MBA-M Tray App and MBAMService Don't Close

[jholland1964]

I am running Windows 10 Home 64bit and I am using MBA-M 3 Free version. I have MBA-M 3 set to NOT automatically start with Windows and the MBAMService has a Startup Type of Manual.

That part works fine, there are no MBA-M processes running unless I am actually using the program. However, once I have completed my use of the program and close it then the DASHBOARD closes but the MBA-M Tray App AND MBAMService DO continue to run. I have to close them manually. Is this how it is supposed to work?

Of course it is easy enough to go to the MBA-M Tray App and select Quit MBA-M but unless a person can see this tray app, and many people have them hidden so won't see it, these two processes will continue to run. Can't this be changed for the Free version so that once the DASHBOARD is closed the entire program is closed?

One more additional piece of information in reference to this, if a person does not notice that MBA-M Tray App and fails to open it and choose Quit MBA-M and reboots his computer then the MBAMService, which has a Startup type of Manual, automatically DOES start up when the computer starts up and then runs all the time. This needs fixing for sure.

Edited December 15, 2016 by jholland1964

[exile360]

Greetings  

Yes, this is by design.  The app continues to run in the background,  That said, I do believe it is a bug for the startup to be changed when it is left running like that when you have the setting for having it start with Windows disabled and I've reported it to the team.

Regarding why the application closes to the tray rather than terminating completely when in Free mode, I'm not totally certain so I've asked the Malwarebytes 3.0 team for more info.

[jholland1964]

Well this is upsetting that the app is supposed to continue to run. Why must it continue to run in the Free version, it does nothing. Sad, I've been defending this upgrade to others with the same complaint, makes me look like a fool that is for sure. Wish I had not taken the upgrade.I have loved this program since almost the day it was first released. What a total disappointment.

[Gt-truth]

I’ve also have been seen the same issue since I myself had to uninstall the program . after I uninstall it . it still been running in startup area with an error for "MBAM.tray.exe error message popped-up after I uninstall the version 3"

Edited December 16, 2016 by Gt-truth

[NoelC]

I signed up here just to comment on this.

I really just want to be able to scan my system occasionally with the free version without having the service or tray application running all the time.  As far as I can tell, nothing about scanning occasionally requires the service to be running full time. 

I was able to do this by disabling the service and driver in version 2.

I'm willing to accept that with version 3 the service/driver are needed.  Indeed, the mbam.exe starts them as needed - good!  But they just stay running forever more. 

it's sloppy for a product to not implement a timeout and have its service self-exit when it hasn't been needed for a while, e.g., 5 minutes.  Modern computers can start services very quickly.

Since stopping the service does appear cause the tray application to exit, could the following be a workaround?

• Create a script (e.g., batch file) that simply starts mbam.exe from the command line. 
• In the script, after mbam.exe exits, issue a net stop MBAMService directive.

This seems to work.  Can anyone see a downside to doing this?

-Noel

Edited December 17, 2016 by NoelC

[exile360]

Greetings and welcome NoelC

While I don't see any particular problems with your proposed approach, also keep in mind that if you wish all you have to do to terminate Malwarebytes once you're done with it is right-click the tray icon and choose the Quit option.  That will get the tray process and service terminated so that they don't continue to run in the background or run on startup.

If you have any more questions or issues please don't hesitate to let us know.

Thanks

[Ried]

As a side note with the Free version, you can also set it to not start with Windows. When you want to run a scan, double click the desktop icon.

[exile360]

18 hours ago, Ried said:

As a side note with the Free version, you can also set it to not start with Windows. When you want to run a scan, double click the desktop icon.

Hi Lisa,

I believe the issue most users are experiencing is due to the fact that 3.0 does not honor the startup setting once the program has been run again.  In other words, if you set it not to start with Windows, but then exit the program and open it again or reboot and then open it again, it sets the service (listed under services.msc and in the services registry key) to 'Automatic' rather than 'Manual' or 'Disabled' which causes the service and tray to still start automatically on boot, even though the 'start with Windows' setting is still set to 'disabled' in 3.0's settings.

Anyone who knows better please feel free to correct me on what I've said, but having heard from users, I do believe this is the problem being experienced.

[Ried]

I have done this on 2 of my machines, one is Win 7 x64 and the other is Win 10 x64 and I have not had a problem with it honoring that setting.

[exile360]

12 minutes ago, Ried said:

I have done this on 2 of my machines, one is Win 7 x64 and the other is Win 10 x64 and I have not had a problem with it honoring that setting.

Excellent, this must have been fixed then (thank goodness)

Hopefully it's no longer affecting any other users either.  I guess the only remaining issue is with regards to the user experience of the product not exiting completely when the 'X' button is used in the main window and still having to use the 'Quit' function in the tray's context menu to exit the program when in Free mode.

[jholland1964]

28 minutes ago, exile360 said:

Hi Lisa,

I believe the issue most users are experiencing is due to the fact that 3.0 does not honor the startup setting once the program has been run again.  In other words, if you set it not to start with Windows, but then exit the program and open it again or reboot and then open it again, it sets the service (listed under services.msc and in the services registry key) to 'Automatic' rather than 'Manual' or 'Disabled' which causes the service and tray to still start automatically on boot, even though the 'start with Windows' setting is still set to 'disabled' in 3.0's settings.

Anyone who knows better please feel free to correct me on what I've said, but having heard from users, I do believe this is the problem being experienced.

 

21 minutes ago, Ried said:

I have done this on 2 of my machines, one is Win 7 x64 and the other is Win 10 x64 and I have not had a problem with it honoring that setting.

 

6 minutes ago, exile360 said:

Excellent, this must have been fixed then (thank goodness)

Hopefully it's no longer affecting any other users either.  I guess the only remaining issue is with regards to the user experience of the product not exiting completely when the 'X' button is used in the main window and still having to use the 'Quit' function in the tray's context menu to exit the program when in Free mode.

No, it is Not fixed. Let me try to explain what I meant in my original post;

I am running the Free version. In Settings, Protection the Start Malwarebytes' at Windows Start up turned OFF. In Services MBANService has a MANUAL Startup Type. So I manually open the program and then the MBAMService starts up (showing in Background Processes plus the Tray Icon shows there and in the Apps section of Task Manager mbam.exe shows also.   

Once I have completed my use of the program if I just close it by "X"ing out then the DASHBOARD and mbam.exe close but the MBA-M Tray App AND MBAMService DO continue to run and are easily seen if I  look in the Task Manager. Both can  be turned off by Right Clicking the MBA-M Icon in the System Tray (which appears when program opens but does NOT close when using "X" to close the program).

If I reboot the computer without using the Right Click Quit MBA-M on the Tray Icon then, even though it is still set to Manual, the MBAMService Starts up upon rebooting the computer. There is NO change to Start Malwarebytes' at Windows Start up, it is still set to OFF and the other two files for the program do NOT start, only the MBAMService starts up...even with the Manual setting still unchanged.

If I right Click the Tray Icon and choose Quit Malwarebytes every thing closes AND does NOT start up on Reboot.

There has been NO Change since I first posted this question on Thursday, December 15th. So none of it is Fixed in the Free version at least.

[jholland1964]

53 minutes ago, exile360 said:

Hi Lisa,

I believe the issue most users are experiencing is due to the fact that 3.0 does not honor the startup setting once the program has been run again.  In other words, if you set it not to start with Windows, but then exit the program and open it again or reboot and then open it again, it sets the service (listed under services.msc and in the services registry key) to 'Automatic' rather than 'Manual' or 'Disabled' which causes the service and tray to still start automatically on boot, even though the 'start with Windows' setting is still set to 'disabled' in 3.0's settings.

Anyone who knows better please feel free to correct me on what I've said, but having heard from users, I do believe this is the problem being experienced.

 

45 minutes ago, Ried said:

I have done this on 2 of my machines, one is Win 7 x64 and the other is Win 10 x64 and I have not had a problem with it honoring that setting.

 

31 minutes ago, exile360 said:

Excellent, this must have been fixed then (thank goodness)

Hopefully it's no longer affecting any other users either.  I guess the only remaining issue is with regards to the user experience of the product not exiting completely when the 'X' button is used in the main window and still having to use the 'Quit' function in the tray's context menu to exit the program when in Free mode.

No, it is Not fixed. Let me try to explain what I meant in my original post;

I am running the Free version. In Settings, Protection the Start Malwarebytes' at Windows Start up turned OFF. In Services MBANService has a MANUAL Startup Type. So I manually open the program and then the MBAMService starts up (showing in Background Processes plus the Tray Icon shows there and in the Apps section of Task Manager mbam.exe shows also.   

Once I have completed my use of the program if I just close it by "X"ing out then the DASHBOARD and mbam.exe close but the MBA-M Tray App AND MBAMService DO continue to run and are easily seen if I  look in the Task Manager. Both can  be turned off by Right Clicking the MBA-M Icon in the System Tray (which appears when program opens but does NOT close when using "X" to close the program).

If I reboot the computer without using the Right Click Quit MBA-M on the Tray Icon then, even though it is still set to Manual, the MBAMService Starts up upon rebooting the computer. There is NO change to Start Malwarebytes' at Windows Start up, it is still set to OFF and the other two files for the program do NOT start, only the MBAMService starts up...even with the Manual setting still unchanged.

If I right Click the Tray Icon and choose Quit Malwarebytes every thing closes AND does NOT start up on Reboot.

There has been NO Change since I first posted this question on Thursday, December 15th. So none of it is Fixed in the Free version at least.

[exile360]

Thanks for the additional information.  I thought that's the behavior you were describing.  I guess Lisa just wasn't able to replicate it on her systems or her test method differed slightly from the process you describe.  Either way, it's definitely something that needs to be fixed so that the 'start with Windows' setting is honored as it should be.

[dcollins]

Thanks for the detailed instructions @jholland1964. I just tested those instructions out on W10 x64 and W7 x64 but was unable to reproduce. It sounds like there may be some other software configuration going on. If possible, can you grab the following information for me please so we can take a look at your configuration?

1. Please download Farbar Recovery Scan Tool from here http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ and save it to your desktop.
   Note: You need to run the version compatible with your system.
   **After you click the Download Now 64-bit, or the Download Now 32-bit, another page will open — DO NOT CLICK ANY ADDITIONAL 'download now' buttons, just wait and look toward the bottom of your browser for the option to Run or Save. Click Save.
2. Double-click to run it. When the tool opens click Yes to the disclaimer.
   Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
3. Click the Scan button.
4. When the scan has finished, it will save 2 logs  in the same directory the tool was run from.  Please attach the following logs:
   Addition.txt
   FRST.txt 

Also, can you please zip up the following file and upload it as well? Thanks!
c:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

[jholland1964]

Sure will do so shortly. Honestly don't understand what is so difficult about Closing the Tray App to close the program. I have no trouble with that at all. I really wondered why using the "X" to close it would cause the MBAMService to start when computer was rebooted even though its Startup Type remains at Manual.

I have three computers, all Dell Laptops, the one I use daily is running Windows 10 Home 64bit. The other two are running Windows 7 Home 64 bit and results are identical for all three. Use Tray Icon to Quit MBA-M and everything stops and doesn't start when computer boots. Use "X" to close program leaves Tray Icon and MBAMService running. Shut down/reboot and only the MBAMService stars up even though its Startup Type remains at Manual.

Back shortly with the logs.

[jholland1964]

Here are the requested files

 

config.zip

FRST.txt

Addition.txt

[dcollins]

Very strange, everything you uploaded says that Malwarebytes should not be running. In fact, the service shows that it is stopped. Did you stop Malwarebytes before running FRST?

[jholland1964]

11 minutes ago, dcollins said:

Very strange, everything you uploaded says that Malwarebytes should not be running. In fact, the service shows that it is stopped. Did you stop Malwarebytes before running FRST?

 

I was not using Malwarebytes' before running FRST. If I was supposed to be doing that then you should have told me to open the program.

I knew that you did not understand my original post and also did not understand my post where I attempted to clarify. This is just ridiculous. I asked why a user cannot fully close the FREE program after using it by clicking the "X" in the upper corner as you can do with most programs and certainly could do with MBA-M v. 2. Hitting that "X" will only close down the visible Program but will NOT close the Tray Icon and will not STOP MBAMService. and if that Service is not stopped then it will boot up when the computer boots up even though the Startup Type says Manual.

I had NOT used the "X" to close the program since I discovered this and reported it here and asked the question. I am using the Tray Icon to close the program by Right Clicking the Icon and choosing Quit Malwarebytes. When a user does that then Every Malwarebytes' file is closed and does not restart until the User opens the program. Why is this so hard to understand???

Edited December 19, 2016 by jholland1964
added sentence

[dcollins]

I do understand what you're saying. The application is designed to stay open when clicking the X button, so I'm not trying to focus on that. What I am trying to focus on is this part:

25 minutes ago, jholland1964 said:

and if that Service is not stopped then it will boot up when the computer boots up even though the Startup Type says Manual.

If the service is set to manual, it should not be running on startup. But just to be clear, let's try to make sure we're both on the same page to reduce any more confusion. If you don't mind, follow these steps and let me know what the status of MBAMService is after rebooting

1. If you don't have FRST from the instructions earlier, please download it again and save it to your desktop
2. Download the attached fixlist.txt file and save it to your desktop
3. Restart your computer
4. After restarting, do not run Malwarebytes
5. Open up FRST and click Fix
6. Once it finishes, upload the fixlog.txt file

fixlist.txt

Edited December 19, 2016 by dcollins
Attached file

[jholland1964]

What attached fixlist.txt file ????

There is no attachment in your post. Why would I have to fix something on my computer when the problem, as I have been told and have seen in other posts here, is a known issue with the MBA-M program.

[dcollins]

Sorry, forgot to attach the file. It's attached in the previous post, and attached to this post as well. My apologies.

These steps aren't designed to fix anything, more to help us understand what the cause of the problem is. Unfortunately this is not something any of our QA teams have been able to replicate, so we're hoping the users are able to help us get the information we need so we can resolve it.

fixlist.txt

[jholland1964]

Here you go. Sorry I was being difficult, just didn't want to "toast" something running just fine for the sake of one program "quirk" that I can work around.

Fixlog.txt

[dcollins]

No problem, I understand that things can be frustrating when they don't work as we expect them too.

Now from what I'm seeing here, MBAMService is not running after you have rebooted the computer. So after you reboot the computer, are running Malwarebytes and then checking the status of the service? Opening the Malwarebytes application will always start the MBAMService, even if it's in manual mode, as the program needs the service to work properly. 

1 hour ago, jholland1964 said:

Use "X" to close program leaves Tray Icon and MBAMService running. Shut down/reboot and only the MBAMService stars up even though its Startup Type remains at Manual.

So after you use the X button to close the program, but the tray and MBAMService are still running, and then you reboot; where are you seeing that MBAMService is starting on it's own?

Edited December 19, 2016 by dcollins

[jholland1964]

I still am certain that you do not really understand what I am saying. Let me try once more. Please remember this is the FREE version. Start MBA-M on Windows Start is turned OFF. MBAMService is Startup Type is set to Manual

1.  I run MBA-M. IF I only use the "x" to close it and do NOTHING else. All that does is close the program interface, nothing else. If you look in the System Tray, you Will see the MBA-M Tray Icon. and if you look in Task Manager you will also see, Tray Icon running and MBAMService running. Then if I shut down the computer. When it reboots fully if I open Task Manager, MBAMService IS Running. If I check in Services, MBAMService Also shows a Running, however it you look at the properties Startup Type still shows as set to Manual but the file shows as running.

2. If I run MBA-M and I Right Click the Tray Icon and choose Quit Malwarebytes, all running files Close. I can check Task Manager and NO Malwarebytes' files are running. All are gone. Shut down, reboot, check Task Manager, NO MBAMService running. Check Services. MBAMService is NOT running and remains set at Startup Type Manual

Would it help you if I add some print screens? I can do those in about 2 minutes.

[dcollins]

Thank you, step 1 is what I was looking for. Specifically this part:

1 minute ago, jholland1964 said:

...When it reboots fully if I open Task Manager, MBAMService IS Running. If I check in Services, MBAMService Also shows a Running

A screen shot would definitely help, because none of the logs you've provided show that MBAMService is running. And my machine doesn't have this issue as you can see in this screenshot