Windows Boot-up Error After Update to v. 1.61.0

[lmacri]

I upgraded from MBAM Pro v. 1.60.1.1000 to 1.61.0.1400 yesterday on a Vista 32-bit machine and now I receive an error message titled "Found New Hardware" every time I boot-up that states "Windows needs to install driver software for your unknown device". If I follow the recommended solution and try to locate and install the driver software, Windows reports that it can't find the driver software and generates the following generic Problem Report for PnPDriverNotFound:

Product

Driver software installation

Problem

Could not find driver software

Date

11/04/2012 10:42 PM

Status

Report Sent

Description

Windows detected a new device attached to your computer, but could not find the driver software it needs to make the device usable. Each device manufacturer typically includes driver software of a CD that comes with the device, or as a download from its website. The hardware ID of your device is .

Problem signature

Problem Event Name: PnPDriverNotFound

Architecture: x86

Hardware Id: unknown

OS Version: 6.0.6002.2.2.0.768.3

Locale ID: 4105

Extra information about the problem

Bucket ID: 3083014

I checked my Device Manager and I now have a device named "Unknown Device" under the "Other Devices" category, and the Details tab shows that the device instance path of this unknown device is ROOT\LEGACY_MBAMSERVICE\0000.

I've tried re-installing MBAM v. 1.60.1 from scratch (uninstalling from the Control Panel, running mbam-clean.exe, disabling my Norton anti-virus before re-installing MBAM) but that hasn't solved the problem. I also tried a Windows System Restore but got a message that Windows was unable to complete the restore (an error I've seen before when I tried a previous system restore and likely has nothing to do with the MBAM update).

I've plugged a few USB devices and Plug and Play (PnP) seems to be identifying my USB mouse, printer, etc. correctly, and MBAM v. 1.61.0 updates and on-demand scans seem to be running normally as well.

The next time I boot up and see the "Found New Hardware" error mesage, would it be safe to select the "Don't show this message again for this device", or is this error something that needs to be addressed?

Please note that I originally uninstalled the old v. 1.60 using the free Revo Uninstaller in Advanced Mode and then ran the mbam-clean.exe utility to wipe all traces of the old version off my system (which I always do every time I update MBAM) and it's possible that Revo removed a Windows registry entry that it shouldn't have this time.

--------------

MS Windows Vista Home Premium 32-bit SP2 * NIS 2011 18.7.1.3 * MBAM PRO v. 1.61.0.1400

HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[exile360]

Greetings

Please do the following:

• Download and run mbam-clean.exe from here
  
• It will ask to restart your computer, please allow it to do so very important
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes Anti-Malware from here
  
  • Note: You will need to reactivate the program using the license you were sent via email if using the Pro version
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that Malwarebytes Anti-Malware is in the task tray if using the Pro version. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or ask and we'll explain how to do it.
    

Please let us know if the issue is now resolved or not.

Thanks

[lmacri]

Hi exile360:

A clean re-install of MBAM v. 1.61.0.1400 did not solve the problem with the Windows boot-up error.

[exile360]

Hello again

Please try uninstalling the unknown device by right-clicking on it in Device Manager and choosing Uninstall.

It may well be that Revo removed something it shouldn't have. For future reference, we genarally only recommend doing a clean uninstall if there are problems, as our product is designed to be able to handle in-place or over the top upgrade installations, and even if it is necessary, we only recommend using our mbam-clean.exe utility, as other tools, like Revo, may from time to time remove something that is critical to the system.

[lmacri]

Hi exile360:

Uninstalling the Unknown Device from Device Manager has solved the problem with the Windows boot-up error (yeah!), but I'm still uncertain if MBAM Pro is installed correctly.

Is it normal for MBAM Pro (registered) users to be unable to stop the MBAMService from Windows Services (see attached screenshot)? I noticed this after I had uninstalled the Unknown Device, so I decided to try re-installing MBAM v. 1.61.0.1400 from scratch as follows:

1. Uninstalled MBAM 1.61 from the Control Panel and re-booted
   
2. Ran mbam-clean.exe and re-booted
   
3. Ran mbam-clean.exe again for good measure and re-booted
   
4. Disabled anti-virus protection (NIS 2011) and re-installed MBAM 1.61
   
5. Re-booted and everything looked fine (no error message on boot-up and no unknown deivce in Device Manager, could update MBAM and run a manual Quick Scan)
   
6. Registered MBAM but declined enabling of real-time protection mode (since I have NIS 2011) and auto-updating (since I have a slow Internet connection and run my MBAM updates manually every day)
   
7. Scheduled a MBAM Quick Scan to run daily at 6:00 PM
   
8. Re-booted and everything still looked fine (i.e., still no error message on boot-up and no unknown device in Device Manager, could update MBAM and run a manual Quick Scan) but noticed that MBAMService cannot be stopped from the Windows Services.
   

I scanned my registry for entries related to MBAM (see attached screenshot - please note that I do not routinely use a registry cleaner to "fix" my registry) and noticed that I have several entries in HKLM\System\CurrentControlSet\ referring to a device called MBAMProtector (as well as the MBAMService service) that I have "no permission to modify". Is there any chance that I am unable to stop the MBAMService from Windows Services because I have some corrupted permissions in my MBAM registry that is preventing the System and/or Administrator group from making changes to the registry?

--------------

MS Windows Vista Home Premium 32-bit SP2 * NIS 2011 18.7.1.3 * MBAM PRO v. 1.61.0.1400

HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[exile360]

It's quite normal for you not to be able to stop MBAMService. That service runs at kernel level, so stopping it can result in system instability. Stopping it would also prevent scheduled scanning and scheduled updating from working.

Also, just FYI, you can run our realtime protection alongside NIS without issues as we have tested this configuration ourselves, as have many of our users who run NIS, and there should be no conflicts between the two. Malwarebytes Anti-Malware is designed to be able to safely co-exist with your resident antivirus, not replace it.

Additionally, since we now have incremental updates for the PRO version, I would recommend scheduling your updates, because even with a very slow connection (like dial-up), the size of the database downloads would be quite tiny (generally only a few KB if set to a good frequency, such as hourly).

[lmacri]

It's quite normal for you not to be able to stop MBAMService. That service runs at kernel level, so stopping it can result in system instability. Stopping it would also prevent scheduled scanning and scheduled updating from working.

Hi exile360:

Thank you for confirming that MBAM Pro 1.61.1 appears to be working correctly again - and for all your excellent suggestions regarding real-time protection and automatic updating. Please consider this issue solved.

I think you're correct that using the free Revo Uninstaller might have caused the problem in the first place. When I originally purchased my MBAM Pro licence back in July 2009 (version 1.38) I could prevent the mbamgui.exe process from starting automatically at boot-up (see attached screenshot) and my MBAM Quick Scan would still launch at 6:00 PM as scheduled. I've noticed in the past year or so that the mbamgui.exe process will re-enable itself after every re-boot, and after reading your comments in your previous post I suspect that Malwarebytes' has improved MBAM's product tamper protection to prevent malware from attacking and turning off the real-time protection. The Revo Uninstaller probably tried to remove some registry entries or files before the native MBAM uninstaller was able to shut down my MBAM services in an orderly fashion and somehow corrupted my Windows registry.

Thanks again for all your help.

-------------

MS Windows Vista Home Premium 32-bit SP2 * NIS 2011 18.7.1.3 * MBAM PRO v. 1.61.0.1400

HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[exile360]

You're welcome, I'm glad I could help .

The simplest thing to do, if you don't wish to use realtime protection but do wish to use the scheduler would be to simply open Malwarebytes Anti-Malware and access the Protection tab and then uncheck the option Start protection module with Windows. Unchecking that setting will make certain that the protection module doesn't start with Windows and that Malwarebytes will only launch what is necessary for the scheduler to function.

[lmacri]

Hi exile360:

Thanks for the hint, but I always have MBAM's real-time protection disabled and I've even disabled automatic program updates as well (see screenshots). For some reason, my MBAM installations have never correctly detected when program updates are available for download so I use the FileHippo Update Checker to automatically alert me when updates are released for MBAM. I've also had problems in the past with incorrect MBAM version numbers being detected by Secunia PSI and other third-party software if MBAM updates are installed over an older version so I've gotten in the habit of uninstalling and wiping the old version first (hence my "extra" scrub with the Revo Uninstaller that probably got me into all this trouble in the first place).

These are just minor annoyances compared to the boot-up errors you helped me fix, however, and I suspect these minor MBAM quirks have more to do with a flakey Windows Vista installation that needs to be repaired or re-installed. From now on I'll stick to using mbam-clean.exe if I run into a problem with an MBAM program update.

-------------

MS Windows Vista Home Premium 32-bit SP2 * NIS 2011 18.7.1.3 * MBAM PRO v. 1.61.0.1400

HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[exile360]

Yes, if the protection module isn't running (and thus no Malwarebytes tray icon), you won't get notifications when a new program version is available. Those notifications come from the tooltip balloons from the tray when scheduled updates are executed, notifications you don't get if our tray isn't running.

If you want the notifications but don't want the protection module running, then you can re-check the option I had you disable, and simply uncheck the options for starting file execution blocking with Windows as well as starting malicious website blocking with Windows. The result will be you'll still have the tray icon and notifications from the scheduler, but the protection will not be running.

I also noticed, based on the images you posted, that you appear to be using an older version of the program. If that's the case, I'd recommend updating the the latest release, 1.61.