Malwarebytes mb3-setup-consumer-3.0.6.1469 CU3 BETA and Registry Backup

[TempLost]

I wrote in another post

that using Malwarebytes 3.0.6.1469-beta-component-package-version-1069 that the size of the SVI folder reduced after I ran Casper 10 Backup.

BUT I have just done carried out a registry backup with Tweaking.com's Registry Backup (which makes use of VSS shadow copy) and noticed that the size of my SVI folder has increased from 32,451 MB before the backup to 32,899 MB afterwards.

[TempLost]

Just carried out another registry backup with RegistryBackup 3.5.3 from within Tweaking.com's Windows Repair 3.9.25 Pro, again using the Volume Shadow Copy service (which I always use rather than the fallback Windows API) and the SVI folder has again increased in size from 32,899 MB to 33,536 MB.

[TempLost]

That's really weird - rebooted, and the SVI folder has dropped back to 32,899 MB..................

[TempLost]

OK, so in the interest of clarity

Did a clean reinstall of Malwarebytes 3.0.6.1469-beta-component-package-version-1069

1. Deleted all Restore Points
2. SVI folder reduced to 35 MB
3. Reenabled and created New System Restore Point
4. SVI Folder 2,276 MB
5. Rebooted
6. Backed up with Casper 10
7. SVI Folder 2,410 MB after Backup with Casper 10
8. Rebooted
9. SVI Folder still 2,410 MB
10. Run Tweaking.com's Registry Backup
11. SVI Folder 2,613 MB
12. Rebooted
13. SVI Folder still 2,613 MB

So I don't think that the SVI folder problem has been fixed, sadly............

Windows 7 SP1 x64

Security:-
Malwarebytes 3.0.6.1469 CU3 Premium
Avast AV Free 17.1.2286
CryptoPrevent 8.0 Premium
Casper 10 Backup
Tweaking.com Registry Backup 3.5.3

[Telos]

@TempLost Did you look at your list of restore points after all that? I'm wondering if Casper and Tweaking,com create restore points as part of their routine.

[TempLost]

52 minutes ago, Telos said:

@TempLost Did you look at your list of restore points after all that? I'm wondering if Casper and Tweaking,com create restore points as part of their routine.

Neither of those programs create restore points as part of their routines.

[Telos]

Hmmmm... I wondering if the "fix" only affected Macrium Reflect... 

[TempLost]

I did touch on this before, asking if Casper would be affected, and the response I got from Malwarebytes indicated that any program that used Volume Shadow Copy would / could be affected by "the bug" - so I guess they are aware that any issue that affected Macrium Reflect could also affect any of the plethora of other programs using the same techniques. We can but wait for a response from the backroom boys and girls.

[siliconman01]

TempLost,

I am running Windows 10x64 Pro Build 14393.693 as well as Insider Build 15031 with Malwarebytes 3.0.6.1469, Components 1.0.69  and with Casper 10.0.6114.  I do not experience any SVI size increases when running Casper 10 on any of my systems.  Nor did I experience it with earlier versions of Malwarebytes when it comes to Casper backups. 

When you run your Casper 10 backup, do you get CAPI2 errors logged in your Event Viewer?  If so that could be what is causing your SVI size to jump.  This CAPI2 bug has been around since Windows 7.  A solution that works on Windows 10 is provided at https://answers.microsoft.com/en-us/windows/forum/windows8_1-update/event-513-errors-when-setting-a-restore-point-or/0ac566b0-b16b-4e6f-9344-27800151e21d   

 

[davei1]

Acronis True Image also uses VSS...

[TempLost]

1 hour ago, siliconman01 said:

TempLost,

I am running Windows 10x64 Pro Build 14393.693 as well as Insider Build 15031 with Malwarebytes 3.0.6.1469, Components 1.0.69  and with Casper 10.0.6114.  I do not experience any SVI size increases when running Casper 10 on any of my systems.  Nor did I experience it with earlier versions of Malwarebytes when it comes to Casper backups. 

When you run your Casper 10 backup, do you get CAPI2 errors logged in your Event Viewer?  If so that could be what is causing your SVI size to jump.  This CAPI2 bug has been around since Windows 7.  A solution that works on Windows 10 is provided at https://answers.microsoft.com/en-us/windows/forum/windows8_1-update/event-513-errors-when-setting-a-restore-point-or/0ac566b0-b16b-4e6f-9344-27800151e21d   

 

Thanks for that info, siliconman01, that's interesting - I don't think I get any such errors reported but I'll take a look tomorrow when I've got the laptop fired up again and post back.

[TempLost]

siliconman01

I did a search of the Event Log and could find no CAPI2 errors.

Strange to report,- Tweaking/com's RegistryBackup does a full backup at the first logon of the day and and I checked the SVI folder subsequently this morning and it had reduced in size by 1 MB to 2,612 MB. I manually created another registry backup and the size of the SVI folder was unchanged at 2612 MB.

So, I have no idea what has changed between yesterday and today. All backups report they were successfully created using VSS and are of the expected size. Yesterday's registry backup increased the size of the SVI folder, today's didn't. I'll monitor the situation during my next Casper backup operation and re-post then.

Thanks for your interest.