Per guidance on the "Protection Module Errors" (http://www.malwarebytes.org/forums/index.php?showtopic=7038) thread I am opening a new topic on this particular error.

The problem/symptom as I have experienced it (and so it appears have a few others such as user 'jsb2b' has reported it) - after installing MBAM, registering it, enabling protection and logging out of one user account in Windows XP and logging into another user account is that it's not long before a window pops up saying: 'Malwarebytes' Anti-Malware .... [OpenEvent] Failed to preform desired action. Error Code: 2'



I appreciate that you would like a new topic (as I'm doing here now) or open a ticket but I've got to say .... I have highly recommended, sold and installed MBAM to several clients and their computers this past week and I have seen the "Error code: 2" popup occur as I am at the client's location right after purchasing a license for them and installing the application - with the client looking right at the screen as this occurs. I have (and my/your client) seen it both on Vista and XP installations. I can confirm that an initial boot up into Windows and entry into an initial account appears fine. It appears as a problem as I log out from one account and into another .... the system tray icon is not displayed (clients wondering if what they paid for is running and protecting them) and minutes later after logging into the other account the "Malwarebyte's Anti-Malware [OpenEvent] Failed to preform desired action. Error Code: 2" window pops up in front of the client. I can sense the confidence level of my customer (your customer well) as well as my own secret confidence sink a notch or two as I try to come up with some reasonable explanation why this might be happening, that it might be fixed in an update soon (I hope) or that I might find out news about it so I can reassure them that all is fine or will be shortly. jsb2b's experience is the same as mine. I have seen it on more than a couple of PC's now (PC's that have more than one account that I need to log into and out of as I work on the client's system.) One client today (pc with three different user accounts) is much more suspicious about the quality/worthiness and whether they really have what I've told them is an "awesome" product as they see this behavior. I have even been asked to provide them with a printout of the "Error Code: 2" screen snapshot so they and their users can post it next to their system to let them each know that this is 'normal' (which it really should be!) And so this really doesn't look good. I'm in a position that I cannot currently recommend and install a paid version of this tool unless I know that the problem has been identified and fixed. The basis of the sale is undermined greatly by this behavior and the questions my clients rightfully ask when they see it and no current clear explanation, fix or workaround to be shared with them.

As for providing helpful information so you may figure this out ... well I'm a bit stuck there as well since several of these installs are a client's locations, in their homes, where my time and access to their systems is limited and is largely gone as the job I was hired to do is now done and I no longer have a good/valid reason to return to gather information unless they hire me to do some additional work. Thus another reason I must hold off on further installs of the paid version until I understand what the resolution might be. It's a tough sell to say something like: "Yes - that really great software I recommended to you and installed ... well I need to re-visit you to uninstall, reboot, mbam-clean it, reboot, reinstall, set the registration with their previous registration information, reconfigure for 'start protection', update and short scan times. And yes - for a client system I have had the luxury to have here in my office to work on I have done that procedure as outlined in the "Protection Module Errors" thread and the results are no different after following them.

So *please* ... I would like to avoid calls from clients that I've helped put MBAM on their system telling me they are tired of seeing this "error" and questioning the product and it's value (one client has even put forth that perhaps it should be uninstalled).

Looking forward to a fix or update (hopefully one that can be automatically introduced through the once-a-day update mechanism and avoid me having to visit each machine to do some 4 or 5 step proceedure on my own nickel and time.)

I also would be very thankful for some explaination I might be able to provide existing/new MBAM client that now have this a problem/concern barring any fix that might come out in short order. What can I say to reassure them about MBAM's effectiveness and protection dispite the fact they are getting this error message and seeing the "M" MBAM system tray icon gone after logging out and into another user account on the same system?

Here's the quote from jsb2b from the other thread mentioned above which I think does a great job of describing the problem as I have seen it also. Thank you for any help on this and sorry to perhaps sound harsh or as if I'm whining - but for my business (and I'm sure yours as well) perception of 'high quality', solutions that 'work' and 'work well', that provide high value with low or little to no hassle factor and don't appear to 'break' is very important.



It was mentioned in that other thread that some people performed the process as outlined (which doesn't appear to work to fix this - my own personal experience as well) but another person took additional steps of manually getting rid of the contents of certain MBAM directories and reporting better success. I look forward to some confirming information as to how to fix this or that a fix is in the works and will be rolled out soon as part of the regular automatic update process.

Sorry for the long post and thank you a TON for the great work, product and service you all are providing!!!

David I

Greetings David and welcome. I'm not one of the developers or anything, but I have observed a dramatic rise in these issues of late and I believe they are investigating it. As far as I can tell, the problems seem to have started when Microsoft released a patch for Windows this month, one in particular that patched the kernel of the operating system. I'm not saying that it's Microsoft's fault or anything, just that the developers may need to rework some of the program code in Malwarebytes' to fix this issue due to whatever it was that changed with the patch. I don't have any kind of ETA or anything on a fix, but I'm sure the developers are taking all the reports seriously and looking into how to correct the problem.

Thank you exile360. My apologies to the MBAM team concerning my first post above.

I failed to realize late last night (after a long day and week) that or course their goals and mine are the same and to trust that they also find this annoyance to be a big pain right now on top of I'm sure many other plans, additions and work and they are probably working very hard to understand and resolve it. And even though I did try and read the forum for help, guidance or status on this (and found some talk about it in the protection module forum) it wasn't until after I created this thread that I later found another thread where people like you and myself are contributing in good form and fashion in a positive way to try and help with understanding and getting useful information to the MBAM team and community. As I look over my initial post the morning after (I should know better!) I realize I probably didn't contribute much to help and perhaps just rubbed a bit of obvious salt into a known concern and that wasn't necessary. I do not wish to jeopardize my relationship with MB or their products and great service they provide. I honestly feel and tell many people that this day in age running your system with only an AV product (and I am rather specific with them about what I feel are the top 4 or 5) is like showing up to a gun fight with only a knife (and a butter knife at that!) That with MBAM you have a significantly higher complement of defense and protection - that I even go so far as implying that a person would be foolish to not have MBAM as well as their top AV solution. The protection as well as ability to cleanup is top notch and in my experience has beaten even some of the top AV solutions.

Although I am not deviating a bit from the subject I would like to take liberty to share an example of my own testing of how well MBAM has been compared to some other supposedly high rated and talked about products (without naming names). I have had occasion where I have agreement and time from a client to image their hard drive in it's completely infected state. I then have had the freedom to try (test) different tools to see what they do and their effectiveness on finding problems and cleaning up and what remains for other tools to see and find. I then could restore that "infected" image and run the experiment again but allowing another tool in the pack to have first crack and the others to follow up later.

In this limited, informal 'test', I found MBAM to be the winner as the tool that did the most "heavy lifting" of finding, eradicating and cleaning of all the others. This test revealed to me what my most trusted heavy artillery would be in my 'tool kit' of tools and it has served me and many users very well. For that I and they are extremely thankful.

I must say that a recent 'retest' of this situation not only reconfirmed this but brought shock to my eyes as I saw one top rated AV product I used in the past test and in this more recent test this week basically "give up" and report that out of the 60 some odd infections/viruses/backdoor trojans, etc. that their result back was only 4 removed and 56 I was now told to visit their website to select from a host of individual 'removal' tools to run, one by one (with multiple restarts I'm sure). This was unbelievable to my eyes! To make matters worse (or all too clear!) there was a very prominent link at the top of that "removal tools" page advertising their own services to hire them to clean your system with their tools (you just sit back and watch them do their magic.) As a paid subscriber to that AV product (for purposes of having tools in my tool kit to call upon on my server as necessary) I was dismayed at the change from the AV product that at one time months ago - even though still behind MBAM in effectiveness - would have probably reported a cleaning of say 56 and leaving 4 to be picked up on a rescan or some small manual action to now doing a 180 reporting 56 things that I, a subscriber/user, would have to manually clean myself (or take the bait and pay for their service.) But I have digressed and greatly off topic here.

Again - my apologies if any are due to the MBAM team and people who read my first post. I could have said less and been more helpful. I did follow through with going to the support ticket area and submitting a formal support request for what it's worth and if asked I will try my best to be helpful in the process of helping gather information that might help the MBAM team figure out if this is a MS problem or some combination with MS, MBAM or some other situation in the systems I work with. Unfortunately - as I said in my post above - many of my clients I support I do not have easy liberty of returning to gather additional information. Some would be more favorable and helpful and allow and understand that - some would not. I also need to balance it with where my resources need to be focused on. So I am hopeful that others will more easily contribute the knowledge necessary to help the MBAM team. I will review my other systems (only a few of mine I have multiple user account on) and see if there is anything new I can contribute that hasn't already been mentioned. If I could find an emotioncon that represented humbleness and thanks I would put it right here _ . Thank you MBAM and exile360.

Sincerely,

- David I

I do wish there was an 'edit this post' button or link for editing my posts after they have been posted. As even after I have reviewed my posts and spell checked them I find inevitably that I've made a mistake or would like to possibly change something in it. So in both my posts I see places were it probably looks illogical that I used a 'not' when I shouldn't have and failed to include a 'not' when I should have! As well as perhaps a few more important things I might have said differently. I will attempt to make better use of 'preview' and allow more time between writing my thoughts and coming back to review what I wrote in cases where it might matter more so hopefully I avoid both these silly obvious things as well as realizing I would want to say something a bit differently. I do see from a management and tracking point of view that it can be troublesome to allow content in older posts already viewed to be changed and to catch it.

Ok - enough groveling and probably avoiding other important work.

May there be blessings on every one's day that reads this.

Thank you,

- David I

davidi - I don't know if you've seen this thread Protection Module Turns Off When User logs off..., But not when user reboots or turns off PC , but if not, I think it applies to what you are discussing. There are a couple fo work around scripts (to start auto-protect) discussed in posts 18 & 23 of the referenced thread that have worked for me. While not ideal, they may help you in the short term.