Conflict with Malwarebytes Anti-Executable

[ghost22]

Hi,

Yesterday I installed MBAE and after several hours here at the MBAE site,I was finally able to get it installed and working correctly.....SEE THIS POST.....https://forums.malwarebytes.org/index.php?showtopic=146255

 

This AM I fired up my computer and MBAE did not start,but the service was started....but MBAE was not in Task Mgr...

 

Yesterday,after all was fine with MBAE,I enabled again "The self protection module" and left it on...

 

When I couldn,t get MBAE to start this morning,I then "Disabled" the self protection module,and re-booted...

 

It is now working again as it should...

 

Do I have to now leave the module disabled??.....And is this a good practice..

 

Thanks

[daledoc1]

Hi:

 

I think from your other post that you are describing the following scenario:

With MBAM (Malwarebytes Anti-Malware) 2.0 Self-Protection (SP) module enabled, you were unable to install MBAE (Malwarebytes Anti-Exploit)?

When you disabled SP, you were able to install MBAE?

 

Yes, that is to be expected, as explained here:

 

Program Information

• The program Self Protection will prevent renaming, moving, or deleting any files related to the program including shortcuts on the Desktop. If you wish to move or rename a shortcut or uninstall the program or run the MBAM Clean Removal Process then you need to first disable the Self Protection module. From Settings -> Advanced Settings -> uncheck the "Enable self-protection module" and close the program. It can also prevent or hinder installation of other Malwarebytes products so make sure to disable the Protection Module before installing other Malwarebytes programs.  https://forums.malwarebytes.org/index.php?showtopic=146011#entry815199

 

MBAM SP does exactly that -- it protects MBAM files from being altered by malware.

It can also cause issues such as the one you described (inability to install other Malwarebytes software, such as MBAE and MBSB).

 

Depending on your computing practices, it's not entirely necessary to have SP enabled.

That's one reason why it is not enabled by default during installation.

It's really your choice, once you know how having it enabled might affect your system.

 

The staff will likely have some additional information for you.

 

Cheers,

 

daledoc1

[ghost22]

Hi,

"It can also cause issues such as the one you described (inability to install other Malwarebytes software, such as MBAE and MBSB)."

 

This seems like a really "catch 22".....Why would it not be to hard to identify within Malwarebytes products only,some sort of recognition sig...so this doesn,t happen??

 

I believe SP is beneficial,but its a pain trying to remember to disable it before shutting down every night,so that MBAE will start-up after a new reboot...

 

Just my thoughts.....

 

 

[daledoc1]

Hi:

 

SP might block the installation of MBAE, but I wouldn't expect it would stop it from running.

If MBAE is not running (after a successful install) with MBAM SP enabled, then that sounds like a different problem.

 

You might want to  try the clean reinstall mentioned in my earlier reply.

I don't know, but you MIGHT need to reinstall MBAE, as well (we will need to wait for staff to weigh in).

 

If that doesn't work, the next step would probably be to please read this pinned topic >>Diagnostic Logs<< and post back with the logs.

The staff will take a look and see if they can help decide what might be going on.

 

Please post back and let us know how it goes - I will turn you over to the experts now.

 

Cheers,

 

daledoc1

[Firefox]

Just to add... I believe there is a bug in MBAE where sometimes it starts up, but will not show a tray... icon... but this bug may have already be fixed....

[ghost22]

Hi,,Daledoc1

 

 

"You might want to  try the clean reinstall mentioned in my earlier reply."......I had already done this process on my own when I was having the problem installing MBAE....When that didn,t help me,is when I posted for help in the MBAE forum...

 

"I don't know, but you MIGHT need to reinstall MBAE, as well (we will need to wait for staff to weigh in)."...I sure hope this is not the case...

 

 

"The staff will take a look and see if they can help decide what might be going on."....Okay will wait for them...Thanks..

 

Might be awhile before I post again as I have an appt. to go to....

 

 

 

Edit: @Firefox....Just to add... I believe there is a bug in MBAE where sometimes it starts up, but will not show a tray... icon... but this bug may have already be fixed....Thanks,but I wasn,t seeing that problem...(which was good )

 

 

[ghost22]

Here are requested logs...Hope this can be resolved....

Addition.txt

FRST.txt

CheckResults.txt

[pbust]

This is a known issue that only happens under Windows XP. Basically MBAM's Self-Protection prevents MBAE from writing to its log directory which is protected by MBAM. This same issue is not a problem under Vista, Win7 or Win8. It only happens under XP. It is neither a bug of MBAM nor a bug of MBAE, just a small conflict.

 

If you are using this combination (Windows XP + MBAM + Self-Protection + MBAE) the workaround until we fix this conflict is to simply disable Self-Protection.

[daledoc1]

@pbust:

 

Ah, hah!!

Now we know.

 

Thanks VERY much for helping out here.

Your explanation was very clear and informative.

 

@ ghost22:

 

I hope this helps?

 

 

 

Thanks!

 

daledoc1

[ghost22]

This is a known issue that only happens under Windows XP. Basically MBAM's Self-Protection prevents MBAE from writing to its log directory which is protected by MBAM. This same issue is not a problem under Vista, Win7 or Win8. It only happens under XP. It is neither a bug of MBAM nor a bug of MBAE, just a small conflict.

 

If you are using this combination (Windows XP + MBAM + Self-Protection + MBAE) the workaround until we fix this conflict is to simply disable Self-Protection.

 

Okay I understand now the conflict that affect XP users...but other than the "start up" issue,rather than disable SP while running...isn,t it fine to run with it enabled and have MBAE run also....(even if no logging takes place in MBAE)....?

I will just make myself a reminder to disable SP when I shut down,and enable it again after all is loaded....(Until conflict fixed)