Jump to content

Recommended Posts

The upgrade to Malwarebytes 3.0.5.1299 introduced a bug not present in 2.x, which I labelled "Custom scan".  When you create a "Custom Scan" in "Settings" / "Scan Schedule", "Operation Type" = "Custom Scan", "Schedule Frequency" = "Weekly", "Recurrence" = "1 week", and click "Customize Scan", put checkmarks in "Scan Memory Objects", "Scan Startup and Registry Settings", "Scan within archives", and "Scan for Rootkits", then select one or more drives (e.g., put checkmarks on drive "C:" and "D:"), and click "OK" and "OK" to save the settings; the program promptly forgets the selected drives.  You can observe this behavior two ways:  1) just go back into the settings and you will notice the checkmarks missing from the drives that you had just put there moments before, and 2) wait for the scheduled scan to execute - no files will be scanned, and you may not even get a scan report.  Some computers get a report showing 0 files scanned, others do not even get a scan report as if the scan never happened, however on all computers the dashboard shows the last scan as having happened when it should have, even if there is no scan report present on that computer.

O/S:  Windows 10 Professional, all updates and patches.

Reproducible:  Yes.

Link to post
Share on other sites
  • 2 weeks later...

I have done that many many times on at least 10 different computers suffering from this critical malady, as well as the ultra-critical "forgetting the configuration" malady which is often followed by the "false notification of new version" malady which causes an infinite loop of reinstalling the same 3.0.5.1299 version of the software that almost immediately informs you that "there is a new version" again, and the ultra-critical "forgetting your license" malady that occasionally occurs.  Technical details on Operating systems in use, Anti-Malware versions involved, and Clean versions used:

Operating systems in use were Windows XP-32 Professional, 7-64 Ultimate, 10-64 Professional.

The Anti-Malware versions in question were 3.0.4.1269 2016/12/08 and the newer 3.0.5.1299 2016/12/19.

The Clean removers used were 2.1.1.1001 2014/07/03 and eventually the newer 2.3.0.1001 2016/07/07 when it was made available in December.

I am very much looking forward to the results today as I attempt to fix 5 computers (1 Windows XP-32 Professional and 4 Windows 10-64 Professional) using the just released Anti-Malware 3.0.6.1469 2017/01/25 version and the still current Clean 2.3.0.1001 2016/07/07 version.  I wish there was a specific Clean for 3.x versions that deletes the "C:\Program Files\MalwareBytes" directory structure and its contents so that I don't have to manually follow-up and perform that function before allowing the Clean program to reboot the computer, as well as cleaning up any other 3.x version specific items that I do not know about.

Link to post
Share on other sites
  • Root Admin

I'll have QC look at this as I'm not able to duplicate it myself. My scans continue to scan as scheduled. The removal of 3.x does remove all except 1 dll file. We have tested this on quite a few computers and all of them remove the structure. If it's not being removed for you then perhaps some other security software is blocking. I'll go ahead though and report to QC and see what they can find for you.

Thank you

Ron

 

Link to post
Share on other sites
  • 3 weeks later...

Once you start using "Custom Scan", you will find the problem escalates:  The checkbox for "Scan for Rootkits" will stay checked if you have the latest 3.0.6 clean installed, but the drive selections will not stay checked (Click "Edit", click "Customize Scan", check the desired drives, click "OK" on "Customize Scan", click "OK" on "Edit Scheduled Scan", then go right back into "Edit" and "Customize Scan" and you will find the drives that you had just checked are not checked).  This is not just a visual bug, the custom scan will not actually scan the files, and usually will not place a scan report in your history.  This happens on all computers I am responsible for that have version 3.x installed.  The original topic on this is "Custom Scan Forgets Drive Selection" started by me on January 11.  The problem still exists today and is the reason I have not upgraded any more of the hundreds of client computers I am responsible for from 2.x to 3.x.  I just setup a brand new client computer a few days ago (i.e., totally clean brand new install of everything) using 3.0.6 and the bug is present on that computer as well.  The weekend full in-depth custom scan shows having run on the dashboard, but there is no report and no indication that any files on the drive were actually scanned.

Link to post
Share on other sites

One or more of the protections often are switched off when a computer is booted and can get switched off if the computer is left idle for a long period of time.  This seems to be an annoying "feature" of version 3.x including the latest 3.0.6.  The only workaround I have found is to make sure the icon is always visible in the system tray (bottom-right), educate your users to vigilantly watch to make sure there are no triangles in that icon, to not do anything on the internet or e-mail while a triangle is present, to always click "Fix Now" on the placard when it comes up, then reboot if the triangle doesn't go away in about 5 minutes after clicking the "Fix Now" button or if they missed the placard.  If you can teach them how to check the settings for protection, that will provide the possibility to clicking the sliders if they missed the placard, but usually the sliders will get stuck "enabling", which you should wait about 5 minutes to see if it will enable without rebooting, and reboot if they are still stuck.  It can take as many as 3 or 4 reboots with "Fix Now" and/or changing sliders before everything gets fixed, especially if you have received Microsoft updates (manually or automatically).

Also, at all times it is advisable during computer bootup to not enter your login password into Windows until the initial flurries of drive activity settle down (this is drivers and other infrastructure stuff loading in the background), which gives you a much more stable run of Windows with all intended background programs running.  On most computers there are two or three flurries of intense drive activity with a brief pause between them, solid state drive computers take 30 to 60 seconds normally to settle down, old style rotational 5400rpm hard drives can be as much as an intolerable 5 minutes.  The value of this advice is true for all Windows versions XP through 10, prior to XP there was an administrator setting that could be set to cause Windows not to present the login box until this condition was achieved.  Pressure from Apple caused Microsoft to change this and to rush to show the desktop or login options before the computer is fully ready, which would work if Windows reliably loaded everything in the background, but "reliably" is sadly not the case.  If you have ever noticed that not all of your icons showed up on the right, this is evidence of the problem and a warning.

Link to post
Share on other sites
On 1/26/2017 at 3:39 PM, DeGraff said:

I am very much looking forward to the results today as I attempt to fix 5 computers (1 Windows XP-32 Professional and 4 Windows 10-64 Professional) using the just released Anti-Malware 3.0.6.1469 2017/01/25 version and the still current Clean 2.3.0.1001 2016/07/07 version.

BTW, no joy with 3.0.6.1469 2017/01/25 - All computers with this version of MBAM still suffer from this bug, including a brand new client computer that I unboxed and set up last week.  As this constitutes a total clean install in every way, it really speaks to the pervasiveness and repeatable nature of this issue.  Please fix this issue and the issue of one or more realtime protections occasionally being off at boot time soon!  Until these items are fixed, IT and users cannot trust MBAM to always have them protected.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.