Flash Scan after Successful update

[iammike]

Hi,

I would like to see that the option "Run flash scan after successful update" only runs if a Update has really downloaded a newer Sig update. Now a flash scan is run even if no newer Sig Update is available.

[daledoc1]

Hi, iammike:

Are you sure that's what you are seeing?

AFAIK, the "Flash Scan after successful update" ONLY happens if, in fact, there is a database update.

If the scheduler checks every hour, but there is no update, then there ought not to be a resulting Flash scan.

For example, I have my updates scheduled to check every hour.

Only when there is a new definitions update -- 10, 12 and occasionally a few times more often in a 24-hour period -- do I get a Flash scan and tooltip balloon notification.

IOW, AFAIK if there's no available update, then there ought not to be a flash scan.

If you're seeing some other behavior (flash scans happening too frequently, without updates), then there might be something amiss in your scheduler settings, or another glitch.

If that's the case, please run the mbam-check tool, as described below.

Then, please post back with the checkresults.txt log and a couple of your protection logs attached to your next reply.

These will provide the MBAM staff with a bit of information that will permit them to pinpoint the cause and the solution for you.

Thanks!

daledoc1

-----------------------------

Create an mbam-check log:

Download mbam-check.exe from HERE and save it to your desktop.

Double-click on mbam-check.exe to run it, it should then open a log file.

Please attach to your next reply the CheckResults.txt file which should now be located on your desktop.

Then, if you can, please also upload your 3 most recent Protection module logs:

In Windows XP, these logs are located in: C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs

In Windows Vista/7, these logs are located in: C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs

[iammike]

Hi Daledoc1,

thanks for the help on my "two issues"

I will turn the "Flash Scan ..." back on as I have unchecked it now. And as soon as I it does a scheduled updated I will post the log (I have deleted all older logs)

[daledoc1]

Hi:

The experts would actually need to see the checkresults.txt log & the protection logs to really see what's going on with your system.

You can send these any time.

They don't necessarily need the Flash Scan logs themselves, especially if they are clean.

Please take another look at my instructions and post back with the checkresults.txt log and a couple of protection logs attached to your next reply.

Thanks,

daledoc1

PS I'm going to hazard a guess that perhaps you might have Flash Scans scheduled to run hourly in the scheduler, in addition to and independent of those that run after successful updates?

[iammike]

<snip>

PS I'm going to hazard a guess that you might have Flash Scans scheduled to run hourly in the scheduler, independent of those that run after successful updates.

I have 1 now (a daily one (4pm)) because I disabled the Flash Scan check box from the update box. But before I only had a update scheduled and nothing else

I will wait for the "Scheduled Update" now as I have reenabled the "Flash scan" there and will let you know in about 1 hour and will post the log.

[iammike]

Sorry for the long wait

2013/01/05 12:31:51 +0700 MYPC USERID MESSAGE Scheduled update executed successfully: database updated from version v2013.01.04.05 to version v2013.01.05.02

2013/01/05 12:31:51 +0700 MYPC USERID MESSAGE Starting database refresh

2013/01/05 12:31:52 +0700 MYPC USERID MESSAGE Stopping IP protection

2013/01/05 12:31:52 +0700 MYPC USERID MESSAGE IP Protection stopped successfully

2013/01/05 12:31:53 +0700 MYPC USERID MESSAGE Database refreshed successfully

2013/01/05 12:31:53 +0700 MYPC USERID MESSAGE Starting IP protection

2013/01/05 12:31:54 +0700 MYPC USERID MESSAGE IP Protection started successfully

2013/01/05 12:31:54 +0700 MYPC USERID MESSAGE Executing scheduled scan: Flash Scan | -terminate

2013/01/05 12:31:54 +0700 MYPC USERID MESSAGE Scheduled scan executed successfully

You see it does an Update and right after that it does a Flash Scan.

The only thing I have in the Scheduler is:

Update Hourly, Repeating every 2 Hours, Recover by 1 Hour ("Run Flash scan after .." enabled

Flash Scan (Daily) 4pm Repeating every 1 Day, Recover by 4 Hour

[iammike]

Another update, and here you see it does do a flash scan when it updates.

2013/01/05 13:42:03 +0700 MYPC USERID MESSAGE Executing scheduled update: Flash Scan | Hourly

2013/01/05 13:42:05 +0700 MYPC USERID MESSAGE Database already up-to-date

It's not a big deal, as I can disable the "Run flash scan after Sucessful update"

[daledoc1]

Hi, iammike:

Thanks for those snippets from your protection logs.

Based on what you describe, it's possible that either your scheduler settings might need to be tweaked, and/or there might be some misunderstanding of how the scheduler/auto-updates/Flash scans work?

It would very much help the MBAM staff to sort this out if you would please follow my original recommendations to run mbam-check and post its resulting log, as well as a couple of ***complete*** protection logs, not just snippets.

1) Please take a moment to re-read and follow the steps I posted >>HERE<<.

2) Then please reply with BOTH a full checkresults.txt log AND a couple of complete protection logs attached to your next reply.

Alternatively, since you are a paid user of MBAM PRO, you may contact the help desk directly >>HERE<<.

A member of the support team will help you sort this out one-on-one via email assistance.

When you open your ticket, please reference this topic by including this forum link:

http://forums.malwarebytes.org/index.php?showtopic=120454

Thanks very much,

daledoc1