MBARW Beta v 0.9.18.807 - Build 274 interfering with MBAE

[hake]

I noticed that MBAE is absent from the system tray and then that build 274 of AntiRansomware has been pushed as an update.  Further investigation in Task Manager shows that mbae.exe is suspended. I guess that this is why the MBAE icon is not on display in the system tray.

mbae-svc.exe and mbae64.exe are running.

The issue also causes difficulties with uninstalling and reinstalling MBAE.  The problem vanishes when MBARW build 258 is reinstated.

Can this issue be resolved without user intervention?

Edited January 28, 2020 by hake

[hake]

I'm still getting my head straight on this.  It seems to me that I can run the MBAE GUI and interract with it.  I had uninstalled MBARW build 274 then reinstalled MBARW build 258 but build 274 quickly replaces it.  It seems to me that MBARW build 274 is inhibiting the start of MBAE GUI at startup but is probably not interfering with its operation since MBAE event logging is working OK.  I think that MBAE proection is unimpaired (phew!)

I guess therefore that a remedial update of MBARW is required.

Following the fun and games I have had with trying to uninstall then reinstall MBAE to correct the problem before I realised that the cause was MBARW build 274, I would prefer that no updates of MBAE are pushed out until MBARW is fixed.

The 'fun and games' were the MBAE uninstall and install processes freezing.  Since I was initially unaware that the build 274 update to MBARW was running, this caused me some confusion.

BTW, this issue occurs with Windows 7, 8.1 and 10.

Edited January 28, 2020 by hake

[LiquidTension]

Thanks for reporting this issue, @hake! This is reproducible and we've filed a defect. Until a fix is available, there are two available workarounds for the issue.

Workaround #1:

• Add C:\Windows\SysWOW64\RunOnce.exe as a file exclusion in Malwarebytes Anti-Ransomware.

Workaround #2:

• Move the “Malwarebytes Anti-Exploit” value from HKLM\SOFTWARE\WOW6432Node\...\Run to HKLM\SOFTWARE\...\Run.
  The following .reg file can be used to accomplish this: https://malwarebytes.box.com/s/dp4jgjr06oqtmx3cp4g8dh0kzxmlze8u

[hake]

It is because of the potential for problems with uninstalling/installing of MBAE that I expressed a hope that no MBAE updates would be pushed until the issue is fixed.  I am content to leave things alone since MBAE 1.13.1.127 functions even without mbae.exe running.  I have a couple of installations of MBAE/MBARW which require me to travel 90 miles to do the suggested fix and these will not receive attention for the next ten days.

There was no problem with MBARW build 258.  Wouldn't it be better to push out, i.e. revert to, the previous build of MBARW?  MBAE is arguably more important than MBARW.

Edited January 28, 2020 by hake

[Porthos]

54 minutes ago, hake said:

I have a couple of installations of MBAE/MBARW which require me to travel 90 miles to do the suggested fix and these will not receive attention for the next ten days.

I am just curious, Why go thru the issue of making them work when Malwarebytes Premium instead would be a better solution.

[hake]

I was pleased that automatic updates became available for MBARW but now I find that the lack of the means of inhibiting automatic updates is not so pleasing.

Is there any chance that build 258 can be pushed out so that it could backdate MBARW build 274 to build 258?

Edited January 28, 2020 by hake

[hake]

It would be great if an automatic update could be pushed out to revert installed Build 274 of MBARW to Build 258.  I wish that I had made Malwarebytes aware of the problem even earlier so that more users could have been saved the nuisance of faulty Build 274 being installed over adequately functioning Build 258.  I have two relatives who are stuck with Build 274 because they are to far way for me to personally visit them to recover the situation.  If a remedial update is not to be forthcoming, I will talk them through uninstalling MBARW later to day.

MBARW has up to now behaved so well that I was lulled into a false sense of confidence in it.  I appreciate that this is Beta software but it would be much appeciated if Build 258 could be restored by automatic update.  Isn't this possible?  I have restored Build 258 on my several Windows systems but there must be others who are lumbered with faulty Build 274 and do not yet realise it.

Edited January 29, 2020 by hake

[LiquidTension]

Thank you for the feedback. The impact of this issue is currently being evaluated. We hope to have an update shortly.

In the meantime, note that the protection offered by Malwarebytes Anti-Exploit is unaffected by this issue as it only extends to the user interface elements of the program (e.g. notifications). Also note that two workarounds exist that will mitigate the issue entirely, as well as having the option of manually launching mbae.exe.

[hake]

Did you know that the automatic update from Build 258 to Build 274 is till being pushed out?  I am slightly surprised since you surely have a very good reason to suspend the update.  I am uninstalling MBARW pending a resolution to the issue.

[LiquidTension]

Thank you for your patience. We are working on a fix for this issue. An update will be provided as soon as possible.

For other affected users, please refer to the post linked below for details on available workarounds.
https://forums.malwarebytes.com/topic/256145-mbarw-beta-v-0918807-build-274-interfering-with-mbae/?do=findComment&comment=1359023

[hake]

I realise that grumbling about a flaw in MBARW is like looking a gift horse in the mouth.  I look forward to a solution for the problem.

[1PW]

1 hour ago, hake said:

I realise that grumbling about a flaw in MBARW is like looking a gift horse in the mouth.

Au contraire @hake.  This is one of the prime reasons the perpetual beta MBARW exists!  Those defects that are found now and resolved here will soon find there way to the ARW module etc in the flagship product.  (Consumer and Enterprise)

Thank you always for your diligence! 👍

Edited January 31, 2020 by 1PW

[hake]

I am happy to use MBARW Beta and to report problems but after this present difficulty I would ask that automatic updating can be optionally switched off. That way I can notify issues but not be stuck without this very valuable protection. A working previous version is better than no MBARW.

Edited February 3, 2020 by hake

[LiquidTension]

Hello,

We've now released an updated component package for Malwarebytes Anti-Ransomware (version 1.1.278). This is intended to address issues encountered when Malwarebytes Anti-Exploit is installed as well.

Thank you once again for reporting this. Please let us know if you experience any issues with the new version.

Edited February 5, 2020 by LiquidTension

[hake]

Got Build 278 thanks very much. It plays nice with MBAE.

[LiquidTension]

Excellent, thanks for the feedback!