terrypin

OK thanks.

Thanks. Had this reply from Nir: "Yes, it's a very common problem with password-recovery tools." The puzzle is why I've never had these particular FPs identified before. The only reason I can think of is that MBAM has recently 'tightened' its criteria.

Thanks for fast reply. I'll see what Nirsoft author replies, but looks like I'll hang on to them.

In many runs of Malwarebytes' Anti-Malware over the years I've never seen any of Nirsoft's tools implicated before. But these are the only threats MBAM has found today: Generic.Malware/Suspicious, C:\PROGRAM FILES (X86)\NIRSOFT PACK ETC\PCANYPASS.EXE, No Action By User, [0], [392686],1.0.2655 PUP.Optional.PasswordViewer, C:\PROGRAM FILES (X86)\NIRSOFT PACK ETC\ROUTERPASSVIEW.EXE, No Action By User, [324], [426047],1.0.2655 Generic.Malware/Suspicious, C:\PROGRAM FILES (X86)\NIRSOFT PACK ETC\SNIFFPASS.EXE, No Action By User, [0], [392686],1.0.2655 I checked Nisoft's FAQ and its list of reported false positiives, but these three were not included. I've also emailed the Nirsoft author. I haven't quarantined them yet, awaiting advice please. FWIW, I've never used any of those tools, but one or more might come in handy some day. Best wishes, Terry, East Grinstead, UK

I spoke too soon. At some point during my current session, Malawarebytes has returned. It's sitting in my tray and XP Task Mgr shows mbam.exe is running. Services shows that MBAMService and MBAMScheduler are both Started (Automatic). But why? Bit of a nuisance really, and didn't happen with1.75 which waited politely for me to run it! -- Terry, East Grinstead, UK

Thanks for the prompt response. After studying other similar posts I decided to scour my registry for entries about Malawarebytes' (note the apostrophe) and deleted them. That appears to have fixed the problem. I think your upgrade installation program should have done this automatically? -- Terry, East Grinstead, UK

Malawarebytes is an excellent complement to my other anti-virus software, but I don't want it running permanently. Yet even though I have the setting Start Malwarebytes Anti-Malware with Windows unchecked, it insists on running when I reboot my XP PC. -- Terry, East Grinstead, UK

I'm pretty sure that I used to be able to right click on an entry in the list of scan results and get some details of it, but that's certainly not true now if it ever was. Also, what is the point of 'Vendor information'? It just takes me to the Malwarebytes home page. Elsewhere in the right click menu the term 'vendor' appears to mean the author or supplier of the malware entry, so I'm confused. -- Terry, East Grinstead, UK

Excellent, thanks Samuel, much appreciate your thoughtful help. I look forward to that new release. -- Terry, East Grinstead, UK

Thanks. I'll get back onto this in the morning and keep you informed of any developments. -- Terry, UK

Thanks for sticking with me on this. OK, progress! This time, directly after the latest reboot, mbamservice.exe was behaving quietly, as you predicted. However, my XP Pro PC became almost unusable at that stage. I'll describe it in case it offers any clues. Every operation I attempted (r-clicking a tray icon, opening the Run box, minimising a window, bringing up the Start menu. - everything) was glacially slow. Remarkably consistent too. I reckon about 22 seconds from initiating any operations to its completion. As I don't presently use Scheduling, and as I'm now very wary about it, I disabled mbamservices.exe in Services. (So I suppose I'll have to write off my

OK, thanks. (It would have been good to know about that after my original post, before these unnecessary steps.) But anyway that's exactly what I did previously, unchecked Start protection module with Windows, yet the extremely heavy usage continued after reboot. Has anyone in Support actually tested this to see if they can reproduce the issue? I've now fresly unchecked that option,and I'll now reboot yet again (I think that's #5) to make absoutely sure, and report back. Meanwhile, no one has yet addressed my question about the apparent coincidence of two similar problems. BTW, is resident protection the only feature in Pro that's not in my previous free version? -- Terry, East Grinstead, UK

OK, I did all that. Took me a long time with 3 reboots. As I expected, it's made no difference. Now will you consider the points I made before please? To repeat: 1. Why is mabamservice.exe still running when I've disabled protection as I described? 2. And generating such an enormous number of Read I/O entries which slow the system down? Neither of which happened before. 3. Doesn't it strike you as more than a coincidence that two users are reporting an almost identical problem with the same version within a day or two of each other? -- Terry Pinnell, East Grinstead, UK

Thanks, but that looks like a copper-plate answer rather than reflecting any consideration of my particular problem! Did you also see my reply in the thread 'mbamservice.exe excessive disk load, Slows PC'? MBAM was updated only recently. I strongly suspect that this latest version is buggy. Did you investigate that possibility? -- Terry, East Grinstead, UK

Ah, interesting! Before seeing your query, I just posted a very similar one of my own, 'Why is mbamservice.exe running?'. I have identical symptoms. -- Terry, East Grinstead, UK