[CreateService] Failed to perform desired action. Error Code: 1073

[Matt Amato]

To Support,

15 corporate licenses were purchased and we are having problems with enabling the realtime autoprotect feature. I have tried using the MBAM clean tool and have not found a solution on these forums. This is exactly what happens:

I click "Start Protection" I get Error: [OpenEven] Failed to perform desired action. Error Code: 2

I then Click Ok

System Tray Icon Disappears

I Click Start Protection again

"The Malwarebytes Anti-Malware Protection Module is Already Running"

"[CreateService] Failed to perform desired action. Error Code: 1073"

In the Eventvwr I get:

Eventvwr -> MBAMSERVICE = "The description for Event ID ( 1 ) in Source

( MBAMService ) cannot be found. The local computer may not have the necessary

registry information or message DLL files to display messages from a remote computer.

You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and

Support for details. The following information is part of the event: MBAMService,

mbamservice.exe: WTSQueryUserToken failed with error code 1008."

Please advise on what I can do to get the realtime protection to work as this is the main reason why we purchased the software.

Thank you.

Matt

[Swandog46]

This error means ERROR_NO_TOKEN and is thrown when you try to start the service with no users logged in. Are you using some kind of remote access software or something that does not load your user environment?

EDIT: this can also happen on Windows Vista, say, if you are trying to impersonate Session 0. How you are trying to perform the installation, and on what operating system(s)?

Edited June 22, 2009 by Swandog46

[AdvancedSetup]

Hi Matt,

Start MBAM and ensure the program is registered.

Then please try the following immediately after the open event failure while logged on with Admin rights.

Click on START - RUN and type in CMD and click OK.

type in the following

SC QUERY MBAMSERVICE

It should show the service is stopped. Now run the following

SC START MBAMSERVICE

That should start the service and show as successful. Now run the following including the quotes or change to that directory to run it.

"C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

That should start the tray and protection should be enabled. Now restart the computer and ensure that the tray now launches when any user logs on.

[Matt Amato]

This error means ERROR_NO_TOKEN and is thrown when you try to start the service with no users logged in. Are you using some kind of remote access software or something that does not load your user environment?

EDIT: this can also happen on Windows Vista, say, if you are trying to impersonate Session 0. How you are trying to perform the installation, and on what operating system(s)?

I was RDPing into the client computers. Is this what is causing this error? Do I need to sit at every machine?

[AdvancedSetup]

From my testing all you need to do is reboot the computer and it should be fine.

You can also use a Remote Desktop tool like Dameware or pcAnywhere, etc.. that allows the same console as the user and the error does not happen.

What appears to happen is that some of the Registry keys are not loaded the same as they are when you're physically on the console so it fails if you try to enable at that time, but on reboot of the computer it loads up for the user just fine.

[jeremy whiteman]

From my testing all you need to do is reboot the computer and it should be fine.

You can also use a Remote Desktop tool like Dameware or pcAnywhere, etc.. that allows the same console as the user and the error does not happen.

What appears to happen is that some of the Registry keys are not loaded the same as they are when you're physically on the console so it fails if you try to enable at that time, but on reboot of the computer it loads up for the user just fine.

I am having the same problem described here...

i followed the process you listed (i was connecting via RDP to the workstations as well). I installed logmein and the PC and malwarebytes started fine. I logged out, and logged in via RDP an it was ok.

However, when i rebooted, and logged in through RDP first, i gt the error message again.

Is this always going to be a problem when a PC is accessed first via RDP instead of from the console upon a rebot?

Thanks

Jeremy Whiteman

[AdvancedSetup]

Hi Jeremy,

For now until we find a fix for it yes. We're researching it but so far we've not found a fix for it.

Thanks.

[GridDoctor]

Hi,

I have also seen this problem when installing Malwarebytes 1.40 on 6 PC yesterday.

I was using LogMeIn to connect to the PCs remotely.

When you install 1.40 version of the program it installs database rules 2551.

With database rules 2551 no errors occurred when enabling the Auto Protection service on PC.

After updating the database rules to 2699 I was not able to enable Auto Protection service on any of the PCs

without getting the errors described above.

Yes, I rebooted the PC many times.

I finally uninstalled Malwarebytes on all 6 PCs and rebooted them.

I then reinstalled program version 1.40 with database rules 2551 on all PCs and did not update

the database rules as part of the install. I then rebooted the PCs.

Malwarebytes Auto Auto Protection service started and logged NO errors.

Is the problem related to database rules 2699 or the fact that I am logged into the PC using using LogMeIn?

I have used LogMeIn without problems on many PCs running Malwarebytes.

I am currently run database rules 2697 on my home PC.

If I update to 2699 will I have the same problem?

Should I wait a few days and obtain an update greater than 2699?

Thank You for all help in advance.

Gene

[AdvancedSetup]

I have not tried LOGMEIN so I'm not sure what level it's using. Remote Desktop though does do this and it does not matter which DB version.

It is only noticed by RDP from my testing. If you're at the computer logging in then there is no error.

[jerry_usa]

i am getting the same errors but I am on the local XP PC. It is a single PC in a customers home.. No RDP. logging on as 1 of 3 users on the box. All 3 have admin rights.

JerryS

[GT500]

I have not tried LOGMEIN so I'm not sure what level it's using. ...

LogMeIn has always worked with our protection module in the past, but I am not aware of whether or not it still does.

[Swandog46]

LogMeIn works fine; I use it. Check the protection logs: what is the exact error message you are getting?

[Firefox]

I also use logmein and have no issues....

[AdvancedSetup]

Please also export this key from your registry and post the contents back on your next reply.

HKEY_LOCAL_MACHINE\SYSTEM\Setup

SystemPartition

[GT500]

Please also export this key from your registry and post the contents back on your next reply.

HKEY_LOCAL_MACHINE\SYSTEM\Setup

SystemPartition

I have a nifty program for automating that registry export, if it's needed:

Please download the "SystemPartition_Export" utility at the following link, save it on your desktop, and run it:

http://malwarebytes.gt500.org/SystemPartition_Export.exe

It will create a file on your desktop called "SystemPartition_Data". Please attach that file to a reply.

[jt25741]

Hi Jeremy,

For now until we find a fix for it yes. We're researching it but so far we've not found a fix for it.

Thanks.

Hi all, I hit this post via a Google search for the issue. I run XP Pro, after hitting my system with a RDC session and exiting, Malwarebyes scheduler doesnt properly run and I get the following error, same as others in this thread:

WTSQueryUserToken failed with error code 1008

A workaround ...less than ideal, is to type the following command (I created a batch for it) before disconnect from the RDC (run on the RDC remote server): "tscon.exe 0 /dest:console"

If you do this, the console will be sitting the way it was before the connection, and won't be sitting at the login prompt if you login to the actual PC again. Malwarebyes will continue to run correctly in this case.

Hopefully this helps in interim -- but this should be fixed on the malwarebytes side.