MBAM Issues

[hapless]

I get these errors as well, except mine all seem to be of one type:

 

Mbamchameleon Failed to obtain file name information - C0000022

 

The errors appear sometimes twice at the same time (i.e. during the same 1s interval), and sometimes 1 - 3 minute(s) apart, to the second.

 

I am running MBAM Premium 2.0.2.1012 on Windows 8.1 Pro x64.

 

[hapless]

I was wrong about it always saying "C0000022". Today it started with "C000000D":

 

Mbamchameleon Failed to obtain file name information - C000000D

 

I'm sure it will be something else soon as well.

 

In other threads, someone advised disabling "auto protect" under "advanced options". I think that person was referring to MBAM's self-protection feature. That will probably work, since mbamchameleon is used for self-protection (it seems), but we should not have to disable an important security feature to work around this.

[hapless]

Where is the "one user per topic" policy outlined? I don't see forum rules anywhere, and I usually remember to check for these things.

 

I'm also fairly certain that this will indeed prove to be a single issue. And I resent having to decide between disabling self-protection and wear-and-tear on my SSD caused by constant unnecessary log writes.

[1PW]

Hello hapless:

It is less confusing for everyone if we adhere to the "one user per topic" sub-forum policy.

Please start a NEW, SEPARATE topic using this >><< button.

Staffers, experts and helpers will be able to more easily provide both you, and the OP/Topic Starter, with individualized assistance to get you both up and running.

Thank you always for your patience and understanding.

[hapless]

Hello hapless:

It is less confusing for everyone if we adhere to the "one user per topic" sub-forum policy.

Please start a NEW, SEPARATE topic using this >><< button.

Staffers, experts and helpers will be able to more easily provide both you, and the OP/Topic Starter, with individualized assistance to get you both up and running.

Thank you always for your patience and understanding.

 

You've simply repeated yourself. You mention a policy; I asked where I may read this policy.

 

I agree with malbilling that it generally makes more sense to keep related posts in their proper threads. But I will abide by policy of course, if there actually is one.

 

I am dubious here because normally (i.e. in the vast majority of forums out there), a forum participant gets chastened for precisely the opposite behavior--opening separate threads for existing issues.

[daledoc1]

Hi, @hapless and @malbilling:

 

If "policy" doesn't work for you, let's say it's a "practice".

 

Semantics aside, each computer is unique.

Problems that seem "the same" most often are not.
The same is true for solutions.

They most often need to be individualized.

It confuses everyone -- and it not particularly fair to the OP/Topic Starter -- to have multiple users reporting what may or may not be the same issue in one topic.

Whether intentional or not, such "hijacking" and cross-posting in multiple threads started by other users really complicate matters.

 

We volunteer helpers and all the staff and experts are only trying to help.

It's up to you if you wish to allow us to do so in the most efficient, accurate and equitable manner for you and for every other user.

 

Cheers,

[hapless]

I disabled MBAM's self protection, and no longer get these messages filling my event logs. Any hope at a fix? Or ... what do I ("we", since I'm not the only one having this issue, as we've seen) need to do to get heard?

[daledoc1]

Hi:

 

For the record, it appears that the moderator team may have collected several of your posts into this one thread for you.

That's why it appears that we have been repeating our advice.

 

Having said that, I think this recent reply to another user explains the behavior you are seeing:

 

 

Hello Johnf25.

See my post in the Beta area, as well as in MBAR forum, which uses the same type of mbamchameleon driver

This is normal and expected in some cases. Chameleon (mbamchameleon driver) is checking digital signatures/certificates of processes in memory. When it is unable to verify, it is logged as an Information event. It's not an issue of concern in this case.

As to why mbamchameleon is running, Firefox has the right idea. If you're using MBAM 2.0 and self-protection is enabled, that is the mbamchameleon driver.

https://forums.malwarebytes.org/index.php?/topic/145618-problem-in-event-viewer-source-mbamchameleon/#entry813011

 

I am not on the development or QA team and I don't work for Malwarebytes, but as I understand it, you don't need to disable self-protection, and you don't need to worry about the logged events. They are expected behavior.

 

(FWIW, self-protection is not strictly necessary for most users under routine conditions.  So, unless you practice high-risk computing practices, disabling Self-Protection is not a big deal. It is actually disabled by default. More info about the SP module is in the FAQ and the user guide)

 

Perhaps the staff will have some additional advice for you.

 

Thanks,

[hapless]

Thank you. I don't have the time or energy to search down all these separate posts and threads. I got upset when I thought my posts had been deleted, and was glad to find they had been moved instead.

 

The events may be expected, but they are undesirable. They represent constant writing to my SSD, and they fill the event log and make it harder to find entries I actually care about. The problem is that if the MBAM team is saying "Just ignore them; they don't matter", the flip side of that coin is "If they don't matter, then don't write them to the log in the first place!"

 

Normally, constant log bombardment would be something you would see only in betas or during explicit debug use. But hey, it's been years since I programmed so what do I know?