10/16/2010 update broke my MBAM, so I have reverted to the 10/15/2010 rules.ref to repair the database problem cause by the update. From my viewpoint, it would make much more sense for MBAM staff to research the database problem caused by the rules.ref updates after 10/15/2010, than for me to chase after every other possible explanation in a complicated computer system.

I will certainly admit that it is a stretch for me to say that the updated rules.ref impact all XP Pro x64 systems. It could be that the damage caused by the updated rules.ref is more specific to the software that I have installed on my computer. I would be much more confident of that if just one user of XP Pro x64 would step up and say that his system works fine with the latest updates to rules.ref. Whatever is the actual cause of this database problem, I still see it as a problem caused by the changes in the updates to rules.ref since 10/15/2010, because everything works great on my computer when I do not update MBAM to later than 10/15/2010.

[shadowwar]

Have you tried copying a new DB from another computer over to yours and try that? This has to be a specific problem on your system. I know that there arent too many running XP64 but you are the only report we have so far of this. With the Millions of users we have there would be more reports if it was a specific database issue.

[nosirrah]

All OSs get the same database and in all cases it is opened the same way so it is impossible to have an OS specific issue here.

What is going on is a system specific issue breaking the database on your system.

[Jim-1]

Have you tried copying a new DB from another computer over to yours and try that? This has to be a specific problem on your system. I know that there arent too many running XP64 but you are the only report we have so far of this. With the Millions of users we have there would be more reports if it was a specific database issue.

MBAM tech support email the latest rules.ref on 10/19, but it crashed with a database error in exactly the same way that any update I downloaded since 10/16. Silence from a few people who may still be running XP Pro x64 and MBAM over the last few days is not the same as someone saying he is doing it and has no problem. Has MBAM staff actually run MBAM on XP Pro x64 in the last week to confirm that it really does work OK since 10/15? You guys can't really be saying that silence over a few days from a few users (if there really are that many remaining after the migration to Win 7) makes you just certain that whatever change MBAM made in rules.ref after 10/15 is perfect for everyone, and so any problem I have since then is the fault of only my computer. Wouldn't it be worthwhile for MBAM to actually confirm that their updates since 10/15 are not causing a problem for XP Pro x64 systems?

[noknojon]

There are updates for XP Pro 64bit systems as they are supported -

Sorry - That is why it only has SP 2 , not SP 3 -

Edited by noknojon to suit -

[mountaintree16]

Noknojon,

Microsoft does support XP SP2 64 bit as there is no SP3 for XP 64 bit.

* Note: There's no SP3 for the 64-bit version of Windows XP. If you

[Jim-1]

All OSs get the same database and in all cases it is opened the same way so it is impossible to have an OS specific issue here.

What is going on is a system specific issue breaking the database on your system.

Impossible is a very strong word. There are lots of kinks in XP Pro x64, and my guess is that most of the people who tried it have already upgraded to Win 7, partially because of the legacy problems. If this does turn out to be an inadvertent problem MBAM made with the changes to rules.ref since 10/15, will all of you guys chip in to buy me an upgrade to Win 7 too? :-)

If there really is a specific issue in my computer, then it is not likely to be related to AVG or Outpost firewall. I have already tested both by disabling them before trying to update the MBAM database, but I always get the same database error instantaneously after the download completes. Also, AVG 2011 has an anti spyware module that would likely alert to a malware problem that could affect MBAM, but there are no problems indicated in my computer and I do not expect to find any there. I have absolutely no problems I know of when I use rules.ref dated 10/15/2010 or earlier.

[nosirrah]

MBAM tech support email the latest rules.ref on 10/19, but it crashed with a database error in exactly the same way that any update I downloaded since 10/16. Silence from a few people who may still be running XP Pro x64 and MBAM over the last few days is not the same as someone saying he is doing it and has no problem. Has MBAM staff actually run MBAM on XP Pro x64 in the last week to confirm that it really does work OK since 10/15? You guys can't really be saying that silence over a few days from a few users (if there really are that many remaining after the migration to Win 7) makes you just certain that whatever change MBAM made in rules.ref after 10/15 is perfect for everyone, and so any problem I have since then is the fault of only my computer. Wouldn't it be worthwhile for MBAM to actually confirm that their updates since 10/15 are not causing a problem for XP Pro x64 systems?

It is not possible.

Without going into the exact technical reasons this is the same as checking to see if your tire pressure is preventing your car from starting.

Rules.ref opens or it does not open. The OS is not related unless the OS is damaged.

If the database was damaged it could not be opened at all, the OS would not matter.