Settings Recovery

[UnicornsRock]

Had to reinstall MalwareBytes and now all of my customizations (Exclusions) are reset back to factory defaults.

Example: For whatever reason, either infrastructural costs or potentially latency issues, Rock Star decided to implement their multiplayer system as somewhat "Peer-to-Peer". So for instance if somebody on the same server in the same session just happens to have an IP Address Malwarebytes doesn't like, after a really long time of hanging in limbo with a spinning icon, GTAV eventually will timeout connection. Whitelisted GTAV on the Exclusions list and the problem went away. That was 1 of several exclusion rules.

Now all of those settings are gone, POOF! The UI doesn't appear to support any sort of Backup/Restore system for the settings outside of "Restore Defaults". Is there anyway to recover my previous settings? Or should I just stop wasting my time and demand a refund?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Unfortunately there is no recovery option for customized settings nor is there any straightforward backup function, however read on and I will be providing you with a workaround for the future though it doesn't resolve your current situation unfortunately.

Due to the fact that many program errors and issues are known to be caused by one or more corrupt configuration files, Malwarebytes now automatically deletes all of its customized configuration files/settings when you uninstall it.  It also does this for the sake of users who are removing the software permanently and do not wish for traces or components of the program to be left behind after uninstallation is complete.

You might attempt to recover the lost configuration files via a file recover tool such as Recuva by Piriform (the makers of CCleaner) though there are no guarantees that it will be successful as often times once a file has been marked for deletion in Windows, its data/disk sectors end up being corrupted by being partially or completely overwritten with new data as the system is used.

That said, if you reinstall the software by installing the latest version over the top of your existing installation, your customized settings and exclusions should be preserved.  It is because of this that I would generally recommend trying this method of repair first before resorting to uninstalling/reinstalling the software or performing a clean installation.

Now, with regards to backing up your customized settings, the configuration options for Malwarebytes are stored within the C:\ProgramData\Malwarebytes\MBAMService\config directory so you may back up that folder whenever you desire so that you'll have your settings saved where the program's uninstaller cannot remove them.  Once you have Malwarebytes reinstalled, terminate it by right-clicking the Malwarebytes try icon and choosing Quit Malwarebytes and click Yes if prompted by User Account Control, then replace the folder/files then launch Malwarebytes once more so that it will load the replaced configuration settings.

Again, I apologize that you must reconfigure your modified settings, but at least now you know how to back them up and restore them should you choose to continue using Malwarebytes.  Also, if you do wish to proceed with seeking a refund you may find the information in this support article to be helpful.

Please let us know if there is anything else we might assist you with and we'll do our best to help.

Thanks

Edited April 22, 2018 by exile360

[ihorden]

Is it possible to use this config file backup trick to copy configurations from one machine to another.   The only information I care about are the exceptions and the scanning schedule.

Thank you,

[exile360]

Yes, that should be possible.  Most settings should be transferable between machines.  I believe the files you want are C:\ProgramData\Malwarebytes\MBAMService\config\RTPConfig and C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig, however we might need confirmation from one of the staff members to verify.

@dcollins is this accurate, or are there other files the user would need for backing up/migrating the following settings?:

• Exclusions
• Scheduled scans
  

[dcollins]

No, you can't copy config files from one machine to another as the config files are hashed using information from the machine itself.

[exile360]

Ah, well that's a bummer.  I knew they would be for the license info etc. but I figured the settings would be machine-agnostic.  Oh well, thanks for the info.

[ihorden]

Well stated exile - Just when I think I found a solution.  GRRRR

[exile360]

Yep, sorry about that.  Hopefully they'll eventually provide a function to import/export settings.  In the meantime I'll take a look at the config files and see if I can find a way to make it work.  Maybe there's just a header/UUID or something in there that needs to be changed.  If it isn't encrypted I should be able to make it work.  Of course that does mean that it won't be as simple as migrating the files over, but at least you won't have to go through all the extra work of re-configuring your scheduler and exclusions again.

[ihorden]

Thanks Exile.  My guess is that they encrypted the whole mess with the same key, and if they used Machine specifics, its a lost cause.  I was looking for an easy way out, but don't need you to spend time on it unless the curiosity gets the best of you.

[exile360]

Well I have some good news and some bad news.  The good news is the files aren't encrypted.  They're stored in raw text format within the config folder in Malwarebytes ProgramData folder.  The bad news is they must be doing a hash check on the config files via some secondary file because I made an edit to an inconsequential entry in one of my config files and re-loaded Malwarebytes and it wiped everything that was stored in that config file out, resetting everything controlled by that config file back to defaults (they store backups for the default config files in a secondary location for instances where a config file might be missing or become corrupt so that the program can still load without necessitating a reinstall).  This means that we won't be able to use them on another machine even if we were to edit the machine ID/UUID of each config file (assuming they use one as explained by dcollins above) because as soon as any change is made, Malwarebytes will just wipe/overwrite the file with the default copy stored in its backup location.

Sorry, I was really hoping I could figure out a way around it.  Given enough time I might be able to make it work, but at this point the level of effort and workarounds that would likely be involved would probably negate the entire purpose of trying to do it in the first place as it would rival the effort required to just recreate your settings the normal way in your secondary Malwarebytes installations.

[ihorden]

Thanks for the valiant effort.   I think if it worked any other way it would leave a whole in the protection.

[exile360]

Nah, all those files are guarded by the self-protection driver.  The way it is, if a threat really wanted to break Malwarebytes and was capable of gaining write access to those files, they could just as easily wipe them all out or just corrupt them (including the backups) which would prevent Malwarebytes from running.  I made all my edits with Malwarebytes terminated (I quit from the tray) because I knew it wouldn't allow me to make any changes while it was active.

[dcollins]

1 hour ago, exile360 said:

Nah, all those files are guarded by the self-protection driver.  The way it is, if a threat really wanted to break Malwarebytes and was capable of gaining write access to those files, they could just as easily wipe them all out or just corrupt them (including the backups) which would prevent Malwarebytes from running.  I made all my edits with Malwarebytes terminated (I quit from the tray) because I knew it wouldn't allow me to make any changes while it was active.

Not quite. While there may be some way to cause that, Malwarebytes does detect if the files are missing or corrupted and will try to reset them with default ones.

[exile360]

Ah, I see.  Previously they'd built a solution which stored a set of defaults in a backup location which would be used in case the files had become corrupt or deleted, but if the defaults are hard-coded into the software's binary/binaries then all the better, as that's a much more robust solution (lacking such capabilities is precisely why malware is often able to subvert Windows File Protection and System Restore etc. because they either wipe the backups or replace them with infected copies).