daledoc1

December 10, 2014

@David:

Excellent point.

Thanks!

@max_vader:

It appears that malware helper Valinorum has replied to your post in the malware removal section.

If you want help with checking your system, please stay with that other topic until your helper gives you the "all clear".

If other, non-malware issues remain after that, he may refer you back here for additional work, if needed.

OTOH, if you do NOT wish further help, please let Valinorum know by replying in that thread.

That way, the topic can be closed and your helper can work with other users who need assistance.

Thanks,

December 10, 2014

You are most welcome.

I'm glad I could help.

Cheers,

December 10, 2014

Hi:

The installer is the same for the Free, Trial and Premium versions.
It is available for download HERE and HERE.
The Trial version of MBAM is enabled by default during the installation, unless the user opts out.

If you now have the Trial version and you want to revert to the Free version, there are 4 options, any of which will work:

Allow the trial to expire in 14 days; OR
Click the "End Trial" popup notification; OR
Click the "End Free Trial" link in the GUI; OR
Perform a clean reinstall, using the method described here: MBAM Clean Removal Process 2x - be sure to "opt out" (remove the check mark from) the Free trial, if it is offered again during the installation wizard.

Having said that, MBAM Premium is specifically designed to run alongside all of the major AVs, to provide complementary, layered protection against zero-hour and zero-day threats often missed by the AVs.
So, you ought to be able to run both your AV and MBAM Premium in real-time.
We can always help with that, if you need it.

ALSO, re: scan types:
The different types of scans were renamed in version 2, and it has caused a bit of confusion.

"Flash" is now "Hyper"
"Quick" is now "Threat"
"Full" is now "Custom"

Hyper scan is available only to PREMIUM & Trial users. It is not routinely needed or recommended -- if anything is found, a subsequent Threat scan will be needed anyway.
THREAT scan is the most important and most useful scan -- it is the one that ought be run on a regular basis (daily is the default setting now in 2.0).
Custom depends on what drives, folders and files are selected -- routine use of a "full" system scan is neither necessary nor recommended, as it's a task better suited to your antivirus.

I hope this helps,

December 10, 2014

Hi:

Please see my reply in your other topic here: https://forums.malwarebytes.org/index.php?/topic/162057-is-this-a-windows-process/#entry917892 and Firefox's reply to your original thread here: https://forums.malwarebytes.org/index.php?/topic/161755-is-this-malaware/#entry915237

You now have multiple open threads in several areas of the forum:

https://forums.malwarebytes.org/index.php?/topic/161755-is-this-malaware/

https://forums.malwarebytes.org/index.php?/topic/162057-is-this-a-windows-process/

https://forums.malwarebytes.org/index.php?/topic/162059-high-disk-usage/

https://forums.malwarebytes.org/index.php?/topic/162036-possible-malware/

Alas, none of them provides sufficient information (diagnostic logs) to be able to answer your questions with any certainty.

It's possible that all of the problems you describe could be related to malware infection.

But there's no way to know without more info about the system.

And such diagnostic work is performed in a special forum section reserved for that purpose.

So, please wait for an expert helper to assist you >>HERE<<.

Until then, there's no need to start any more new topics.

Thanks very much for your patience and understanding,

December 10, 2014

Hi:

Yes, it is.

But your post doesn't provide enough information to determine if that process on your computer has been changed by malware.

It appears that you have an identical post in the malware removal section here: https://forums.malwarebytes.org/index.php?/topic/162036-possible-malware/

Please be patient and wait for one of the trained malware experts to pick up that thread.

The helper will guide you through the process of checking your system for malware and needed cleanup/repair.

Thanks,

December 10, 2014

Hi:

AFAIK, critical notifications -- such as those alerting the user that a key protection component has been disabled -- cannot currently be entirely disabled, at least from the GUI. The popup notifications control will be added in some form in a later program version, as I mentioned.

The links to the forum posts by the MBAM Product Manager, exile360, in my previous reply explain why that is the case and is not likely to change.

Here is an excerpt:

Well, to be frank, I do not believe that most of our customers permanently disable one of the major components of protection that our application provides. It is quite true that some do, and that we do intend to make some allowances for that, including the ability to specify which tray notifications are displayed, however I have yet to see any security application which allows the user to have the application display a 'green' or 'everything is OK' status when one of its major protection components is disabled (and we tested many when determining what the best practices were for the functionality of our application).

The links in my previous reply also mentioned some options for managing the IP blocks.

Another option would be to "Deactivate" from the GUI link (dashboard > my account > deactivate) or to cleanly uninstall MBAM and reinstall it as the Free version.

Doing so will completely disable the IP blocking feature, as MBAM Free is only a manual, on-demand scanner that can only remove infections that have made it past your anti-virus onto your system. This is NOT recommended, as you will lose all real-time protection from MBAM. However, it will enable you to visit any and all websites without seeing any MBAM IP blocks.

Thanks again,

P.S. I could be missing it, but I don't see an anti-virus (AV) installed or running in your logs (Windows Defender is disabled)? For the record, MBAM is not an anti-virus, and is not a substitute for one. So, regardless of how you choose to proceed with the MBAM Website Protection module, it would be advisable to install a robust AV, either free or paid, to run alongside MBAM.

December 10, 2014

http://www.zdnet.com/article/the-ui-of-the-future-three-takeaways-from-apple-pioneer-bill-fernandez/

"We are in a time of transition," said Fernandez. "And like [how] the water becomes brackish where river water meets the ocean, the state of UI design is messy. There's some great stuff out there, much more than there used to be, but there's still a lot of trash, and there's a lot of well-meaning but misguided efforts. One example of this is in the migration from three-dimensional, photo-realistic UI elements (window frames, pushbuttons, sliders, etc.) to 'flat' UI design. Years ago a friend asked what I thought web pages of the future would be like and I said 'like magazines.' I thought we'd see flatter designs, expert typography, beautiful, magazine-advertisement-like page layouts, etc. That prediction is coming true...
"But in moving towards flat design we are losing much of the wisdom that was embedded in the old 3D style of UI. For example: A user must be able to glance at a screen and know what is an interactive element (e.g., a button or link) and what is not (e.g., a label or motto); A user must be able to tell at a glance what an interactive element does (does it initiate a process, link to another page, download a document, etc.?); The UI should be explorable, discoverable, and self-explanatory. But many apps and websites, in the interest of a clean, spartan visual appearance, leave important UI controls hidden until the mouse hovers over just the right area or the app is in just the right state. This leaves the user in the dark, often frustrated and disempowered."

{{YES, under-the-hood functionality is more important than appearance. And, YES, most users don't need to look at the GUI very often. And, YES, no single design will please all users. And, YES, a return to the MBAM 1.x GUI is not an option. But form and function are related. If the original 2.0 GUI was too bold/colorful/busy/garish/obtrusive, then one might ask if the proposed new GUI for 2.1 might over-correct too far in the opposite direction.}}

{{As for the smileys, the tally of forum member comments speaks for itself.}}

Thanks for listening and for all the hard work to produce the best anti-malware program.

December 10, 2014

Hello and :welcome: :

One possible cause for this behavior can be malware infection.

It's a good idea to exclude that as a possibility.

We cannot perform the diagnostics and removal/repair for this in this particular area of the forum.

So, for expert assistance, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the preliminary steps to expedite the process.
A malware analyst will assist you with looking into your issue.

Thanks,

December 10, 2014

Hello and welcome back:

Let's start here:

Please carefully follow the steps in this pinned topic to uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
If that does not correct the issue, then please read the following and attach to your next reply the 3 requested logs - Diagnostic Logs (the 3 logs are: FRST.txt, Addition.txt and CheckResults.txt)
NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Please let us know how it goes.

Thanks,

December 10, 2014

Hello and :welcome: :

I just installed Mbam Pro on my third system, is that too many?

The answer depends on the type of license.

If you have a 1-PC, lifetime, consumer license purchased BEFORE March 2014 (or in some sort of promotional deal after that date), then, YES, it is too many. A 1-PC, lifetime, consumer license can only be activated on 1 PC at a time. It can be transferred to a different computer in the household, but not to a different user. So, if you are trying to use a 1-PC license on 3 systems, that is not legal. You would need to purchase a license for each of the other 2 computers.

If you have a 3-PC, subscription license purchased AFTER March 2014, then that license can be activated on up to 3 PCs in the same household. It can be transferred to a different computer in the household, but not to a different user.

As far as the issue you are experiencing with no context menu from the system tray icon:

Please carefully follow the steps in this pinned topic to uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
If that does not correct the issue, then please read the following and attach to your next reply the 3 requested logs - Diagnostic Logs (the 3 logs are: FRST.txt, Addition.txt and CheckResults.txt)
NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Please let us know how it goes.

Thanks,

December 10, 2014

Hi:

Sorry, but if the user disables a critical component of MBAM Premium (e.g. the IP/Website protection module) -- or of any security product, for that matter -- the program WILL notify the user, either with popups, and/or through the GUI, and/or through the system tray icon.
https://forums.malwarebytes.org/index.php?/topic/144984-disable-notification-when-i-choose-to-disable-website-protection/#entry813524
https://forums.malwarebytes.org/index.php?/topic/144984-disable-notification-when-i-choose-to-disable-website-protection/#entry894565

Currently, notifications in MBAM Premium 2.x are "all or none"; they can be disabled, but this is not recommended.
The development team has promised more granular user control -- at least for non-critical notifications -- with a future program release.

If you are visiting sites that generate an IP block from MBAM, then there are several ways to address that. For example:

Follow the steps HERE and then report the requested information HERE to the IP Block Team as a possible "False Positive".
Set a particular IP to the MBAM "Ignore List" -- NOTE: this is NOT the safest way to proceed without first verifying that the IP is safe, as MBAM is likely blocking the IP for a reason.

ALSO, for additional information:
There is an FAQ Section here: Common Questions, Issues, and their Solutions
And here are links to the MBAM 2.0 User Guide: Online and PDF
And there are many useful KB topics and videos at the helpdesk support page

Thanks,

December 10, 2014

Hello and :welcome: :

Your post suggests that you might be a computer repair professional?
If so, your inquiry would be better suited to this area of the forum: Malwarebytes Anti-Malware for Business or to the Business Help Desk

Your MBAM business license entitles you to free support from that Business team.

As you have multiple affected computers, they would be best able to assist you with installing, configuring and running MBAM on so many systems.

Thank you,

December 10, 2014

Hi:

Preliminary review suggests that you might be infected.

We can't work on malware diagnostics and removal in this sub-section of the forum.

So, for expert assistance, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the preliminary steps to expedite the process.

>>As you have already run FRST, you just need to start a new post in the malware removal section of the forum -- please attach the latest FRST and MBAM scan logs to that new post.
A malware analyst will assist you with looking into your issue.

Thanks,

December 9, 2014

Hi:

FWIW, The latest version of MBAM for Business is 1.75, not 2.x.

Use of MBAM in a Business environment requires proper licensing (it's a EULA violation to use MBAM Consumer in a Business environment).

And your Business license entitles you to free support from the dedicated Business support team.

So, you'd probably be better off seeking help from those folks.

They can best assist with your technical support questions in that environment.

Otherwise, we'll need to wait for a forum expert or staff member to respond to your specific inquiry here.

Thanks for your patience and understanding,

December 9, 2014

Hello and :welcome: :

Your post suggests that you are running MBAM in a Business or Enterprise environment?
If so, your inquiry would be better suited to this area of the forum: Malwarebytes Anti-Malware for Business or to the Business Help Desk

Thanks very much,

December 9, 2014

Hello and welcome back:

is the "hyper scan" available with the free version?

No, it is not.

The different types of scans were renamed in version 2:

"Flash" is now "Hyper"
"Quick" is now "Threat"
"Full" is now "Custom"

Hyper scan is available only to paid, PREMIUM users (and Trial version users) and is not routinely needed or recommended -- if anything is found, a subsequent Threat scan will be needed anyway.
THREAT scan is the most important and most useful scan -- it is the one that ought be run on a regular basis (daily is the default setting now in 2.0 Premium).
Custom depends on what drives, folders and files are selected -- routine use of a "full" system scan is neither necessary nor recommended, as it's a task better suited to your antivirus.

ALSO, for additional information:
There is an FAQ Section here: Common Questions, Issues, and their Solutions
And here are links to the MBAM 2.0 User Guide: Online and PDF
And there are many useful KB topics and videos at the helpdesk support page

Thanks,

December 9, 2014

Hi:

Thanks.

There's a problem with the FRST.txt log (it's just a few text characters, rather than a full log, for some reason).

Please re-attach it (or re-run FRST and attach a fresh set of both logs).

Also, please attach a PROTECTION log (not a scan log) for a day when you report seeing the IP blocks.

EDIT: See screenshot.

Thanks,

December 9, 2014

Hello and welcome:

It's hard to say --it does sound as if it could be a hardware problem, so it would help us to know what tests you ran to exclude that possibility?

However, it might be worth getting some expert help to exclude malware, such as a rootkit (note: PUPs would not normally cause the behavior you describe).

That sort of diagnostic work is not permitted in this section of the forum.

So, for expert assistance, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the preliminary steps to expedite the process.
A malware analyst will assist you with looking into your issue.

Thanks,

December 9, 2014

Hi:

Most PUPs require some sort of user "interaction" to install (typically NOT opting out during installation of other, legit software with which the PUP is bundled).

Clicking through software install wizards without reading the "fine print" is a common way to acquire such PUPs.

There is more information here: What are the 'PUP' detections, are they threats, and should they be deleted?

Also, please be sure that you have MBAM properly configured both to DETECT and to automatically QUARANTINE, by selecting "Treat Detections as Malware", as shown in the attached screen shot.

Thanks,

December 8, 2014

Hi:

Great!

Thanks for the follow-up.

The GUI has changed a bit for version 2, but there was always a "Trial" version for the MBAM consumer version, I think.

I'm not sure if it was enabled by default in version 1 (sorry, but I can't recall that far back ).

Having said that, MBAM Premium is specifically designed to run actively alongside all of the major AVs, to provide complementary, layered protection against zero-hour and zero-day threats often missed by the AVs.

So, you ought to be able to run both your AV and MBAM Premium in real-time.

We can always help with that, if you need it.

MBAM Free is only a manual, on-demand scanner. It can only REMOVE malware that has already made it past your AV onto your computer.

MBAM Premium is designed to run alongside your AV in real-time, to provide layered protection to PREVENT infection.

Prevention is always better than cleanup, when it comes to malware.

The complexity of finding, preventing, and cleanup from malware

I am just another home user unaffiliated with the company, but I would not run any Windows or Android device without it -- well worth the cost of a license.

As I mentioned, we can help you with getting MBAM Premium up and running with your AV, if you need it.

But it's up to you.

Cheers,

December 8, 2014

Hi:

It's hard to say without more information (e.g. MBAM protection logs and diagnostic logs).

I suggest the following:

Please read the following pinned topic and ATTACH to your next reply all 3 requested logs: Diagnostic Logs (NOTE: If you have run FRST on this computer before, please place a check-mark in the "Addition.txt" option before running it)
AND please ATTACH to your next reply a PROTECTION log from a day where you saw the IP blocks -- instructions are below.

Thanks,

--------------------------------------

*How to get PROTECTION or SCAN logs:
(Export log to save as a txt file for posting in the forum when requested)

Open MBAM.
Click on the HISTORY tab > APPLICATION LOGS.
Double-click on the PROTECTION LOG or SCAN LOG which corresponds to the date/time in question (or the one you are asked to post).
Click EXPORT.
Click TEXT FILE (*.txt)
In the "Save File" dialog box which appears, click on DESKTOP.
In the FILE NAME box, type a name for your scan log.
A message box named "File Saved" should appear, stating that "Your file has been successfully exported".
Click OK.
Attach the saved log to your next reply.

December 8, 2014

Hello and welcome back:

Let's start here, please:

Please carefully follow the steps in this pinned topic to uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
If that does not correct the issue, then please read the following and attach to your next reply the 3 requested logs - Diagnostic Logs (the 3 logs are: FRST.txt, Addition.txt and CheckResults.txt)
NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Please let us know how it goes.

Thanks,

December 8, 2014

Hello:

I'm glad you got it sorted out.

The fact that you have 2 computers explains why the logs you posted didn't match with the story/explanation you initially reported.

(Also: Please be aware that an MBAM Premium 1-PC, lifetime, consumer license can be activated on only 1 computer at a time.)

I'm not sure why you had trouble posting in your own forum topic after having done so previously.

Nor can we say -- without current diagnostic logs from the affected computer -- why you could not update the program from a download of the installer.

There is quite a bit going on with the system (the one for which you posted the FRST logs).

So, if you are experiencing abnormal computer behavior, and if that is the same computer about which you created this forum thread, then you might want to get some free, expert help.

To do that, please follow the steps here: Available Assistance for Possibly Infected Computers.

It explains the options to get free, expert help with scanning and cleaning the system.

But it's up to you, of course.

I'm glad you got it sorted out.

Thanks again,

December 8, 2014

Hello:

It's hard to say without more information (e.g. MBAM protection logs* and diagnostic logs).

AFAIK, the 2.0.4 upgrade did not affect the Web/IP Protection Module (it related to the Malware Protection module). So one would not expect any new behavior from the Web Protection feature after upgrading from 2.0.3.

EDIT: If you would like the Research Team to evaluate the IP in question, then I suggest that you please do the following:

Please read this sticky with instructions: Important: Please Read Before Reporting A False Positive
Then, please submit the requested information (and a protection log*) in a new post here: Website Blocking
The Research Staff will evaluate the IP and determine if the block is appropriate. EDIT: Technically, what you are reporting is a suspicious IP, not an MBAM False Positive. But the Malware Team that works on the IP blacklist works in that area of the forum.

OTOH, if you are unfamiliar with the IP and did not knowingly set the Web Exclusion yourself, then it might be a good idea to have an expert assist you with looking into your issue. To do that, please do the following:

Please follow the advice in this pinned topic: Available Assistance for Possibly Infected Computers
Then, please submit the requested preliminary scan logs in a new post here: Malware Removal Help
A trained expert will guide you through scanning your system for possible malware and any needed cleanup.

Thanks,

---------------------------

*How to get PROTECTION or SCAN logs:
(Export log to save as a txt file for posting in the forum when requested)

Open MBAM.
Click on the HISTORY tab > APPLICATION LOGS.
Double-click on the PROTECTION LOG or SCAN LOG which corresponds to the date/time in question (or the one you are asked to post).
Click EXPORT.
Click TEXT FILE (*.txt)
In the "Save File" dialog box which appears, click on DESKTOP.
In the FILE NAME box, type a name for your scan log.
A message box named "File Saved" should appear, stating that "Your file has been successfully exported".
Click OK.
Attach the saved log to your next reply.

December 8, 2014

@CurlySue:

I'm glad your issue is resolved.

Thanks for letting us know.

Just for clarification, though, a few points:

This updating issues does not appear to have a problem with MBAM PROGRAM version 2.0.3 -- if it had been, there would have been many 100s or 1000s of such reports here at the forum.
I'm not sure that updating to program version 2.0.4 was a direct fix.
- One of my "affected" computers was already running 2.0.4 when this happened.
- On my other 2 systems, I was able to "fix" the issue by closing and then restarting MBAM, without updating the program to version 2.0.4.
The problem seems to have been a self-limited issue -- perhaps with some of the servers that deliver DATABASE updates to a small number of users.
MBAM PROGRAM version 2.0.4 was released only a few days ago. Typically, such PROGRAM updates are made available to a portion of users at a time. This is called "throttling" and is typical of security and other program updates by all software publishers, not just MBAM.
- The fact that your particular MBAM installation had not yet offered you the version 2.0.4 is not at all abnormal and does not mean that anything was/is wrong or broken.
- You might want to check to be sure that your MBAM is properly configured to check for PROGRAM updates, not just DATABASE updates (see the screen shot below).
- Users can always perform an on-top or "clean" upgrade to a new PROGRAM version as soon as it is released, or they may wait until the program update comes down via MBAM's auto-updater.
  - You can watch the forum, sign up for the Malwarebytes newsletter, or watch social media to know when a new PROGRAM version has been released.

Bottom line: updating to the program version 2.0.4 was fine, but it may have been a coincidence that doing so appeared to have fixed the "perpetual database updating" problem. And if you had not manually updated to version 2.0.4 when you did, MBAM's auto-updater would have offered you the same program update "automatically" soon enough.

Cheers,

Events

Profiles

Forums

Posts posted by daledoc1

Important Information