wijllie

I liked the automated check on boot so you start with the newest definitions without having to do something and it worked that way for years, that's kinda back-engineering a good functionality So I sure hope we can enable this option back in the next release...

Must be a bug, have that too since latest version, I changed nothing and had also the check update on start. After removing the task it's ok, so something has changed in newest version. If it's an option it should work like before without opening up the MBAM screen on startup.

Thanks for clearing this up, I already wondered why I couldn't remove the desktop icon in the past LOL

well I wait till the next update if they got it covered so I don't have to do all the work. In Services I delayed the startup for both scheduler and mbam, let's see if that does something... All other settings in the program itself are tested, delay startup, early protecting, self protection etc. I wonder why the self protection of Mbam is standard disabled??

Ok, so I thought I give it a try, cleaned the installation, download latest, registered it and tody the 2 icons are vack so NO it won't hzlp. I een cleaned extra with ccleaner which found a few items left by the Mbam cleaner....

Same symptoms here with an Acer laptop and Win 8.1 with AVG internet security. It's not always double icon but mostly. Tried every setting (delayed start etc) without succes. Another Samsung AIO I use with Win 8.1 and AVG internet security seems not to be affected.

Thanks for the outstanding follow-up, all clear now

I noticed itunes.exe but as stated before there are a lot other programs altered in that registery section. The reactivator process imho is part of the live optimalisation from TuneUp Utilitys, The live optimalisation handles the priority status of programs so if a program needs it and the pc is too slow TU switches the priority of the process to high. Maybe a good thing would be to test install TU 2012 to understand what's it's all about, there is a free full use 15-days trial available here: http://www.tune-up.com/ I use this program since 2006 and like it very very much, only the new 2012 version has now parts like optimalisation and economy/turbo modus which is probably to much interfering with other programs and settings... But it's not a mallware in any way. Regards, Wijllie (wuif wuif! )

Thx. Got also a statement from Tuneup support team that it should be excluded in your software because it's a legit proces.

Seems not to be from itunes itself but from TuneUp Utilitys 2012 which has his hand on something... So I guess I can leave or delete the entry...? Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\itunes.exe] "Debugger"="\"C:\\Program Files\\TuneUp Utilities 2012\\TUAutoReactivator32.exe\"" Also I've seen other same entry's of that TU debugger line in that directory, wonder what it does? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\googleupdater.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javaws.exe and a lot more but only the itunes.exe came out as a "Security.Hijack"... itunes.zip

There you go, diodn't notice the "attach this file BUTTON first time ;-) Malwarebytes Anti-Malware (PRO) 1.62.0.1300 www.malwarebytes.org Databaseversie: v2012.08.03.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Pierre :: P [administrator] Realtime bescherming: Ingeschakeld 3/08/2012 14:25:55 mbam-log-2012-08-03 (18-24-33).txt Scantype: Volledige scan (C:\|X:\|) Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM | P2P Uitgeschakelde scanopties: Objecten gescand: 567277 Verstreken tijd: 3 uur/uren, 28 minuut/minuten, Geheugenprocessen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registersleutels gedetecteerd: 1 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\itunes.exe (Security.Hijack) -> Geen actie ondernomen. Registerwaarden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registerdata gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Mappen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Bestanden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) (einde) mbam-log-2012-08-03 (18-32-46).zip

strange I attached the zip in the first post and since it seems I can't attach it in a second one I will make a new topic later, this topic can be deleted.

Is the ZIP added, can't see an attachement here?

Got a "Security.Hijack" result for an entry in the registry about itunes.exe. I guess this is a false positive since I downloaded it strait from Apple ? Attached a zip with scan result with /developer. Regards, Wijllie

Thanks for your kind answer

AdvancedSetrup, with all respect but it's always easy to copy and paste a drastic workaround which is in most cases not necesaraly, can't you guys see what a hassle it is to do this procedure every time there is a bug in your system (and yes it was)? (Caused by other programs or not, but that should be tested before a major release imho). Today mbam did download the right database file from today so I suppose your technical department addressed and solved the problem. And Yes, I did reboot yesterday so it wasn't the reboot today which corrected the update. For my and other's sake, PLEASE backtalk to the engineers of the program before copy and paste a "reinstall program" solution. Maybe for some people this will help but the most only find it annoying and time wasting... I'm working since 1990 with computers and thousands programs later you're still the only company I jknow who always suggest to do a full clean in first place before trying something else. Thx.

After installing the .1000 update the database is from 12/31/2011 and can't be updated with newer version. I deleted the rules.ref and MBAM succesfully did update the database but again with the 12/31/2011 version. For some buggy reason the program can't get the 2012 update and is stuck with the one from past year. So it's not the fact it can't get the updates, it's downloading always the same old one... Dutch language / Pro version / Win7 starter / Avast FW-AV (updated, mbam excluded and even shut down to test)

Anyone?

Just found what is wrong; Dutch translation. The Dutch translator wrote the text for main screen and systray the same: "Block malicious websites" Because you noticed the main screen is to autostart I enabled the English version and then the right frase is: "start malicious website blocking when protection module starts" so that is something completely different ;-) You can check that yourself, enable Dutch text and you will see the systray and the main screen is the same writing (also on screenshot in previous post) So that was why I thought the function was related to eachother. However! If I disable the "Block malicious websites" in the systray I can't enable it even after 5 minutes, in previous version this was no problem. EDIT; in the systray it's enabled after 10 to 15 minutes, this is WAY too long, maybe you could loosen it from waiting on the off-load?

There is no autostart indicated in the systray, only for the protection module itself. The option for blocking websites is just "on" or "off" but as I said if it's not enabled already in the systray you can't enable it there... Procedure: -Blocking websites in main screen is enabled. -Blocking websites in systray is enabled. -If you then disable the blocking of websites in systray you can't enable it again there. At that point you have to disable it first in the main screen and the strange thing is it is still enabled in the main screen. So imho there must be a bug between the main and systray connection. With the previous version that worked without a problem and no reboot was needed just to enable/disable website blocking...

When IP protection is enabled in main screen it isn't shown in systray (and vise versa). You can't enable/disable it properly in systray, it just doesn't work. After enabling/disabling a few times in the main screen you can get it right in the systray but it is not working like it should. (Pro version, Win7 and latest updates, latest MBAM and updates, Dutch.)

Thanks for your help HTH, much apreciated!

When looking what autostarts on my computer with the program autoruns.exe (good tip by the way) I found this entry in the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ ): A search with Google didn't find a (program)source of this file. One search was a page which says this file is mallware but today all this sites are saying any file is (possible) mallware to sell their software so I don't trust that. ( spydig.com/file-diagnosis/WIASF-AX.html) Mallwarebytes or other AV programs seems not detect this as a treath. My question is if this file could be related to digital camera programs or Skype/Pinnacle drivers or other programs. Filesize is 40.448 bytes / file date: september 11, 2002 / Copyright

I'm a payed customer (6 licences - no corporate.) IF you make an option in the program for an auto-update ONBOOT and this fails (makes zero filesizes and crashes the program if you reboot the system) then it's obvious something should be done about it. Otherwise remove the option. IF you make an option to make manual scans and I like to do it because I downloaded some stuff or visited some sites and want to check immediatly I can because the option is there. If you find that not needed, again, remove the option. quote: The whole idea of buying the Pro version is to keep you better protected and have the entire process automated Well, that's exactly my point; but the "automated" onboot update fails and the "automated" scan scans WITHOUT the latest refs because there is no "automated" update before a scan which IMHO is always better. I kinda find your reply strange... (love it or hate it) Regards, Wijllie.

Great, this would solve any problems on boot if the internet connection is not established. But on a second thought; a delay of 5 minutes could still make problems if for instance the internet connection is temporary shut down for a longer time. A better solution to solve this would be a internet connection check before updating refs or program... I think this is important enough to avoid zero filesizes and program crashes... Also I like to see a auto ref update BEFORE any scheduled or manual scans are aplyed; now while a scan is running I see sometimes an update of the refs is coming in. The update should be automaticly downloaded before any sort of scanning so you scan always with the newest/latest refs.... Regards, Wijllie