Malwarebytes and Webroot

[CyberJake4D]

Dear Malwarebytes staff and user community,

There were reports of a conflict between Malwarebytes and Webroot. Mine started only with the newest Pro version of Malwarebytes (MBAM Pro 1.44) with same latest version of Webroot Internet Security Essentials (WISE 6.1.0.145).

Both softwares load and seem to coexist well on XP Home SP3 until a Sweep (Webroot scan) is manually initiated while MBAM Pro active protection is on (by Start Protection following a manual startup or with Start with Windows ticked). Similar frozen issues with some other security products do exist according to recent reports in this forum.

Specific problem with WISE : Any Sweep using its GUI stops right away at the second memory item inspected and the system freezes except for the MBAM GUI (but can't collect information when a folder is chosen through its new window). The CPU usage drops to low normal. Furthermore, the suspicion is that WISE could have been already ineffective from the start of MBAM Pro active protection because of a memory conflict. And, a computer reset is necessary to restart the OS.

MBAM executables were added to the firewall (mbam, mbamgui and mbamservice) but rules.ref, mbam.sys and mbamswissarmy.sys files can't be added as exlusions in WISE Application Handling. On the other hand, Malwarebytes Corporation was added as a trusted publisher; but, that didn't change anything. (Such settings are not available for users of Webroot SpySweeper with or without an antivirus).

Consequently, the security level of MBAM Pro 1.44 activated is unsure with WISE on my home system (PIII 733 Mhz, 1.5 GB RAM, ZoneAlarm ForceField) which is otherwise stable. Unless, after testing, this strange and cumbersome almost magical solution is applied stepwise which anhilates the conflict : Load MBAM Pro without active protection (whether manually or inactivated at OS startup), do a MBAM Pro QuickScan (or full scan likely too), only then push Start Protection of MBAM Pro. Thereafter, absolutely no problem to run WISE QuickSweep (or Full or Custom) on my computer.

No idea how much that is specific or somewhat general. Are other Webroot users can run QuickSweep without issue when MBAM Pro active protection is ON? Is running an early QuickScan of MBAM Pro with active protection turned OFF is a temporary solution for Webroot and other security users having similar frozen issue?

[CyberJake4D]

In short, firstly a MBAM QuickScan followed by Start Protection solve the problem (unable to Sweep, can't inspect memory items).

Could this short procedure solve some similar conflicts? Please post your result.

Here, always same result with Start Protection. Additional tests done, my security programs has been limited to MBAM Pro and WISE using various reduced settings.

Could an expert explain a little how a simple scan before would prevent a conflict which involves the active protection?

[noknojon]

Hi CyberJake -

If you use an "active running" version of WISE can you exclude the following items from your antivirus And your Firewall - -

Your Antivirus and Firewall program may identify Malwarebytes as an unwanted intruder, so we need to make it recognise that it is not a bad item -

Exclude Malwarebytes' Anti-Malware's Files and Folders From Other Active Security Programs:

For Windows XP:

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  Why can these items not be added to exclusions (Also to Firewall)
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

Please follow these steps first and post back if you have any problems

Also do you have Any other active A/V or A/Malware programs on your system at all - If you may have remainders of other A/V programs we can supply you with removal programs for these - As a clash can cause these problems when older programs are never Fully removed -

Also ensure the items are added to your Firewall (unless it is only the standard Windows Firewall) -

Thank You -

EDIT - Can you also set the 2 programs to run scans at times that do not interfere with each other -

[CyberJake4D]

Hi Nokojon,

Thank you in advance for your interest in this problem.

WISE integrates Privacyware's Privatefirewall and Sophos antivirus with their own Webroot antispyware (better known as SpySweeper) and cleanup utility. As packaged, the firewall can only deal (Allow, Filter or Block; Allowed parents or not) with exe files (no sys, dll, ref, ... files can be excluded) and the antivirus has no exclusions at all (but its combination with the antispyware has various strong settings called Shields). Therefore, I can't exclude dll, sys and ref files but the three mbam exe files are set to allow plus mbamgui.exe set as an allowed parent.

I'm a licensed user of WISE. and have been a happy user of ZoneAlarm Pro firewall and Eset antivirus which were removed by their own uninstallers (Eset's Install folder and their files remain in the Program Files' folder; most active remainders should have been found by using on demand TuneUp Utilities 2007 RegistryCleaner or Large PCTuneUp). (ZoneAlarm/CheckPoint or Eset specialized removal utility tools were not used.)

From my experience with WISE, MBAM doesn't seem to be blocked in its function because there is no such alert by Process Monitor. No

[noknojon]

Hi Again -

I have been doing a bit of checking with WISE , via their web site and have had a reply that No other Anti virus should be running with their product at any time - If the program version you are using also includes the Firewall then that is all you should run - You Must ensure No other A/V is active at the same time as well as No other commercial Firewall program - These will cause the problems you described -

I am waiting on another Email from them to confirm other programs that will run and the settings to use at startup -

Thank you for waiting -

[CyberJake4D]

Thanks Noknojon for your help,

This is to confirm you that I use only WISE as active running firewall/antivirus/antispyware with antimalware MBAM Pro (now, actively running only if I QuickScan before). No other firewall or antivirus.

This problem is new for me with version 1.44 of MBAM with WISE. Hopefully, a solution will be found.

[noknojon]

Hi Again Jake -

This quote is from the WISE/Webroot home site - It may show how to exclude legitimate programs from causing problems -

Always Ignore. If you know some items are required for legitimate programs, you can

specify that they are always ignored and not listed in the Quarantine panel during a sweep.

For example, a legitimate program might need a piece of spyware that should not be

removed. In this case, you can instruct the Webroot software to always bypass that

spyware program during sweeps so it does not get moved. For shields, the Always Ignore

setting allows activities related to the particular item and does not open an alert.

After you specify how Webroot software manages items in the Always Apply tab, the sweep

function still detects them and includes them in its count of found items and traces, but it will not

include the items in the Quarantine list, which reduces the number of items you must evaluate after

sweeps.

Just a First reply -

[daledoc1]

I have no trouble with WISE and MBAM Pro 1.44 on my laptop (Win7 32).

My first MBAM install was problematic with WISE, so I ended up uninstalling/cleaning/reinstalling, after help here at the forum.

I did take the trouble during the 2nd MBAM install to: 1) temporarily disable the WISE FW/AV, 2) ensure that all the MBAM Pro exe files were allowed in the FW, 3) MB allowed as "trusted publisher". After successful install and update of MBAM, I then reactivated the WISE features. (I contacted Webroot about how to allow the DLL, SYS and REF files, and they said that the FW doesn't allow the user to add these file formats to the FW, but that this shouldn't be necessary.)

Everything works fine now, including the MBAM active protection module.

HOWEVER, the 2 programs did seem to conflict when MBAM was set to run at Windows startup.

So, I just wait for the system to boot (and, typically, WISE to check for updates) before I manually start the MBAM active protection.

I know this shouldn't be necessary on Win7, but the 2 apps DO conflict when they both try to load at startup.

If that procedure is too cumbersome, the MBAM folks here can give you a reg import to set MBAM Pro active pro to start X min after startup, or you can try WinPatrol, which has a feature that allows you to set any program to a delayed start.

Anyway, I find that as long as I wait a few seconds after booring to start MBAM and then start the active protection module, it works fine with WISE.

I'll be interested to see what the experts say!

daledoc1

[CyberJake4D]

Hi Noknojon and Daledoc1,

Noknojon, WISE Sweep doesn't find any file or item of MBAM suspicious. Therefore, there is nothing which can be set to Always Ignore.

Madam Daledoc1, I'm happy you have no major issue (except the delay) of actively running the latest versions of MBAM and WISE on W 7 32. To be sure on W XP 32 SP3, a reinstall of MBAM as you did was done earlier today (uninstalling/cleaning/reinstalling) with WISE shutdown and loading disable. In the Firewall, there are three MBAM Executables set to Allow, only mbamgui.exe as Allowed Parent and MB as trusted publisher.

Same strange result, can only Sweep with both actively running when a previous MBAM Scan was done with its protection mode inactive. Maybe the developers could have a clue.

Thanks for your interest.