Why do I have 2 MalwareBytes icons in my Win 7 tool tray?

[Tinsby]

Seems like each time I start Win 7, I end up with 2 icons for MBAM. I have to close one and then update the remaining one.

 

What's causing this? I have tried to remove and re-install but it hasn't helped.

 

Thanks!

[Firefox]

Hello and

Let's try this first....

• Please uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
• If that does not correct the issue, then please read the following and post back the 3 requested logs - Diagnostic Logs

  (the three files should be CheckResults.txt, FRST.txt and Addition.txt)

• NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Thank You,

Firefox

[Tinsby]

Hello and

Let's try this first....

• Please uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
• If that does not correct the issue, then please read the following and post back the 3 requested logs - Diagnostic Logs

  (the three files should be CheckResults.txt, FRST.txt and Addition.txt)

• NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Thank You,

Firefox

 

When I d/l the cleaner program my Norton Antiivirus pitches a fit and deletes it. I am assuming this is a false postive? Yes I know how to disable Norton, I don't like to but I can.

 

Thanks,

 

J T

[1PW]

Hello Tinsby:

 

If you have not restarted your computer and the two Malwarebytes Anti-Malware icons are still present, a Malwarebytes staffer in the Quality Assurance department may wish to request process dumps from you, if convenient.

 

This is an elusive instance that we would like to captured. Please advise the status of your system.

 

Thank you.

 

CC: Jekko  (Jon Eco) QA

[Tinsby]

Hello Tinsby:

 

If you have not restarted your computer and the two Malwarebytes Anti-Malware icons are still present, a Malwarebytes staffer in the Quality Assurance department may wish to request process dumps from you, if convenient.

 

This is an elusive instance that we would like to captured. Please advise the status of your system.

 

Thank you.

 

CC: Jekko  (Jon Eco) QA

 

 

1PW,

 

I will be glad to supply logs or whatever else you need but I didn't get a response about the cleaner program setting off my Norton AV. Until I hear that the program hasn't been compromised, I won't go any further with using the cleaner. I will have to disable my AV to even get it to stay on the desktop. Probably a false positive from Norton but I don't get a lot of them so I have to take the warning seriously.

 

Thanks,

 

J T

[1PW]

I will be glad to supply logs or whatever else you need but I didn't get a response about the cleaner program setting off my Norton AV. Until I hear that the program hasn't been compromised, I won't go any further with using the cleaner. I will have to disable my AV to even get it to stay on the desktop. Probably a false positive from Norton but I don't get a lot of them so I have to take the warning seriously

If you are willing to help us with the "Two Icons" issue, then we don't yet want the mbam-clean.exe utility used yet. Even so, can you add an exclusion in Norton Antivirus later permitting the download?

The most immediate subject is; are two MBAM icons in your system tray now? Or has a system restart temporarily corrected that issue?

If two MBAM icons are present, please read the following and attach the 3 requested logs in a reply to this thread: Diagnostic Logs.

Thank you.

[Tinsby]

If you are willing to help us with the "Two Icons" issue, then we don't yet want the mbam-clean.exe utility used yet. Even so, can you add an exclusion in Norton Antivirus later permitting the download?

The most immediate subject is; are two MBAM icons in your system tray now? Or has a system restart temporarily corrected that issue?

If two MBAM icons are present, please read the following and attach the 3 requested logs in a reply to this thread: Diagnostic Logs.

Thank you.

 

 

1PW,

 

 

Sure I'd be glad to help. But the damnable thing is that NOW I have reported the dual icons and I can't get the problem to re-appear! It's been doing it for months and I've just put up with it. I have made no changes to the system to try and fix the problem, other than a remove and re-install many moons ago. Nothing recent at all.

 

As of today I have an "X" on my speaker icon saying " the audio service isn't running" but it IS and I have sound as always, never had this happen before today and haven't a clue why.

 

When the double icon comes back and I know it will, I'll take a screen shot and then follow your directions above.

 

This is typical behavior, you go to the dentist and your tooth stops hurting... >sigh<

 

J T

[MikeW]

Tinsby

If its any consolation this occurrence was reported by several of us when beta testing version 2. We never did get any

answer. For me the problem eventually went away. I know not why

[Maurice Naggar]

Hello,

 

Can you tell us if this computer has installed both the Anti-Malware and also the Anti-Exploit ?

What colors are those icons?   and if you hover your mouse over the icon ( for each / 1 at a time) what does Windows display for the name description?

[Maurice Naggar]

To Mikew

 

Tinsby

If its any consolation this occurrence was reported by several of us when beta testing version 2. We never did get any
answer. For me the problem eventually went away. I know not why

 

I have no direct experience on what you describe.  However, I believe that was related to Windows notification cache.

If so, a cure is described here  http://www.sevenforums.com/tutorials/13102-notification-area-icons-reset.html

[1PW]

In the few cases we began to pursue this, hovering the mouse pointer over each of the blue icons would render different database versions.

This led to confirmation of two mbam.exe processes, with unique PIDs, in the Windows Task Manager.

As we were not making rapid progress, Jon requested mbam.exe process dumps and we also started looking into methodologies for producing and conveying full system dumps. I have also reached out on another forum to a different user who had seen it more than once, but the condition didn't return.

Further pursuit of those instantaneous conditions were usually thwarted when the user(s) was influenced, by a well meaning third party, to restart their computer and/or re-install MBAM2, etc, thereby loosing those precious few data acquisition opportunities.

Any assistance with this rarely repeating condition is of course greatly appreciated.

[Tinsby]

In the few cases we began to pursue this, hovering the mouse pointer over each of the blue icons would render different database versions.

This led to confirmation of two mbam.exe processes, with unique PIDs, in the Windows Task Manager.

As we were not making rapid progress, Jon requested mbam.exe process dumps and we also started looking into methodologies for producing and conveying full system dumps. I have also reached out on another forum to a different user who had seen it more than once, but the condition didn't return.

Further pursuit of those instantaneous conditions were usually thwarted when the user(s) was influenced, by a well meaning third party, to restart their computer and/or re-install MBAM2, etc, thereby loosing those precious few data acquisition opportunities.

Any assistance with this rarely repeating condition is of course greatly appreciated.

 

Hello 1PW.

 

I have the condition NOW on my machine. I have a screen shot of it as proof.

 

I only have the Premium MBAM installed there is no Anti-Exploit. Also hovering the cursor over the icons yeields the same information both are the same program number but one is updated and the other not.

 

Let me know what you want me to do as soon as you can please. My machine is a triple boot and at times I need to change to another OS, I can't guarantee that the dual icons will be there on a reboot. Today I cold booted and went right to Win 7 and there they were!

 

J T

[Maurice Naggar]

May I suggest that you use Control Panel >> Programs and Features  and review the list of installed programs.

How many do you see for Malwarebytes Anti-Malware ?

 

You said this pc has a triple boot setup.   How do you control that at startup?

and

Did you install the Anti-Malware in more than one o.s. partition ?

[Jekko]

Hello!

 

I've been informed of the situation and we've been hoping to get another instance of this happening.

• Could you please give us a log using mbam-check?
• Also, if possible could you run Wireshark in the background and save the logs from that as well?  (if you are unfamiliar with wireshark, we can convert this to a support ticket and work with you 1-on-1).

[MikeW]

To Mikew

 

 

I have no direct experience on what you describe.  However, I believe that was related to Windows notification cache.

If so, a cure is described here  http://www.sevenforums.com/tutorials/13102-notification-area-icons-reset.html

Thanks for the reply. Resetting the cache made no difference. In my case the second icon eventually disappeared after a

version update.

[Maurice Naggar]

@ Mikew

Thats fine.  I you have the same situation still, then see the suggestion by Jekko above  ( just before your last post).

[Tinsby]

May I suggest that you use Control Panel >> Programs and Features  and review the list of installed programs.

How many do you see for Malwarebytes Anti-Malware ?

 

You said this pc has a triple boot setup.   How do you control that at startup?

and

Did you install the Anti-Malware in more than one o.s. partition ?

 

May I suggest that you use Control Panel >> Programs and Features  and review the list of installed programs.

How many do you see for Malwarebytes Anti-Malware ?

 

You said this pc has a triple boot setup.   How do you control that at startup?

and

Did you install the Anti-Malware in more than one o.s. partition ?

 

hello Maurice,

 

There is only one instance of MBAM in the program list in Win 7.

 

I control the multi-boot by using a program called EasyBCD, it controls the booting of XP, Win 7 and Ubuntu Linux.

 

Only one instance of MBAM on the machine since I rarely if ever use XP anymore, only to send PGP mail to a friend. Add to that fact that each parition that uses an MS OS has it's own registry completely independent of one another. One can't 'see' the other one no matter what, and Linux won't run a .exe file unless I use Wine, and I am not using Wine.

 

Thanks,

 

J T

[Tinsby]

I now have WireShark installed.

 

What routine do you want me to start / monitor?

 

J T

[Tinsby]

Since there was a delay in getting instructions vis a vis WireShark, the machine went to sleep and I lost the duplicate icons. I do however have the log from MBAM when the icons were present.

 

Do you want me to just copy and paste the log in here? I see no way to add it as a zip file or as any attachment in the options above.

 

J T

 

Whenever the icons appear again, I will be glad to run WireShark IMMEDIATELY, if I know what to run.

[Tinsby]

Not to beat a dead horse but I have the icons again.....

 

 

 

 

 

I can't help bu notice the difference in the 2 versions at least in the database......

[1PW]

I am sending you a PM soonest.

[1PW]

Log files may be attached through the use of the "More Reply Options" button in the lower-right of your topic's window.

 

Your post #21 is priceless. Thank you.

[1PW]

Hello Tinsby:
 
Malwarebytes staffers (Maurice & Jon) probably have gone home for the day.
 
Please create a separate full memory dump file for each mbam.exe instance if and while the multiple instances are still occurring:
 

Create a Full Process Dump using Microsoft's Sysinternals Process Explorer Utility

• Please download the latest Sysinternals Process Explorer from >>here<< and save it to your desktop.
  • Note: If using Windows Vista or Windows 7/8 then you also need to do the following:
  • Right-click on procexp.exe and left-click Properties.
  • Left-click on the Compatibility tab.
  • Under Privilege Level check the box next to Run this program as an administrator.
  • Left-click on Apply then left-click OK.
• Double-click procexp.exe to run it.
• When you see multiple MBAM icon instances happening, find the first mbam.exe in the process list in Process Explorer, note its PID#, and right-click on it and hover your mouse over Create Dump and left-click Create Full Dump...
• Save the mbam.dmp file to your desktop and close the Process Explorer.
• Right-click on the mbam.dmp file you just created and hover your mouse over Send To and left-click Compressed (zipped) Folder.
• Right-click the mbam.zip file and Rename it to mbam{PID#}.zip.
• Attach the .zip file you just created to your next reply.
• Repeat steps 2 through 7 of these dump file capture procedures for the next mbam.exe process.

Also, please read the following and individually attach the 3 requested logs in a reply to this thread: Diagnostic Logs.
 
Thank you.

[1PW]

Hello @MikeW:

If you are following the above, and have multiple mbam.exe instances now, it is less confusing for everyone if we adhere to the "one user per topic" sub-forum policy.

If you can post (Attach) the above requested files in your own topic, it would be most appreciated.

Please start a NEW, SEPARATE topic using this >><< live button here.

Thank you always for your patience and understanding.

[Tinsby]

Hello @MikeW:

If you are following the above, and have multiple mbam.exe instances now, it is less confusing for everyone if we adhere to the "one user per topic" sub-forum policy.

If you can post (Attach) the above requested files in your own topic, it would be most appreciated.

Please start a NEW, SEPARATE topic using this >><< live button here.

Thank you always for your patience and understanding.

 

 

Be glad to do that when the error occurs again right now only one instance is showing.

 

Where in the options can I attach a file other than one using a url which I don't have?

 

Sorry I am not seeing it...

 

Tinsby