Real Time Protection pop up

[tno3838]

I wanted to report that even though my dashboard says all my protection layers on, at startup I received the pop up that they were off. Just happened for first time since I downloaded CU4.

 I have this version:

Malwarebytes version: 3.0.6.1469

Component package version: 1.0.96

Update Package version: 1.0.1640

 

Is there another update or something?

[Maurice Naggar]

Did the pc just come out of Windows sleep mode?

and what 3rd-party antivirus / security apps are there on this Windows system?

Please provide this diagnostic report.   It will collect some information on the installation of Malwarebytes and create a report I need to review: 
Please close all open work programs and save your work.  Let's please have all open user programs closed so that you see a cleared up view to the Desktop.

Download mbam-check.exe and save it to your desktop    "from this link"
On Vista/Windows 7, 8, 10, Right-click on *mbam-check-.exe* & select Run as Administrator & allow to Run when prompted by User Account Control.

Reply YES when prompted to allow it to proceed.
Do have patience while the tool runs.  The tool runs super fast, and will flash a command prompt window.  
After a minute or so, or if you do not see any movement, please look on the Desktop for the file.

It should then create a log file mb-CheckResult.txt on the DESKTOP
You should attach the *mb-CheckResult.txt* file located on _*your desktop*_ so that I can review.

 

Cheers,

[tno3838]

Thank you. My computer was off overnight, this was the first startup of the day. I have Norton also installed on my computer.

 

MB-CheckResult.txt

[Maurice Naggar]

Norton  must be configured to add specific Malwarebytes files to its exclusions lists to be sure the application does not scan Malwarebytes which can slow performance and can cause Malwarebytes performance issues.  After that has been done, you should add the Norton  installation folder to your Malwarebytes "Malware Exclusions" List.  
 
Please follow these steps:
 
How to exclude specific Malwarebytes   files in Norton/Symantec 
Step 1. Start your Norton Internet Security  application.
 
Step 2. Select "Settings" tab.
 
Step 3. Click on "Antivirus".
 
Step 4. In the Settings > Antivirus  configuration window, click on the "Scans and Risks" tab, then scroll to the bottom of that window.
 
Step 5. In the section "Exclusions / Low Risks", locate the line item titled "Items to Exclude from Auto-Protect, SONAR and Download Intelligence Detection" then click on "Configure" to the far right of that line item.
 
Step 6. In the resulting "Scan Exclusions" window, click the "Add" button at the bottom of the screen.
 
Step 7. Select "Files" from the pull down menu to show the "Add Item" selection box.
 
Step 8. Click on the small folder to the right of the Add Item field to display the Browse window.
 
Step 9. Navigate to the file path shown above for the Windows OS you have installed.
That path will be "C:\Program Files\Malwarebytes\Anti-Malware\"  
 
Step 10 Click on "mbam.exe" and then click the "OK" button.
 
Step 11. The "Add Item" selection box will show the full path to the file you have selected. 

These are the other Malwarebytes Premium files that need to be added to the Norton  exclusions list:
 
C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
 
Step 12. Click OK.
 
Step 13. You should now see the "Real Time Exclusions" window with the path to the that file in the list.
 
Step 14. Follow steps 6-13 for the four remaining files that need to be added to "Real Time Exclusions" list.
 
Step 15. When all of the five files are listed in the "Real Time Exclusions" list, click the "OK" button.
 
Step 16. On the Settings window, click "Close".
 
Step 17. On the Norton  main screen, click on the "X" in the upper right corner to close the Norton  application.
 
You will also need to follow these short steps to add Norton  installation folder to the Malwarebytes "Malware Exclusions" List.
 

How to add your Norton  application folder to Malwarebytes "Exclusions" list
 
Start Malwarebytes
Click on the Settings tab in the left pane.
Click on the Exclusions tab.

Clicking the Add Exclusion button allows an exclusion to be added to a list of items which will be excluded from scanning.  Each item type is defined by criteria as follows:

Select Folder button to add a folder.  ( select the first line marked Exclude a file or folder)and click the button NEXT
You want to have the Norton program folder excluded
(typically, it is something like   C:\Program Files (x86)\Norton Security Suite)

Under How to Exclude, choose Exclude from malware protection only  
When done, press the OK button to complete the task.

Be sure to use the Windows Start menu and do a Restart, when all done.
 

[tno3838]

 I added the exclusions and have not seen the pop up reappear.

Thank you for your help.

[Maurice Naggar]

You are welcome.

[Pdalton]

On 4/1/2017 at 11:19 AM, Maurice Naggar said:

Step 14. Follow steps 6-13 for the four remaining files that need to be added to "Real Time Exclusions" list.
 
Step 15. When all of the five files are listed in the "Real Time Exclusions" list, click the "OK" button. 

I believe these two Steps should have referenced FIVE and SIX files, respectively, (rather than four and five), because your Step 10 previously had instructed to add "mbam.exe" to the Norton exclusion list before (in Step 11) you created the list of five additional files to add to the exclusion list.  

Other than that tiny point, this is an excellent and easy to follow set of instructions for configuring Norton AV to stop messing with Malwarebytes!  

Nevertheless, I have a couple of questions about this:  

(As "notice" to others:)  When I originally was doing this myself, I was surprised (and a bit irritated) to learn that Norton wouldn't allow me to do this in one step (e.g., select multiple files in the same subdirectory so they all would be added to the exclusion list in a single pass).  So, instead, I ALMOST added just the malwarebytes subdirectory folder to the Norton Exclusion list, instead.  However, I changed my mind out of fear that some 'evil actor' might anticipate a user taking this 'easier approach' and use it to cause something harmful to be placed into that subdirectory.  So, I decided to add all SIX of the files you listed, one by one.  (Another irritant I noticed in doing this was being required to chase down the directory tree each time to get to the file to be added; Norton doesn't 'return' to the previous subdirectory after adding a file.  So, for the last 2-3 of the files, I just copied the full path and filename (Ctrl-C") from your list, then pasted (Ctrl-V) it into the Norton window, one by one.  That was definitely faster).

Anyway, when I finished doing that, I noticed there was just one .exe file* remaining in the malwarebytes subfolder:   "malwarebytes_assistant.exe".   I checked its properties and, because it appears to have the same file size, date and digital certificate as "assistant.exe", I "excluded" it, as well.  

My questions about all this are:   

1.  Should I have added "malwarebytes_assistant.exe" to Norton's Exclusion list?  Should I not have done so?

2.  How is "malwarebytes_assistant.exe" different from "assistant.exe"?

(* Other than "unins000.exe", which I assume is an uninstall file.)

Thanks, Paul

Edited September 5, 2017 by Pdalton
Accidental double entry.

[dcollins]

This post is old, which is why malwarebytes_assistant.exe isn't called out, it didn't exist then

Yes it should be added. malwarebytes_assistant handles a few different functions than assistant.exe, and uses different permission methods. 

[Pdalton]

BTW, I checked the Norton Firewall settings, as well, (from the Norton Security screen, click on the 'Settings' tab, then click on 'Firewall', then click on the 'Program Controls' tab).  

The only files listed from the C:\Program Files\Malwarebytes\Anti-Malware subdirectory were 'mbamservice.exe' and 'assistant.exe'.  So I added the other five Malwarebytes .exe files, as well.   

I don't know whether it was necessary to add all seven of these Malwarebyte files to the "Trusted" list, but I assume it can't hurt.

Paul 

[Porthos]

Current list

• C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
• C:\Windows\system32\Drivers\farflt.sys
• C:\Windows\System32\drivers\mbae64.sys
• C:\Windows\System32\drivers\mbam.sys
• C:\Windows\System32\drivers\MBAMChameleon.sys
• C:\Windows\System32\drivers\MBAMSwissArmy.sys
• C:\Windows\System32\drivers\mwac.sys

 

Also please exclude the following folders too: (The complete folder)

• C:\Program Files\Malwarebytes\Anti-Malware
• C:\ProgramData\Malwarebytes\MBAMService

     

[Pdalton]

GREAT!  Thanks!  I've added them all.  

Two questions though:

1.  Is there not a risk of something "bad" getting installed into one of those folders and then being overlooked because of that?  

2.  If all those specific files from C:\Program Files\Malwarebytes\Anti-Malware are separately listed, as well, why also list that subfolder itself &/or if the subfolder itself is listed, why also list specific files from it, as well?

Paul

[Porthos]

3 minutes ago, Pdalton said:

1.  Is there not a risk of something "bad" getting installed into one of those folders and then being overlooked because of that?  

Rare. Personally never seen it happen.

 

4 minutes ago, Pdalton said:

2.  If all those specific files from C:\Program Files\Malwarebytes\Anti-Malware are separately listed, as well, why also list that subfolder itself &/or if the subfolder itself is listed, why also list specific files from it, as well?

Some programs recursively add the files in the folders some don't. I don't take the chance.  

[Pdalton]

THANKS!