Discrepancy between MBAM-Check and latest Malwarebytes 3?

[kimiraikkonen]

Hello,

A few months ago, i had updated my existing Malwarebytes 2.2.1.1043 to Malwarebytes 3.3, which is quite latest version. Today i wanted to run mbam-check just to look up something about configuration and noticed that i still have VERY old registry entries under WoW6432Node key, after seeing Mbam-Check returning very old version numbers and dates. I'm using mbam-check 2.3.20 as it seems the latest.

I'm feeling a discrepancy, why is mbam-check reporting very old registry entries (like MBAM 1.75 etc), despite i'm using MBAM 3 with no problems today?

My system is Windows 7 x64, Malwarebytes free (trial ended).

I'm attaching the related screenshot and report file here.

I beleive, after upgrading from 1.7-2.x series to Malwarebytes 3, the installed left those keys behind and Malwarebytes registry structure has apparently been changed and those keys are not overwritten even after upgrading to version 3.

A brief explanation is greatly appreciated, thanks!

CheckResults.txt

[Porthos]

5 minutes ago, kimiraikkonen said:

Today i wanted to run mbam-check just to look up something about configuration

Use this

1. Download MB-Check and save to your desktop
2. Double-click to run MB-Check and within a few second the command window will open, then click "OK"
3. This will produce one log file on your desktop: mb-check-results.zip
4. Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

[Porthos]

On 1/6/2018 at 12:49 AM, kimiraikkonen said:

Malwarebytes 3.3, which is quite latest version

You are not on the latest version. And since you had leftovers...

Let us get a clean install of the current version. 3.3.1

 

 

We have another tool called MB-Clean which will automate the whole process for you.

 Tool can be found at xxx

 

Post updated [02/12/2021 - AdvancedSetup]

The following MBST tool should be used to perform a clean removal and reinstall

https://support.malwarebytes.com/hc/en-us/articles/360039023473-Uninstall-and-reinstall-using-the-Malwarebytes-Support-Tool

 

 

 

1. After downloading the tool run the tool.

2. The tool will automatically clean up the older possibly damaged installation and will ask you for a restart.

3. Restart your system and then the MB-Clean tool will prompt you to re-install the latest product.

4. Click on "Yes" to reinstall MB 3.×.

5. Now you will have the latest product installed. If it does not offer the new install after the reboot you can download and install from here. 

 

https://downloads.malwarebytes.org/file/mb3

Edited February 13, 2021 by AdvancedSetup
updated information

[kimiraikkonen]

36 minutes ago, Porthos said:

You are not on the latest version. And since you had leftovers...

Let us get a clean install of the current version. 3.3.1

 

 

We have another tool called MB-Clean which will automate the whole process for you.

 Tool can be found at https://downloads.malwarebytes.com/file/mb_clean

 

 

1. After downloading the tool run the tool.

2. The tool will automatically clean up the older possibly damaged installation and will ask you for a restart.

3. Restart your system and then the MB-Clean tool will prompt you to re-install the latest product.

4. Click on "Yes" to reinstall MB 3.×.

5. Now you will have the latest product installed. If it does not offer the new install after the reboot you can download and install from here. 

 

https://downloads.malwarebytes.org/file/mb3

Hi Porthos,

Thanks for your quick reply, you were quicker than me as i noticed the same info a few minutes ago. But there are still some discrepancies. First, my Malwarebytes version is 3.3.1.2183 as you can see from the screenshot, sorry for shortening it down to 3.3 inside my text. So the program is up-to-date.

I downloaded and ran mb-check-3.1.9.1001.exe which seems the latest and current mb-check tool, i ran it, after confirmation it created a zip file on my desktop named "mb-check-results.zip", what i see in this diagnostic zip file, there are 2 main text files:

1) CheckResults.txt : This is the text file containing and referring to my topic's outdated version information, it still shows entries from the year 2013, MBAM 1.75 from Wow6432Node key. (You know it's the registry key for those 32-bit programs running on 64-bit systems).

2) mb-check-results.txt : This is the correct text file containing current and valid entries related to Malwarebytes 3.3.1 version which is installed on my machine at the moment.

Why is it still reporting old entries within CheckResults.txt file located in zip file?

You remember, a few years ago, lets say in 2013, Malwarebytes Antimalware was offering us to update itself (core program) with an installer prompt WHEN we try performing a database update. I always clicked "YES" and the new versions had been installed without any problem, for example moving from 1.7 to 2.x and from 2.x to 3.3.1 branch, no problems. For that reason, i beleive that doing this would have caused a lot of leftovers, "old and currently unused keys" remain on system. That's why i'm a bit curious and furious why Malwarebytes was used to select that type of upgrading style when switching to a major version for itself in the past, without offering and running an uninstaller (like mbam_clean on the background), though. However, it's history.

I'm attaching the current screenshot of mb3_check, hope you clarify things, mate.

Should i delete the Malwarebytes' AntiMalware key manually under Wow6432Node key as it's really old and not being used any longer? I don't want to use mbam_clean at the moment and struggle with cleanup / reinstallation process not to screw up things again.

I appreciate!

Edited January 6, 2018 by kimiraikkonen

[Porthos]

33 minutes ago, kimiraikkonen said:

after confirmation it created a zip file on my desktop named "mb-check-results.zip", what i see in this diagnostic zip file, there are 2 main text files:

post that zip, please.

[kimiraikkonen]

2 hours ago, Porthos said:

post that zip, please.

Hi, here is the zip file attached.

I feel that the registry entries included in these logs do not harm, but i'm curious about why these entries are still reported in CheckResults.txt and not in mb-check-results.txt (which is the latest checker tool), and i wonder why this zip file contain multiple check logs, eventhough i only have ONE, the latest Malwarebytes installed (v3.3.1) on my system.

Thanks for your response!

mb-check-results.zip

Edited January 6, 2018 by kimiraikkonen

[Porthos]

4 hours ago, kimiraikkonen said:

Thanks for your response!

Your log shows that you did NOT run the clean tool like I instructed. You are not on the newest version. After you run the clean tool get me a new MB check zip.

Please follow the instructions in post #3

[kimiraikkonen]

1 hour ago, Porthos said:

Your log shows that you did NOT run the clean tool like I instructed. You are not on the newest version. After you run the clean tool get me a new MB check zip.

Please follow the instructions in post #3

Well, indeed i have not ran clean tool yet.  The reason is to understand the current situation and how it happened. But i am on the newest version, 3.3.1, which is the only and afaik the latest Malwarebytes build version at the moment. Control Panel (Programs and Features) and Malwarebytes GUI are prooving this by itself. So i did not understand your statement of being not on the latest version. Mb-check-results.txt shows it. But i just wonder why i also have CheckResults.txt, which shows some unused and outdated registry keys appear to remain on system.

Please check all my screenshots again in previous posts in this thread, sir.

For the interactive program updating procedure during database update check without running clean tool, it is obvious that developers of Malwarebytes had made big logical mistake, which caused a lot of dead registry keys remain on system. I mentioned the case and reason in earlier posts of this thread.

Thank you.

[Porthos]

1 hour ago, kimiraikkonen said:

So i did not understand your statement of being not on the latest version. Mb-check-results.txt shows it.

1 hour ago, kimiraikkonen said:

Please check all my screenshots again in previous posts in this thread, sir.

I looked at your screenshots before I posted the first time.

I wish you would trust me and follow my instructions. I am telling you are NOT FULLY UP TO DATE.

Quote

"controllers_version" : "1.0.236",

The CURRENT version is 1.0.262

Please run the MB Clean tool.

Edited January 6, 2018 by Porthos

[kimiraikkonen]

46 minutes ago, Porthos said:

I wish you would trust me and follow my instructions. I am telling you are NOT FULLY UP TO DATE.

The CURRENT version is 1.0.262

Please run the MB Clean tool.

Hi Porthos,

Of course i trust you, sorry if there is any inconvenience. I just wanted to test and make sure about the things before the clean up. I'll run it.

But, before running clean up, could you please clarify one thing more that i've just tried. You told me that my component package version is old, that is 1.0.236, and the latest/current component (controller) version is 1.0.262, nice catch, thanks! However, if i try updating component package manually as instructed here, at my first manual attempt, i got "no updates are available" message! (see screenshot 1). I thought that the update would not appear to me because my OS is fairly old, Win7 SP1, maybe it is for newer clients like Win10.

Then i followed some instructions from you and finally managed to get the latest component package, 1.0.262 (see screenshot 2). I re-ran mbam-check (for version 3) again and it seemed to appear normal with only one check log text file, mb-check-results.txt as it should be. I'm attaching it, too. However some older registry entries are still there if i use regedit to see them.

I'm attaching the screenshots here, my first attempt, and second attempt with successful component update.

Am i OK now? Do i have to clean nasty registry entries manually or had i better live with them?

mb-check-results.zip

[Porthos]

On 1/6/2018 at 11:33 AM, kimiraikkonen said:

maybe it is for newer clients like Win10.

 

It is for every one on VER 3.

You log still tells me you DID not follow the instructions and run the MB clean tool...

xxxx

 

Post updated [02/12/2021 - AdvancedSetup]

The following MBST tool should be used to perform a clean removal and reinstall

https://support.malwarebytes.com/hc/en-us/articles/360039023473-Uninstall-and-reinstall-using-the-Malwarebytes-Support-Tool

 

 

Edited February 13, 2021 by AdvancedSetup
updated information

[dcollins]

For reference, there's two files in your zip file because mb-check is detecting the older installation leftover on your machine. It's hard to say why it happened as the upgrade to Malwarebytes 3 should have removed that leftover stuff.

That being said, there is a situation where this could happen. If you installed Malwarebytes 3, which should have removed everything, and then attempted to re-install Malwarebytes 2.x, it would put those keys back because the Malwarebytes 2.x was not updated to check for the 3.x version and stop the installation

[kimiraikkonen]

8 hours ago, dcollins said:

For reference, there's two files in your zip file because mb-check is detecting the older installation leftover on your machine. It's hard to say why it happened as the upgrade to Malwarebytes 3 should have removed that leftover stuff.

That being said, there is a situation where this could happen. If you installed Malwarebytes 3, which should have removed everything, and then attempted to re-install Malwarebytes 2.x, it would put those keys back because the Malwarebytes 2.x was not updated to check for the 3.x version and stop the installation

Hi @dcollins and thank you for answer. I never and ever have reverted back to 2.x after i have installed 3.3.1. I have no idea why leftovers are there, however it appears that Malwarebytes 3 installer failed or skipped to uninstall them correctly when migrating from 2.x / 1.75 to 3.x series. However it's not a big deal and can be removed manually as far as we know what we're doing. After updating component package to 1.0.236 to 1.0.262 manually, now i get only one check file on mb-check-results.zip archive, not duplicated log files any longer. I'm attaching it again.

I'll try running mb-clean ASAP as Porthos and any other members have pointed out in case of any strange behaviours.

Cheers

mb-check-results.zip

Edited January 8, 2018 by kimiraikkonen

[Porthos]

Also...

Go to the folder C:\Program Files\Malwarebytes\Anti-Malware\
Find the file mbam.exe and right click on it and choose Properties
In the window that pops up click on Compatibility Tab
Remove ALL checkmarks. Malwarebytes has issues when you change these settings,