JRF

While MBAM team is evaluating/developing my suggestions above , I am using this workaround to have the MBAM processes run with Low-Priority , if somebody is interested about : -- drop any MBAM internal schedule you may have -- create a Schedule Task , or Shortcut , or Script , or an entry in your launcher -- choose from the list below the proper process entry , to be copied as the application path to run . C:\WINDOWS\system32\cmd.exe /c start "MBAM (priority=6) Update -silent" /belownormal "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /update -silent C:\WINDOWS\system32\cmd.exe /c start "MBAM (priority=6) Scan Flash -silent" /belownormal "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /scan -flash -silent -remove -reboot C:\WINDOWS\system32\cmd.exe /c start "MBAM (priority=6) Scan Quick -silent" /belownormal "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /scan -quick -silent -remove -reboot C:\WINDOWS\system32\cmd.exe /c start "MBAM (priority=6) Scan Full -silent" /belownormal "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /scan -full -silent -remove -reboot Notes : 1- the four entries above are for XP ; they must be adapted accordingly to be used with Vista or Windows 7 . 2- if you do not want to run the process silently , or if you do not have MBAM Pro : just remove from the chose entry all occurrences of -silent -remove -reboot . 3- the Scan Flash entry above can only be used with MBAM Pro .

Hello , these are my suggestions not acknowledged yet (compiled here as directed by Marcin) 1- Updates and Scans with -silent should automatically run with "Priority Bellow Normal = 6" (I have tested this value) to not disrupt other computer tasks on slow-CPU machines , or there should exist a "-lowpriority" command line parameter . 2- Logs presenting any detection or blocking could have the filenames with a literal appended after the time-stamp , to facilitate the analysis and list cleaning , e.g. mbam-log-2010-11-14 (07-26-38) DETECTION.txt protection-log-2010-11-15 DETECTION.txt 3- The two Dates presented in the GUI Update tab (for Current DB Info and Latest News) should conform to standards , in the same way the DB-date is presented in the systray icon tooltip . -------------- Thanks for your continuous research and product improvement .

I use to run update , scan flash and scan quick with the -silent parameter in the command line . What happens is that in slow CPU s like mine (~1.5 MHz) these operations interfere in all other running tasks , as mbam.exe runs with Priority Normal = 8 . The MBAM "background mode" however could run with lower priority . I have tested running with Priority Bellow Normal = 6 , and everything goes fine (no interference in other tasks) . So my proposal : when -silent is used , then mbam.exe would automatically run with Priority = 6 , or there would be a new command line parameter for this purpose . Thanks for your good support/development .

Thanks for replying . I suggest you just add these parameters after the mbam.exe in the entry you prefer to execute the program : you may have a shortcut in the Desktop Area , or you may create a Scheduled Task , or you may use some particular launcher .I tell you the way I use it , and you may adapt for your needs : 1- I have two shortcuts in the Desktop Area (one for Update , other for QuickScan) , to manually run immediately . For these shortcuts I have assigned Shortcut-keys : e.g. Ctlr+Shift+U for the Update , and Ctlr+Shift+Q for the QuickScan , to make easier to start them , even if I am working in other application window . 2- I have defined also two Scheduled-Tasks : -- one to to run the Update daily at 09:20h and 17:20h , -- and the other to run the QuickScan daily at 09:30h and 17:30h . The minimized QuickScan should alert you if something is found (according to the MBAM - Help - Command Line) .However , the minimized Update will not inform you if it failed . Just one space is sufficient (and not quarreling , I verified and could not find two spaces in my previous post -- ) .Please reply for any doubt , or to report the way you would implement this .

whatmeworry : you may get the desired behavior with the command line parameters : /runupdate /minimized and /quickscanterminate /minimized

Thanks for replying . All the reported updates were manual . Before posting here I did re-test , previously closing Internet appls , wiping temps/caches/cookies/... Something to confirm and other to correct : -- Only when Avira update is started : in fact that IP shows blocked by MBAM several times . -- But , being MBAM-IP enabled or not , the Avira update process performs to completion . What happens is that these recent Avira updates are taking too long (it confused me), e.g. for these tests , just to verify the application is up to date it took from 4 to 14 min . I see there is more to investigate . I believe my connection (cable=3Mbps) can not be blamed . Well , I run the free blend , and I read Avira announcing dedicated servers for the update process , as a premium version feature ... Thanks again , I will inform when I find something more coherent .

After started , Avira update freezes "Scanning for updates" until is aborted , while some MBAM IP Protection popups show up : "208.73.210.27 infection detected" , and the Log lines say "IP-BLOCK" . If the MBAM IP Protection is disabled , then the Avira update runs well . This IP is identified by CoolWhois as parkinglot.information.com Version info : XP Pro SP2

To noknojon - Thanks for your interest . As I said Avira blocked the file , asked me for an action , and I chose to delete it . Details : I get all my emails via POP Peeper 3.5 , which I use to run with Message Viewing = Rich Text (i.e. links are showed , but no HTML is executed without consent , so my computer is hardly going to be infected by any email content) . Clicking the link (which I carelessly understood from the text as an article) , the download was in fact done by my default browser (Firefox 3.5.2) to a temp area , then Firefox presented the usual popup asking if the file should be opened|saved|canceled . That was when Avira blocked all the operation , including the Firefox popup buttons . ..................... Yes , I use to update/quick-run MBAM daily , but normally keep Avira's Quarantine empty .

Not sure if this is normal , so understand this post as an alert to the Mod . I use to track this Suggestion Forum , and got an email about a new topic : the email body (and the topic , of course) contains a link that downloads LnKnZOte.rar.part , blocked by Avira (9.0.0.407/eng.8.2.1.3/vir3=7.1.5.149) as a TR/Dropper.Gen(Trojan) . This is the copy of the email , DO NOT ACTIVATE THE LINK (HTTP://....=6166) BELOW : ----- Original Message ----- From: "Malwarebytes Forum" <no-reply@malwarebytes.org> Date: Mon, 24 Aug 2009 12:21:47 +0000 Subject: Forum Subscription New Topic Notification ( Malwarebytes Forum ) JRF, sony_georgiev has just posted a new topic entitled "Suggestion" in forum "Comments and Suggestions". ---------------------------------------------------------------------- Now with manual scan of archived RAR file I see that, MB scan 1 file only. In archive are 9 files... + settings of deep level scan up to 10 levels. And please add forums/index.php?act=attach&type=post&id=6166 to signature update. ---------------------------------------------------------------------- The topic can be found here: http://www.malwarebytes.org/forums/index.php?showtopic=22469

I may be missing something , but you could just ask CCleaner to empty that MBAM Logs folder (or clear specific files inside it) : click (CCleaner) Options > Include > Add Folder > select the MBAM Logs folder in the list > optionally change the filename-mask-box from *.* to e.g. log*.txt > OK .

(I got an email notification about fredvries topic asking for RR improvements suggestions , but I can not find it here inside the Forums) Suggestion : RR to have a Silent run mode , possibly started as a command line parameter . Justification : for RR-free , or RR-pro (for users that do not have the Monitor active) , this would be a practical way to periodically scan the computer (via scheduled tasks) . Detail : -- the Silent run would check for updates (*) , and then perform a rogue-scan , plus a cookies verification (RR-pro). -- If neither updates found , nor rogues , nor cookies , then it would exit , all without opening any RR window . -- If either updates found , or rogues , or cookies , then RR would open the regular window , and the process would continue as in the standard execution . (*) for RR-pro , the update-checking would occur (???) even if this option was not marked .

To have options to Bleach (e.g. DOD | NSA) , and to Wash the File Slack Space , available for the immediate Delete option , would make FA a general use tool (specially now with the Delete-only option) , replacing one or more "elephant" programs .

When it starts , RR-free 1.18 does not check for an existing active instance (as occurs for RR-pro) .

+ 1 , deleting Folders (and sub-folders) would be great .

Hi Marcin --when program starts the Delete box comes correctly UNmarked , however after a deletion process , it keeps marked (it should reset to UNmarked) . I tested the three new versions , it is correct now . ----------------------------------------------------------------- I'm not sure what you want me to replace ARCHIVO with, FILEPATH? Due to the space limitation , I think it is better to have the right term FILEPATH in English . ----------------------------------------------------------------- Doubt (for all versions) : 0- Choose a test.exe file to be "assassinate" . 1- If the 3 initial options are selected (Unlock handles + Unload modules + Terminate process) there are informative messages for the functions requested , and it ends with "Unlock successful" , that is OK , however ... 2- For the same file (or a copy of it) if selecting the 3 initial options plus Delete , then it comes the final message "File was deleted successfully" , but it does not seem the initial 3 functions are performed , also the time it takes is shorter than for step 1 . Maybe be only my impression , just to confirm .