Jump to content

Dave-H

Members
  • Content Count

    45
  • Joined

  • Last visited

About Dave-H

  • Rank
    New Member
  1. Dave-H

    Firefox add-on not working?

    Any more thoughts on this @rakeshsejwal? πŸ™‚
  2. Yes, I did think it was a bit strange that Malwarebytes' main service could be killed so easily! Anyway, I have now returned the mbamchameleon service to system start, and everything looks OK again. πŸ™‚
  3. The registry keys are certainly protected, I get "access denied" if I try to change them, but I can kill MBAMService.exe with Task Manager. It immediately runs again if I do, but it does terminate. I don't know if that's expected behaviour. I can also stop the service using the Services MMC as well, as I mentioned in an earlier post, but I gather from the reply that is expected behaviour. πŸ™‚
  4. Yes, you could well be right, this is all very strange indeed! Actually the anti-exploit protection, where the original problem was, seems to be fine now, it's the self-preservation module I'm now having issues with! I must say that I'm now sorely tempted to just leave the self-protection service on system start and not boot start, and hope that it's still doing everything that it should in that mode. The main program certainly seems to be happy that the early self-preservation protection is enabled in that mode. Presumably it won't start quite so early in system mode as it will in boot mode, but I don't know how much the delay would be and whether that compromises it in any way. πŸ™‚
  5. Yes, I did wonder about that, and I tried two earlier versions that people online said worked fine with XP, 3.20 and 2.96. Neither of them worked to log the system boot either! All the versions I've tried, 3.50, 3.20, and 2.96 seem to work fine when run normally, logging all the system activity as they should, but the boot logging system doesn't seem to do what it should at all. Another mystery. πŸ™‚
  6. Really sorry about this, but I'm having real trouble getting a boot log out of Process Monitor! I can set it to produce one, and it seems to be doing all the right things, setting a boot service in the registry to run on the next boot, using PROCMON24.SYS as the driver, but when I reboot, nothing happens and nothing is recorded. I've looked and looked online, and I can find no reason for this. There are no error messages being logged, but I can only assume that the temporary boot service that Process Monitor is installing to do this is not actually running for some reason, in the same way as the mbamchameleon boot service isn't running! Any ideas? πŸ™‚
  7. BTW, we have now moved a long way from my original subject title for this thread! Would it be possible to change it to something more general like "Malwarebytes Installation Problems on Windows XP"? πŸ™‚
  8. Thanks, but I have already done that procedure many tim Thanks, but I have already done that many times before, and the end result is always the same, I doubt that doing it again will be any different! After the uninstall and clean the re-installation seems to go fine, but the self-protection module is shown as being completely turned off. If I try to enable the self-protection module, the interface just immediately and permanently freezes. I obviously can't alter the early start setting either as the main setting isn't switched on. It's shown as being on, but greyed out. The only way I've found to fix this is to manually change the mbamchameleon service's start type from "boot" to "system" in the registry. As I said earlier, the service is actually running eventually when it's set to "boot" but only after an initial error message in the Windows log that it had failed to start. It's then logged as actually starting about 5 seconds after the error message was logged. Cheers, Dave. πŸ™‚
  9. Hi again. I've just checked the Windows System Log again, and if the mbamchameleon service is logged as having failed to run, it does in fact then run according to the log, exactly five seconds later! This delay is presumably what's causing the problem with the interface, as it thinks the service isn't running as it didn't start on boot, but when you try to run it by switching on the self-protection, it can't do it because the service is in fact running by then, and the consequence of trying to switch on a service already switched on causes the interface to crash! It obviously isn't enabled properly anyway, as I can still change its startup type by editing the registry, which I shouldn't be able to do if it's working properly, as it's one of the registry keys which should be protected by it. πŸ™‚
  10. Hi again and thanks. I tried the 4Shared link and it worked fine for me, so I don't know what's wrong there. Anyway, I have uploaded it to WeTransfer too now. The link is - https://we.tl/t-u9fzUuVS2g I set the mbamchameleon service to boot start in the registry, and when I restarted I again got the Windows System Log message that it had failed to start ("The following boot-start or system-start driver(s) failed to load: mbamchameleon.") It is still set to start type 0 in the registry. The "enable self-protection module" option in the MB interface is shown as off, and as before if I try to turn it on the interface just permanently freezes and has to be forcibly terminated. However, after running your two commands, the Windows System Log now says that the service was started ("The mbamchameleon service was successfully sent a start control."), although the MB interface hasn't changed. The query.txt file is attached. Cheers, Dave. πŸ™‚ query.txt
  11. Dave-H

    Firefox add-on not working?

    Hi again, sorry for the delay! I did a test install of Firefox 52.9 ESR on Windows 10, and the Malwarebytes extension did not work in it. I think that proves that the problem is nothing to do with the operating system, it's the Firefox version. I guess it just doesn't work with 52 ESR for some reason, and I guess in that case it won't actually work with any versions of Firefox earlier than a certain point. If you can find what the earliest version it will work with is, that information should be added to its download page, and in fact it should be blocked from installing on versions it won't work with! Cheers, Dave. πŸ™‚
  12. Hi again. I've done a bit more experimenting, and I've managed to get things back to running as they were before. It appears that the self-protection settings do simply change the start type of the mbamchameleon service. If self-protection is completely switched off, the service is set to type 4 (disabled). If it's on but not early start, the service is set to type 2 (automatic), and if the early start is on it's set to type 0 (boot). That makes perfect sense, but it's that last configuration that doesn't work, the service will not start as a boot service. Setting it manually to start type 1 (system) seems to work around this, and the service presumably still starts early enough for the early start setting to show as being on. Why it won't start as a boot type service is a mystery though. Cheers, Dave. πŸ™‚
  13. Thanks, yes I looked again and the link you gave is to version 3.50 of course! D'oh! I guess that is the last version, and runs fine on XP as you say, despite what they say. I guess being part of Microsoft they're not allowed to acknowledge the existence of XP any more, in fact I'm surprised they haven't remove the reference to Vista now too! Anyway, I ran Process Monitor, and then tried to switch on the "Enable self-protection module early sο»Ώtaο»Ώο»Ώrο»Ώt" option again, and still nothing appeared to happen. I stopped the trace and saved the file. It's here - https://www.4shared.com/file/VGdDwxZrda/Logfile.html I don't know what it will show though, as I say the function seems to be completely non-functional at the moment. Cheers, Dave. πŸ™‚
  14. Hi, thanks and sorry for the delay in responding, I was very busy yesterday away from home most of the day! I switched off "Enable self-protection module early sο»Ώtaο»Ώο»Ώrο»Ώt", waited 10 seconds, and then it wouldn't turn on again! Even after a reboot it's still off and won't switch on. The normal self-protection on/off option is still apparently switched on. The version of Process Monitor that you gave a link to doesn't work on Windows XP, it needs at least Vista. I do already have version 3.50, which I suspect is the last that does work on XP, I assume that's OK for any further testing? Cheers, Dave. πŸ™‚
  15. Thanks, I've done that and the logs are attached. I also switched on the enhanced log collection function. "Enable self-protection module early start" indicates that it is switched on. Both the log gatherings were done with the mbamchameleon service startup type set in the registry to "system" (type 1) instead of "boot" (type 0) which is the default. Cheers, Dave. πŸ™‚ mbst-grab-results-prereboot.zip mbst-grab-results-postreboot.zip
×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.