MBAM and Norton's NIS 2009 Not Compatible ?

[lmacri]

I purchased a full licence for MBAM 1.38 on July 10/09 and shortly after I enabled the MBAM real-time protection my PC began crashing when my system was idle (i.e., all tasks closed and PC left for 30 minutes or so). On two occasions that this problem occurred I noticed a pop-up message in the system tray that Norton Internet Security (NIS) 2009 was running a background idle scan. Full scans with both NIS 2009 and MBAM were clean. The only two changes that I made to my PC before this problem started were:

1) An update of the Intel Matrix Storage Manaager from v. 8.0.0.1039 to 8.7.0.1007 A (HP update sp43871.exe)

2) Enabling of real-time protection in Malwarebytes' Anti-Malware (MBAM) v 1.38 (automatic quick scan disabled)

Based on advice I received in the NIS 2009 users forum, I disabled the real-time protection of other anti-malware programs I had on my PC (i..e., MBAM and Lavasoft Ad-Aware AE) and that seems to have solved the problem.

Has anyone else running both NIS 2009 and a licenced version of MBAM had a problem with their PC freezing when their system is idle? After searching the NIS 2009 users forum I'm beginning to think that this problem is not unique to MBAM and could occur with any anti-malware program that has real-time protection and is running at the same time as NIS 2009.

Here's the pertinent information about my current system:

- HP dv6835ca Pavilion notebook PC (3 GB RAM, Intel 1.83 GHz Core Duo T5550 processor, 2 MB L2 cache)

- Microsoft Windows Vista Home Premium v. 6.0.6002 SP2 (32-bit)

- NIS 2009 v. 16.5.0.135

- Norton SystemWorks Basic 2009 v. 12.0.1 (not loaded at startup)

- MBAM v. 1.39 (no longer loaded at startup, automatic updates and quick scans disabled)

- Microsoft Windows Defender always disabled by NIS 2009 at startup (which annoys me to no end)

[GT500]

Did you have real-time protection enabled in Ad-Aware?

[lmacri]

Hi Forum Deity:

I installed the free version of Ad-Aware Anniversary Edition v. 8.0.7 back in May 2009 and Add-Watch Live! realtime protection (for processes only) was enabled. NIS 2009 and Ad-Aware AE ran together for three months with no apparent problems.

Ad-Watch AE and MBAM were never running on my system at the same time - I disabled realtime protection in Ad-Aware AE before I activated the realtime protection in MBAM, so MBAM and NIS 2009 were the only two anti-malware programs running on my PC when my system became unstable. I even disabled automatic scanning in Windows Defender after activating realtime protection in MBAM, but that was likely unnecessary since NIS 2009 v. 16.5.0.135 automatically turns off Windows Defender at startup anyway.

[GT500]

OK, here's the best course of action. Add the following files to your exclusions list in NIS so that it ignores them:

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

[lmacri]

Foreign Deity:

NIS 2009 appears to have 3 separate options for exclusions:

1. Scan Exclusions (under the Scan Exclusions section - the \System Volume Information\ is listed by default)
   
2. Auto-Protect Exclusions (under the Scan Exclusions section)
   
3. Security Risks Excluded from Scans (under the Signature Exclusions section)
   

Do I need to add these exclusions to all three sections? I saw this solution posted in the "Fixes For Commmon Problems" in the Important Posts section of the forum, but I wasn't quite sure where to add them.

When I posted this problem on the NIS 2009 forum (http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=62806), I was told that "When you run a scan, anything else monitoring in real-time will watch the scanning program as it accesses files. At best, this will cause an increase in the time needed to complete a scan. At worst, you'll get an application crash as the programs fight each other, using up system resources as they do so." If this assumption is correct (and and it seems logical given the large amount of memory that the NIS 2009 background scans are using on my system), I'm not sure that excluding these 3 MBAM executable files from NIS 2009 scans will solve the problem.

I'm sorry if I'm getting ahead of myself here, but if I turn my MBAM realtime protection back on and my system crashes again, I'm worried that I might end up corrupting my OS or drivers.

[GT500]

Try adding them to all three sections, just in case.

Our protection module doesn't scan access to each file like an anti-virus does. It checks each application as it launches to ensure that it is not malware, but it does not scan every file access.

[lmacri]

Try adding them to all three sections, just in case.

Hi GT500:

I've now added the following three files to my NIS 2009 Scan Exclusions (i.e. from both risk scanning and auto-protect scanning):

- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

I wasn't able to add them to the Signature Exclusions section. It appears that Signature Exclusions is only used to select specific known risks by name (e.g., Adaware.DollarRevenue, Dialer.Pornosex, Spyware.Keylogger, etc.) in the event that another program on your computer relies on a security risk program to function. In order to exclude a signature from scans it has to appear on a drop-down list of known risks that NIS 2009 is currently blocking.

I've re-enabled the real-time protection in MBAM, but even if this solves the problem of my PC freezing during a system idle, what happens if I'm actually infected with malware at some point in the future? Aren't NIS and MBAM going to try to simultaneously remove the malware and compete for system resources if both programs have real-time protection enabled?

[GT500]

I've re-enabled the real-time protection in MBAM, but even if this solves the problem of my PC freezing during a system idle, what happens if I'm actually infected with malware at some point in the future? Aren't NIS and MBAM going to try to simultaneously remove the malware and compete for system resources if both programs have real-time protection enabled?

If it's something that Norton is capable of detecting and stopping, then I would believe that MBAM will usually take second place to your anti-virus (this could have changed when the new protection module was released in version 1.37, but if it did then no one bothered telling me). If it is not something that your anti-virus will take care of, then MBAM will pop up it's notification, and let you chose how to deal with it.