Upgrade from 1.75 questions

[mynorgeek]

I am finally ready to upgrade to 2.0.2 from 1.75.  For a variety of reasons, I have been reluctant to do so until now.

I own several licenses, and I've made a disk image so I can restore in case I encounter any issues.

Please advise, should I uninstall 1.75 before installing 2.0.2, or can I go over top?

If it is recommended that I uninstall, is there a process that works best?

Please forgive me if this has been discussed many times already... I searched a bit, then opted for asking directly.

Help is appreciated.

[daledoc1]

Hi:

 

You should be able to install on-top.

My own personal preference for major software version updates -- not just MBAM -- is to do a clean upgrade.

It seems to minimize the chance of minor problems.

 

Our forum Root Admin, AdvancedSetup, has prepared a very detailed, clear, stepwise tutorial: MBAM Clean Removal Process 2x

If you follow those steps, you should be all set.

A couple of tips:

As instructed in the tutorial, please be sure you have the license ID and key handy first and please be sure to reboot (restart) the computer after running the removal tool, when prompted.

It's also a good idea to reboot again after you have installed and activated/updated MBAM 2.0.

 

Please post back and let us know how it goes.

 

Thanks,

 

 

[mynorgeek]

Hi,

I took the shortcut method... one that has always worked fine for me, by the way.

2.0.2.1012 is now installed on 1 pc and just finished 1st scan.  All looks well.

 

One more question... what is the 'Self-protection module' that is disabled by default?

I am assuming it is different than 1.75's 'Filesystem Protection'?

And I see there is a separate setting for Malware Protection.

 

Any explanation of these terms and functions will be helpful,

TY!

[daledoc1]

Great!
I'm glad you are all set.
 
MBAM 2 Self-Protection is a new feature.
As the name suggests, it's an optional feature to protect the MBAM program itself from alterations by malware, as explained here.

 

Enable self-protection module: This setting controls whether Malwarebytes Anti-Malware creates a safe zone to prevent malicious manipulation of the program and its components. Checking this box introduces a delay as the self-protection module is enabled. While not a negative, the delay may be considered undesirable by some users. When unchecked, the "early start" option which follows is disabled.http://www.malwarebytes.org/support/guides/

One reason it is disabled by default is that -- when enabled -- it will block certain routine tasks, such as moving/renaming or deleting the desktop shortcut icon, cleanly reinstalling the program, or installing other Malwarebytes products. 
To minimize confusion -- and because it's not necessarily, routinely needed for many users -- it is disabled by default.

If you do enable it, just be sure to disable it before performing a clean removal/reinstall, etc.
 
All of this -- and more -- is explained in greater detail in these resources:
There is an FAQ Section here: Common Questions, Issues, and their Solutions
And here are links to the MBAM 2.0 User Guide: Online and PDF
And there are many useful KB topics and videos at the helpdesk support page

 

Cheers,

[mynorgeek]

Thanks a million, daledoc1.  You've provided me with a wealth of information.

I'll spend some time with the links you posted.

Take care. 

[mynorgeek]

  From reading 'Common Questions and Issues', I see that...

 

There is currently no way to disable automatic/silent PROGRAM update checks. The program will always check for program updates when it checks for database updates. An option to disable this program update check will be added to a future release.

 

So the question is, (and I fear that I know the answer), while the program always checks for program updates, is there any way to prevent prog updates from being downloaded and installed?

That is a very useful setting in 1.75, as far as I am concerned.  I always prefer to make my own decision as to whether or not an upgrade is to be installed.

 

If the answer is no, there is no way to stop the installation of program updates, I sure hope Marcin and his strong team make that option available to us once again soon!

[AdvancedSetup]

Not in 2x at this time. This feature is supposed to be restored though in a future program update though.

[mynorgeek]

Upon upgrading to 2.0.02 from 1.75, I noticed something I had conveniently forgotten.

I have almost 300 Windows system files in quarantine from MBAM's April 2013 Trojan.Downloader.ED fiasco (sorry, no other word for it).

Most are System32 dll files.

I think it's about time to delete these 300 quarantined files, but wanted to confer with an expert before doing so.

Do you see any compelling reason to maintain these quarantined files, or is it okay to delete them?

I guess what is giving me pause is the wording in the MBAM quarantine dialog...

"Objects deleted from quarantine will be permanently removed from your computer"

Does that mean removed just from the quarantine database, or also from the computer, i.e. the System32 folder?

TY!

[daledoc1]

Short answer: Probably OK.

Longer answer: If the items have been in quarantine for months with no apparent ill effect, then it's more than likely safe to remove them. But we can't say for sure without seeing the details of what they are. I assume that your recent MBAM and AV scans are all clean?

 

It is true that if you remove the items from Quarantine, or if you perform a clean program reinstall/upgrade (using the mbam-clean removal tool), they will be permanently removed from the computer.

 

I don't have anything quarantined on my system, so I don't know if it's possible to export a quarantine log in version 2, as one can do with scan logs (it probably is).

But, if you run the mbam-check tool from the link >>HERE<<, it should contain a list of the quarantined items in its log.

While you're at it, it would be a good idea to run BOTH tools (FRST and mbam-check) and to post back with all 3 logs.

 

You can post back those logs and the staff/experts can take a look and advise you.

 

Thanks.

 

 

[mynorgeek]

I was really hoping that someone could answer the general question I posed... 

>>>When objects in quarantine are deleted, does that mean deleted only from the quarantine database, or also from the computer, i.e. the System32 folder?<<<

All of the quarantined System32 files obviously exist currently in the Windows folder where they belong... my pc has been running fine since recovering from the April 2013 episode.

But the more I read the MBAM quarantine dialog note, the more I question what will happen if I delete them.

"Objects deleted from quarantine will be permanently removed from your computer"

 

Can I get some guidance from Ron Lewis as to the above question, before having to go through the log gathering and posting steps suggested?

And yes, you assume that my recent MBAM and AV scans are all clean.  No issues since April 2013 false positives.

 

As always, daledoc1, thank you for your helpfulness.

[AdvancedSetup]

They will only be removed from Quarantine as they were moved there in the first place. You can think of it as a special type of Recycle Bin

 

Yes you can safely empty the Quarantine Folder now as it will make no difference one way or the other to your computer.

[mynorgeek]

They're gone!  Thanks to you and daledoc1 for the timely assistance.

I appreciate it.

[AdvancedSetup]

Great. I'll go ahead then and close this topic now.

 

Take care