Jump to content
scut1

MBAE 1.10.1.24 Startup on Win XP 32bit SP3

Recommended Posts

I have a doubt about MBAE 1.10.1.24 startup on my XP SP3 machine. I recently had to downgrade to v24 from v41 after v41 proved not supported on XP machines.

Since this downgrade, I noticed that the MBAE icon does not show on the system tray although the program it's set to launch on boot. Puzzled, I reviewed the active services via Process Explorer and I noticed that the only active MBAE service is mbae-svc.exe, not the main mbae.exe. If I launch MBAE, then the icon appears on my sytem tray and mbae.exe starts. When reviewing the logs on MBAE UI, I also saw that all programs appeared to have been protected, although mbae.exe was not actually started.

It looks like mbae-svc works on the background, without the need to launch mbae.exe and without showing an icon on the system tray. In this case, mbae.exe acts as a pure UI, with no active protection role. If what I am saying is correct, I should not be worried, but I would like to have a confirmation by others.

Have anyone else noticed the same thing? Do you agree with my conclusions?

Share this post


Link to post
Share on other sites

"I should not be worried, but I would like to have a confirmation by others.

Have anyone else noticed the same thing? Do you agree with my conclusions? "

I definitely would not agree with your assessment,IMHO something is not right..If you have MBAE checked to run at startup,the icon should be there in your tray and when you open it,it should say "RUNNING"...also MBAE,exe should be in your Task Mgr under processes....

I would be very worried if those things are not happening ....

Hope you get some help from the mods soon!!

Share this post


Link to post
Share on other sites

Hey Scut1,

That does not sound right. While there is way to hide the GUI, mbae.exe should still be running. Do you mind collecting the logs from here so I can confirm there is no issue with the downgrade:

 

 

Share this post


Link to post
Share on other sites

Hey Scut1,

 

Thank you for the logs. It does look like it is hooking a bit abnormally. To be on the safe side, can you run the clean tool found here:

 

https://forums.malwarebytes.org/applications/core/interface/file/attachment.php?id=199258

 

and then re-install using this link:

 

https://malwarebytes.box.com/s/xhbp0e8xyj4iom093gdtwyervxva0zxh

 

That should resolve the issues I am seeing. 

Share this post


Link to post
Share on other sites

Hi Rsullinger

I followed your recommendation and it appears everything is now back to order. The MBAE icon is showing on the system tray and both mbae.exe and mbae-svc.exe are now running. Thanks for your help.

As a side note, pls remember to instruct folks trying to install a lower version (eg v24) that the MBAE installer has the option "automatically upgrade to new versions"  enabled by default. This means that if you download the installer for v24 and try to install the program, before you actually manage to reach the GUI and uncheck the "automatically upgrade to new versions" box, the program has already updated itself to v41. For the majority of people this is not an issue, but for people like me (XP user), this is a problem.

The only workaround is to download the installer, shut your internet connection, install the program offline, uncheck the "automatically upgrade to new versions" option, restart your internet connection. This way it won't upgrade to a new version unless you check the box again.

Hope it helps.

Share this post


Link to post
Share on other sites

Hi Rsullinger,

An update on this issue. This morning we are back to square one.

On system startup, MBAE.exe didn't start, the only active service is mbae-svc.exe, yet the logs show that my programs are being protected anyway.

Something i didn't notice until today is that If I manually launch mbae and then I click on "hide icon" on the mbae icon on my system tray, then mbae.exe gets killed.

I will stick to mbae in its current form (only mbae-svc.exe active) until I get further advice/ input from you guys.

Thanks for your help.

Share this post


Link to post
Share on other sites

Thanks Arthi.

I upgraded to v45 and the issue persists, ie - MBAE.exe doesn't start neither at boot nor at the launch of a program it was supposed to protect. The only active service is mbae-svc.exe, yet the logs show that my programs are being protected anyway.

I have worked around it by putting a shortcut to mbae.exe into the startup folder, thus forcing a launch at boot.

Thanks for your help.

Share this post


Link to post
Share on other sites

Hi scut1,

Sorry to hear that your issue is not resolved with v45. I am going to need fresh logs to analyze further. Can you please follow the instructions below. Let us know if you need any help in getting these. Thank you.

  1. ZIP the entire contents (ALL the files, not just .LOG) of the MBAE user data directory and attach them to your post. The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it. If you are replying to someone else's post, you can click the "More reply options" button at the end of the page to get the file attachment options. You can find the logs in the following locations:
    1. Windows XP: C:\Documents and Settings\All Users\Application Data\Malwarebytes Anti-Exploit
  2. ZIP the entire contents of the folder  C:\Program Files\Malwarebytes Anti-Exploit 
  3. Detailed system information. To facilitate replicating the problem consider downloading and running FRST and attaching its logs to your post as well. 

Share this post


Link to post
Share on other sites

Hi scut1,

Thanks for the logs. You missed sending us the below

  1. ZIP the entire contents of the folder  C:\Program Files\Malwarebytes Anti-Exploit 

Share this post


Link to post
Share on other sites

Hi scut1,

When the service is installed, it creates an entry in the registry at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Whenever the installer tries to add this entry in your computer, it gets an access denied error so it cannot add this entry and mbae.exe won’t be launched at startup. You should change the permissions of this registry key to give “Full Control” to Administrators group (see the screenshot).

Go to registry Editor -> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> RIght click on the Run folder-> Permissions-> and change the permissions according to the screenshot.

Then reinstall the product. Let us know if that resolved your issue. Thanks.

Registry.png

Share this post


Link to post
Share on other sites

Hi Arthi

thanks for the information.

I have tried following your reco, but the registry key is already set at the value requested.

Screenshot of the current situation attached.

Pls let me know.

Thx

regedit.gif

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.