Hello.

I noticed my two updated Windows XP Pro. SP2 and SP3 (both with IE6) 's HKLM's runs show "C:\winstuff\MalwarebyteAntiMalware\mbam.exe" /runcleanupscript

What's the point of this? Can I safely remove this? I tried manually running it and saw nothing.

Thank you in advance.

Yes you can remove it but the next time you run MBAM scan it will put it back. It is a known issue that has already been fixed but won't be available until the next version is released. It should not cause any harm to leave it for now.

This is a leftover from the Delete On Reboot script. There's a bug where it doesn't get removed after it gets used. It will be fixed in the next version.

You can safely remove this item.

Thank you.

I am on Windows Vista Home Premium (x64).

Due to Vista's security, I get prompted every time my computer starts up if I want to let this /runcleanupscript execute.

I downloaded 1.44 version today, ran it, and rebooted. Same problem. When you said next version can you specify which version number?

What registry key specifically is it safe to remove? Can I have the entire key name?

I find references to mbam.exe in these keys:

HKEY_CLASSES_ROOT\mbam.script\shell\open\command
HKEY_CLASSES_ROOT\Wow6432Node\mbam.script\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mbam.script\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\mbam.script\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\mbam.script\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\mbam.exe

None of these explicitly have "/runcleanupscript".

So I am a little stuck, is it in a different place in Vista?

Greetings

On a 64 bit system it would be listed here: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run and it would show up as Malwarebytes Anti-Malware (reboot)

Hello, and thanks for the quick!

I looked at that key and I don't see it listed under that name.

That's because it gets deleted after it runs.

The bug was that it would not be deleted after it ran, and thus it would prompt on every startup. It's been fixed for at least several versions now, and while you will see the UAC popup on a reboot right after a scan, that will be the only time.