MBAE 1.10.1.24 Startup on Win XP 32bit SP3

[scut1]

I have a doubt about MBAE 1.10.1.24 startup on my XP SP3 machine. I recently had to downgrade to v24 from v41 after v41 proved not supported on XP machines.

Since this downgrade, I noticed that the MBAE icon does not show on the system tray although the program it's set to launch on boot. Puzzled, I reviewed the active services via Process Explorer and I noticed that the only active MBAE service is mbae-svc.exe, not the main mbae.exe. If I launch MBAE, then the icon appears on my sytem tray and mbae.exe starts. When reviewing the logs on MBAE UI, I also saw that all programs appeared to have been protected, although mbae.exe was not actually started.

It looks like mbae-svc works on the background, without the need to launch mbae.exe and without showing an icon on the system tray. In this case, mbae.exe acts as a pure UI, with no active protection role. If what I am saying is correct, I should not be worried, but I would like to have a confirmation by others.

Have anyone else noticed the same thing? Do you agree with my conclusions?

[humanoid45]

"I should not be worried, but I would like to have a confirmation by others.

Have anyone else noticed the same thing? Do you agree with my conclusions? "

I definitely would not agree with your assessment,IMHO something is not right..If you have MBAE checked to run at startup,the icon should be there in your tray and when you open it,it should say "RUNNING"...also MBAE,exe should be in your Task Mgr under processes....

I would be very worried if those things are not happening ....

Hope you get some help from the mods soon!!

[Rsullinger]

Hey Scut1,

That does not sound right. While there is way to hide the GUI, mbae.exe should still be running. Do you mind collecting the logs from here so I can confirm there is no issue with the downgrade:

 

 

[scut1]

Here you go

Malwarebytes Anti-Exploit.zip

[Rsullinger]

Hey Scut1,

 

Thank you for the logs. It does look like it is hooking a bit abnormally. To be on the safe side, can you run the clean tool found here:

 

https://forums.malwarebytes.org/applications/core/interface/file/attachment.php?id=199258

 

and then re-install using this link:

 

https://malwarebytes.box.com/s/xhbp0e8xyj4iom093gdtwyervxva0zxh

 

That should resolve the issues I am seeing. 

[scut1]

Hi Rsullinger

I followed your recommendation and it appears everything is now back to order. The MBAE icon is showing on the system tray and both mbae.exe and mbae-svc.exe are now running. Thanks for your help.

As a side note, pls remember to instruct folks trying to install a lower version (eg v24) that the MBAE installer has the option "automatically upgrade to new versions"  enabled by default. This means that if you download the installer for v24 and try to install the program, before you actually manage to reach the GUI and uncheck the "automatically upgrade to new versions" box, the program has already updated itself to v41. For the majority of people this is not an issue, but for people like me (XP user), this is a problem.

The only workaround is to download the installer, shut your internet connection, install the program offline, uncheck the "automatically upgrade to new versions" option, restart your internet connection. This way it won't upgrade to a new version unless you check the box again.

Hope it helps.

[scut1]

Hi Rsullinger,

An update on this issue. This morning we are back to square one.

On system startup, MBAE.exe didn't start, the only active service is mbae-svc.exe, yet the logs show that my programs are being protected anyway.

Something i didn't notice until today is that If I manually launch mbae and then I click on "hide icon" on the mbae icon on my system tray, then mbae.exe gets killed.

I will stick to mbae in its current form (only mbae-svc.exe active) until I get further advice/ input from you guys.

Thanks for your help.

[Arthi]

Hi scut1,

We have fixed some issues with MBAE when used on Windows XP. Can you please try the below version and let us know if it resolves your issue. Thanks.

https://malwarebytes.box.com/s/gkt3nq7e9luvtyx3nm8hw8vlnu7agl71

[scut1]

Thanks Arthi.

I upgraded to v45 and the issue persists, ie - MBAE.exe doesn't start neither at boot nor at the launch of a program it was supposed to protect. The only active service is mbae-svc.exe, yet the logs show that my programs are being protected anyway.

I have worked around it by putting a shortcut to mbae.exe into the startup folder, thus forcing a launch at boot.

Thanks for your help.

[Arthi]

Hi scut1,

Sorry to hear that your issue is not resolved with v45. I am going to need fresh logs to analyze further. Can you please follow the instructions below. Let us know if you need any help in getting these. Thank you.

1. ZIP the entire contents (ALL the files, not just .LOG) of the MBAE user data directory and attach them to your post. The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it. If you are replying to someone else's post, you can click the "More reply options" button at the end of the page to get the file attachment options. You can find the logs in the following locations:
   1. Windows XP: C:\Documents and Settings\All Users\Application Data\Malwarebytes Anti-Exploit
2. ZIP the entire contents of the folder  C:\Program Files\Malwarebytes Anti-Exploit 
3. Detailed system information. To facilitate replicating the problem consider downloading and running FRST and attaching its logs to your post as well. 

[scut1]

Thanks for coming back to me Arthi.

Logs from MBAE user data as well as from FRST attached.

Look forward to knowing what's wrong with my PC.

Malwarebytes Anti-Exploit.zip

Addition.txt

FRST.txt

[Arthi]

Hi scut1,

Thanks for the logs. You missed sending us the below

1. ZIP the entire contents of the folder  C:\Program Files\Malwarebytes Anti-Exploit 

[scut1]

Apologies - here it goes

Malwarebytes Anti-Exploit.zip

[Arthi]

Hi scut1,

When the service is installed, it creates an entry in the registry at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Whenever the installer tries to add this entry in your computer, it gets an access denied error so it cannot add this entry and mbae.exe won’t be launched at startup. You should change the permissions of this registry key to give “Full Control” to Administrators group (see the screenshot).

Go to registry Editor -> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> RIght click on the Run folder-> Permissions-> and change the permissions according to the screenshot.

Then reinstall the product. Let us know if that resolved your issue. Thanks.

[scut1]

Hi Arthi

thanks for the information.

I have tried following your reco, but the registry key is already set at the value requested.

Screenshot of the current situation attached.

Pls let me know.

Thx