How to stop MBAMService?

[kimsland]

How to stop MBAMService?

Yes we all love Malwarebytes, but sometimes we don't need it consistantly running in the background.

Examples of this may be when installing a known safe program (ie Adobe products etc)) or even a local (safe) game.

Many state that you can just uninstall Malwarebytes, or even stop it using some startup manager. But this requires a Windows restart, and then to manually re-enable the service again after that!

I notice that MBAMService.exe does not allow the stop service command:

sc stop "MBAMService"

The requested control is not valid for this service.

Nor does 'Stop' option exist in Services alongside MBAMService?

Similarly most Antivirus programs also do not allow 'Stop' as an option.

This is (from what I've found) that by forcibly stopping your Antivirus software, it is possible to corrupt the program itself, especially noted to larger (horrible in my view) antivirus programs such as Norton or McAfee.

But Malwarebytes does not fall into this category of being large.

Plus ending the process in Task Manager (without restart) is:

1. Possible

2. Causes no corruption (from what I've found) to the program

3. Can be easily restarted from Services or start command or even from just running the executable itself!

Can you allow a 'Stop' command in Services? I can't see why not?

It will save about 7Meg of running memory (for the presently running Windows session), and otherwise avoids the user restarting their Windows completely! Just to temporarily stop this service from continuously running when a scan or malware protection is just not required.

Why isn't the Stop command allowed anyway?

Note: I don't wish to disable it, thus re-enabling it later. Nor fully uninstall Malwarebytes. As this requires 1. A restart. 2. Lots more (not required) effort!

I find it ironic that I can stop ALL other services, except a few core Windows services and Antivirus. Is Malwarebytes service classed as critical? If so, then what areas in Windows or the program itself is it affecting that may be damaged on a forced stop? By the way, quite obviously I wouldn't be stopping it whilst in the middle of a malware detection scan. Although 'stop' exists in the program for scanning anyway.

I request that you allow the ability to Stop this service.

Don't worry, it will load up just fine on next restart!

[exile360]

It has proven to be quite unstable, both on our own systems in testing as well as reported by many of our customers, that when you force the service to stop using Task Manager, it's a bad idea.

I've seen system freezes/lockups as the most common problem associated with doing so, and that alone is enough for us not to recommend it. Stopping a service that runs in kernel mode is a bad idea in general, and MBAMService is no exception to that.

Besides that, most of your AV's do continue running, you just don't see them because their kernel mode work is done in drivers, which do NOT stop just becuase you stopped their processes or services (you can run a tool that shows running drivers and you'll see what I mean). Those drivers may not show up in Task Manager, but they are still running, still eating up CPU and memory.

[kimsland]

Stopping a service that runs in kernel mode is a bad idea in general, and MBAMService is no exception to that.

Thanks exile.

I see, because MBAMService.exe service and driver is running in kernel mode, a restart is (generally always) necessary.

I wasn't aware that this specific file runs in kernel mode, since that's the case. Then all answered well.

Actually I couldn't find information on the web stating this file itself specifically runs in kernel mode, is there a link to a topic that shows me all these special drivers of Malwarebytes that run in kernel mode? And which ones of malwarebytes exactly do?

I understand that most antivirus programs cannot be stopped normally, if you want to base this on 'kernel mode' issues then so be it. I'm pretty sure they corrupt all on their own, and therefore I normally would not recommend stopping these services ever! (ie uninstall only)

By the way, I've never seen 'system freezes/lockups' with manually stopping MBAMService but then again you are mostly dealing with corrupted/infected users computers. My system certainly does not cause any ill effect from doing so.

[exile360]

I see, because MBAMService.exe service and driver is running in kernel mode, a restart is (generally always) necessary.

I wasn't aware that this specific file runs in kernel mode, since that's the case. Then all answered well.

Actually I couldn't find information on the web stating this file itself specifically runs in kernel mode, is there a link to a topic that shows me all these special drivers of Malwarebytes that run in kernel mode? And which ones of malwarebytes exactly do?

There is only a single driver and a single service. MBAMService and mbam.sys, and both are used for the protection module.

I understand that most antivirus programs cannot be stopped normally, if you want to base this on 'kernel mode' issues then so be it. I'm pretty sure they corrupt all on their own, and therefore I normally would not recommend stopping these services ever! (ie uninstall only)

An uninstall of Malwarebytes Anti-Maware is unnecessary. You can simply select the option to not have Malwarebytes Anti-Malware start with Windows. The service will still launch at startup, but only to run the scheduler and therefore will be using minimal RAM and no CPU (or you can also set Malwarebytes not to start with Windows and set the service to Manual startup if you're not using the scheduler, then start the realtime protection at your leisure, though a reboot is still required to disable it again).

By the way, I've never seen 'system freezes/lockups' with manually stopping MBAMService but then again you are mostly dealing with corrupted/infected users computers. My system certainly does not cause any ill effect from doing so.

No, that's not the case at all. We've seen it consistently across many test systems, including clean ones, including several fresh Windows installations, including systems we ourselves own, though like your case, it does not always happen on every system or operating system. That doesn't mean it's necessarily a good idea either (I've had many long conversations about this very thing with our lead developer who created and maintains our service and driver and he's always said the same thing, that stopping the service can easily lead to system instability and cause major issues).

Now, that being said, it doesn't mean we're opposed to the idea as long as it can be accomplished safely. That's why for the time being, we do not recommend it. However, if our developers can find a way to make it safe to stop the service, then that's likely what we will do, so that when a user exits the protection module, it terminates the service as well.

[PhoebeAnn]

"However, if our developers can find a way to make it safe to stop the service, then that's likely what we will do,..."

 

Any progress on this? My 3GB Windows 7 systems are essentially unusable, and I suspect mbamservice.exe is the problem; I really would like to be able to make it go away on demand. The free MBAM doesn't seem to have this problem. I tried to post an image of the Resource Monitor output showing mbamservice's 820MB commit, but got a nasty message.

[daledoc1]

Hello and welcome back, PhoebeAnn:

 

You wrote:

 

 

My 3GB Windows 7 systems are essentially unusable, and I suspect mbamservice.exe is the problem

 

This thread is over 3 years old, based on a long outdated, unsupported version of MBAM and located in a "Chat" forum, not a support area.

The replies really aren't relevant today, except to say that it's still the case that disabling mbamservice would not be advisable.

It's not likely that mbamservice is rendering your systems "unusable".

 

Until a staff member has a chance to weigh in, in order to better assist you, we would need a bit of basic system information.

 

I suggest that you please do the following, for ONE computer at a time, please:

• First, please carefully follow the advice in this sticky topic to generate 3 diagnostic logs and save them on your desktop: Diagnostic Logs.
• Then, please start a new, separate forum post in the MBAM help section by using this clickable button.
• When you do, please ATTACH all 3 logs to to that new post.

That way, the forum staff and experts can provide you with customized assistance.

 

Thank you very much for your patience and understanding,

[AdvancedSetup]

Actually I'm going to close this topic. If you do wish to discuss further please follow the advice from daledoc1 and post in the correct forum a new topic.

 

Thank you