Avg found someing in MWB - is this file ok

[Clang]

Was doing a scan with MWB when this popped up.

Did the protect me and rebooted. 

[exile360]

I don't recognize that file name at all.  It appears to be a GUID.  Do you have self-protection enabled in Malwarebytes?

[Clang]

yes I do. But early self start is not on.

Edited October 24, 2017 by Clang

[exile360]

OK, let me get a member of our Research team here to take a look.  I don't believe the file is a threat, however I'd rather be certain.

[exile360]

OK, I've got some info for you and it's good news.  That file is a temporary backup copy of the NTUSER.DAT file (a registry hive/file, basically) which is created when Malwarebytes runs a scan as part of our scan process.  Once the scan is completed, the file should get cleaned up/removed by Malwarebytes automatically.

So the good news is, it's not a threat/infection; the bad news is, it looks like AVG had a false positive.

If there's anything else we can help with please let us know.

Thanks  

[Clang]

ok thanks for the info.

[exile360]

I have returned with more news and a correction.  It turns out that file isn't actually a registry backup as I thought it was, however it is something created by our scanner.  It's a copy of an unknown file that our cloud component is analyzing to determine whether or not it is malicious, so it could actually be a threat but that is not guaranteed.  That said, it can't do any harm as it is just a dormant copy of a file that exists elsewhere on your system so it won't be able to infect you even if it is malicious.

[Clang]

It did it again! and now avg software protecting is off

 

Help me please! 

[shadowwar]

What happens if you run a full scan with AVG.

This file should exist somewhere else on your system and not just our directory.

 

[Clang]

ok this is what I had to do....had avg remote in and remove and reinstall avg.. they had to remove MWB because in conflicted avg from working and they suggested I don't reload mwb because it conflicted with it ...

 

I scanned with avg again and it found nothing.

Edited October 25, 2017 by Clang

[shadowwar]

They do work fine together. In your case all you would have to set is an exclusion on avg for the mbamservice folder.

 

[Clang]

When AVG first got set up it saw that Malwarebytes was installed and was in passive mode because it detected another software program was on there(mwb)  so if I install Malwarebytes AVG won't go back to the passive mode?

[Clang]

ok I reinstalled mwb and added a exception to avg... strange..... I never had to do this before....

Edited October 25, 2017 by Clang

[Ried]

Hello Clang,

To keep AVG from going into Passive mode, install Malwarebytes then open Malwarebytes and click Settings > Application tab

Look for Windows Action Center and place a check next to 'Never register Malwarebytes..'

This in no way affects the protection our product provides, it simply does not register it as an installed 'AV' in Windows.

[Clang]

done. thanks.

do I still need to do the avg  file exception ?

[Ried]

Yes, please do.   :-)

 

 

[Clang]

3 minutes ago, Ried said:

Yes, please do.   :-)

 

 

I did all the folders ....should I only do certain ones?

[Ried]

It's really not necessary to list out all the sub-folders.  When you add the 'top folder' it then includes all the sub folders as well.

For example, adding the MBAMService folder will automatically then exclude all those other folders within it. (All those that you see when you clicked the + to expand that MBAMService folder.)

By the same token, if you went up one level to the Malwarebytes folder, that would then include the MBAMService folder and all those other folders under that.

 

[Clang]

1 minute ago, Ried said:

It's really not necessary to list out all the sub-folders.  When you add the 'top folder' it then includes all the sub folders as well.

For example, adding the MBAMService folder will automatically then exclude all those other folders within it. (All those that you see when you clicked the + to expand that MBAMService folder.)

By the same token, if you went up one level to the Malwarebytes folder, that would then include the MBAMService folder and all those other folders under that.

 

C:\ProgramData\Malwarebytes\MBAMService\*    

 

This is what avg shows... I assume this is ok ?

[Ried]

That's perfect, Clang.

[Clang]

Rebooted pc and MWB is not starting up

started manually and this is happing.

[Ried]

AVG remoted in and removed our software, right?  Try using our mb-clean. You can find the download link and instructions here:

https://forums.malwarebytes.com/topic/196955-malwarebytes-support-tools/?do=findComment&comment=1116748

Let me know how that works out for you.

 

[Clang]

did this and reinstalled doing a scan with mwb and will reboot and see how it does.

 

 

[Clang]

After doing the clean install I did the reboot and all is acting well. Thank you.

1 hour ago, Ried said:

Windows Action Center and place a check next to 'Never register Malwarebytes..'

Made sure this was done on MWB 

 

2 hours ago, shadowwar said:

They do work fine together. In your case all you would have to set is an exclusion on avg for the mbamservice folder.

 

And double checked I added this exclusion to avg.

Doing a mwb scan (with rootkits) - and hopfuly all will go well.

[Ried]

Glad to hear it thus far.  Let us know how the scan goes.