Malwarebytes & Trend Internet Security 2010

[MattsComputers]

I have a business client which had a spyware infection. A rogue which has now all been cleaned up thanks to MalwareBytes. There also was a tddss rootkit that I removed using a Kaspersky utility. I recommended that they upgrade to the corporate version of MBAM to which they agreed and they purchased the license from me.

Problem is that the system has started freezing intermittently. It just stops responding and the only way to get it operating again is to power off. It doesn't seem to matter what program they are using. Either browsing the net or just opening Word, Excel or email. Sometimes the system will run for about an hour without any freezing. But then there are times when it will lock up every 5 minutes. They have to power off and restart to get it going again.

They are using Trend Micro Internet Security 2010. I have setup all the exclusions as shown in the help guides. I have also increased the memory from 1gb to 3gb but this hasn't helped. I'm sure the issue is related to Trend Micro and Malwarebytes clashing. I did a complete uninstall of both Trend and Malwarebyes using TIStool and Mbamclean. Then downloading and reinstalling 1.46 of MalwareBytes and the latest 2010 build of Trend Internet Security. Then recreating the exclusions.. But the problem remains. Still freezing and the system really seems to be running a lot slower than it should.

System specs:

Asus P5K-SE-EPU Motherboard, Intel Core 2 Duo E7300 CPU, 2.66, 3gb DDR2 Memory, 250gb Hard Drive, Running Win XP Home SP3.

I really thought that upgrading the memory would have been the answer. I had a P4 system with Mcafee TP 2010 and MBAM. Adding 2 gb to that system resolved its freezing issues.

Any suggestions from other users running Trend Micro 2010 and MBAM together? I'm thinking of reverting to Trend Micro 2009 to see if that helps. Maybe go back to 1.45 of MBAM?

[shadowwar]

Hi,

This sounds like there still could be a piece of the TDSS rootkit left behind like a driver. A bad driver could cause a hard freeze. The kaspersky tool has troubles sometimes removing it completely. Do you happen to have the logs from the Kaspersky tool? I assume the MBAM logs are clean?

[noknojon]

Hi Matt -

I assume you have checked the FAQ area and read This Topic about Trend Micro -

It may be 6 months old but can still apply -

Thank You -

EDIT - As a forum member you have access to the FAQ area and can browse , but if this is a corporate or technicion problem please see TeMerc's response -

[TeMerc]

I have a business client which had a spyware infection. A rogue which has now all been cleaned up thanks to MalwareBytes. There also was a tddss rootkit that I removed using a Kaspersky utility. I recommended that they upgrade to the corporate version of MBAM to which they agreed and they purchased the license from me.

Problem is that the system has started freezing intermittently. It just stops responding and the only way to get it operating again is to power off. It doesn't seem to matter what program they are using. Either browsing the net or just opening Word, Excel or email. Sometimes the system will run for about an hour without any freezing. But then there are times when it will lock up every 5 minutes. They have to power off and restart to get it going again.

They are using Trend Micro Internet Security 2010. I have setup all the exclusions as shown in the help guides. I have also increased the memory from 1gb to 3gb but this hasn't helped. I'm sure the issue is related to Trend Micro and Malwarebytes clashing. I did a complete uninstall of both Trend and Malwarebyes using TIStool and Mbamclean. Then downloading and reinstalling 1.46 of MalwareBytes and the latest 2010 build of Trend Internet Security. Then recreating the exclusions.. But the problem remains. Still freezing and the system really seems to be running a lot slower than it should.

System specs:

Asus P5K-SE-EPU Motherboard, Intel Core 2 Duo E7300 CPU, 2.66, 3gb DDR2 Memory, 250gb Hard Drive, Running Win XP Home SP3.

I really thought that upgrading the memory would have been the answer. I had a P4 system with Mcafee TP 2010 and MBAM. Adding 2 gb to that system resolved its freezing issues.

Any suggestions from other users running Trend Micro 2010 and MBAM together? I'm thinking of reverting to Trend Micro 2009 to see if that helps. Maybe go back to 1.45 of MBAM?

Alternatively, as a licensed corporate user, technician, reseller, affiliate or non-profit you have access to the corporate helpdesk, contact them via the email address below.

corporate-support@malwarebytes.org.

Please provide your corporate license information when requesting help.

[MattsComputers]

Hi,

This sounds like there still could be a piece of the TDSS rootkit left behind like a driver. A bad driver could cause a hard freeze. The kaspersky tool has troubles sometimes removing it completely. Do you happen to have the logs from the Kaspersky tool? I assume the MBAM logs are clean?

Sorry I deleted the logs. But yes the mbam logs are now clean. I did a scan with Trend Micro and this only found a few cookies. Thanks. I''ll try running the kaspersky tool once more just to see if it detects it again and so it will generate another log.

[MattsComputers]

Hi Matt -

I assume you have checked the FAQ area and read This Topic about Trend Micro -

It may be 6 months old but can still apply -

Thank You -

EDIT - As a forum member you have access to the FAQ area and can browse , but if this is a corporate or technicion problem please see TeMerc's response -

Hi noknojon

Yes I made the exclusions shown in the FAQ. I had a laptop last week that had Trend Micro 2009 Pro with MBAM resident but running Vista. I did exactly the same exclusions with it and there were no problems. One thing though with the guide is that I can never seem to find that mbam-dor.exe file to exclude? The rest are all done.

Seems to be easier to get MBAM Pro to work properly with your typical Internet security software on Windows 7 and Vista machines than it is with XP.

[MattsComputers]

Alternatively, as a licensed corporate user, technician, reseller, affiliate or non-profit you have access to the corporate helpdesk, contact them via the email address below.

corporate-support@malwarebytes.org.

Please provide your corporate license information when requesting help.

Thanks TeMerc. I'll do that if I can't resolve the issue.

It's the weekend now but on Monday I'm going to have them disable MBAM resident in safe mode just to be 100% certain that it is the cause. These issues are frustrating when you go for an hour or more without a freeze and you think it's resolved. But then all of a sudden you get several freezes within 10 minutes.

[MattsComputers]

Thanks TeMerc. I'll do that if I can't resolve the issue.

It's the weekend now but on Monday I'm going to have them disable MBAM resident in safe mode just to be 100% certain that it is the cause. These issues are frustrating when you go for an hour or more without a freeze and you think it's resolved. But then all of a sudden you get several freezes within 10 minutes.

A bit of an update to this issue. I did have my client disable the MBAM resident. And this resolved all their lockup issues. It turned out that the lockups were always on startup. When both Trend Micro and MBAM were trying to load initially.

Since this time I have had a few home users also running Trend Micro Internet Security 2010 that I have sold Malwarebytes consumer licenses. As with my business client they are running Windows XP. These also lockup on startup when both Trend and MBAM are trying to load together. After a lot of digging around on these forums I found some very helpful info here about startup delays: http://forums.malwarebytes.org/index.php?showtopic=15456 This allowed me to test various delays and through quite a bit of testing I found a suitable delay that effectively solves the issue. Credit and a big thanks to the posters in that thread.

Now whenever I have been selling and installing MBAM pro with Trend Internet Security is running the following registry fix. To casue a delay for MBAMGUI. I still make all exclusions as per the guide of course as well as the delay.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes' Anti-Malware]

"delayguistart"=dword:b4

This is for Trend Micro Internet Security or Internet Security Pro users on XP. Vista and Win 7 do not need the delay. Hope this helps anyone else that may be struggling with the same issue.

I do not know is relevant for the new 2011 products. Now called Titanium and Maximum Security. I have noticed that installing either of these insists on the removal of MalwareBytes before they will install.

[Haider]

One thing though with the guide is that I can never seem to find that mbam-dor.exe file to exclude?

mbam-dor.exe??? never heard is it a typo?

[noknojon]

I do not know is relevant for the new 2011 products. Now called Titanium and Maximum Security. I have noticed that installing either of these insists on the removal of MalwareBytes before they will install.

The removal of several security programs is asked by several A/V 2011 editions now - CA security has done this for a while -

The idea is that you un-install MBAM , install your new A/V and then re-install MBAM , with exclusions added to trusted areas -

Some of this is due to the A/V companies adding in-built firewalls etc. and addind their own anti-malware engines -

In some A/V programs you need to turn off the firewall section , or add extra exclusions to the firewall area (as per our usual exclusions) -

If you do not have a full list of these , please ask for them -

Also Member yardbird runs (or has run) Trend for several years , so I can always check with him for you -

Thank You -

[yardbird]

mbam-dor.exe??? never heard is it a typo?

Its not a typo, it was a file of an early version of mbam. Consult the staff please for any issues with it. regards. you will note it was in the screenshots below:

http://forums.malwarebytes.org/index.php?s...mp;#entry162099 regards....

[yardbird]

The removal of several security programs is asked by several A/V 2011 editions now - CA security has done this for a while -

The idea is that you un-install MBAM , install your new A/V and then re-install MBAM , with exclusions added to trusted areas -

Some of this is due to the A/V companies adding in-built firewalls etc. and addind their own anti-malware engines -

In some A/V programs you need to turn off the firewall section , or add extra exclusions to the firewall area (as per our usual exclusions) -

If you do not have a full list of these , please ask for them -

Also Member yardbird runs (or has run) Trend for several years , so I can always check with him for you -

Thank You -

Yep! I have been using Trend Micro Internet Security 2008 & 2009. Now using Trend Micro Titanium 2010. Lots of work went into the files to be trusted by MBAM/TM. The screenshots are from 2009. I had lots of help from swandog46, exile360, and I had to send the shots to AdvancedSetup to be posted. I enjoyed the teamwork. The end result is TM & MBAM now work together! TM still does not believe we did it..regards...

[Haider]

Its not a typo, it was a file of an early version of mbam. Consult the staff please for any issues with it. regards. you will note it was in the screenshots below:

http://forums.malwarebytes.org/index.php?s...mp;#entry162099 regards....

yardbird:

I really appreciate your pointer, it was all my fault I haven't used the older versions, I believe I am with MBAM since v1.44. My apologies to MattsComputers too, with a suggestion to upgrade it to the latest version

[MattsComputers]

Yep! I have been using Trend Micro Internet Security 2008 & 2009. Now using Trend Micro Titanium 2010. Lots of work went into the files to be trusted by MBAM/TM. The screenshots are from 2009. I had lots of help from swandog46, exile360, and I had to send the shots to AdvancedSetup to be posted. I enjoyed the teamwork. The end result is TM & MBAM now work together! TM still does not believe we did it..regards...

Thanks Yardbird! That's good to know that the latest Trend 2011 can also be made compatible. I have been using the exclusions for a long time when I found the info here on the forums by googling. These have been very helpful and I really appreciate your efforts and everyone else involved. It was a couple of years back and I was working on a system running Trend 2009 that I was trying to clean malware from and MBAM kept dissapearing during the scan. It sure had me puzzled for quite a while!

Can I ask did you ever experience the issue with the freezing on startup? Or are you running Vista or Windows 7? Also do you know if you do an upgrade to 2011 are the exclusions retained in Trend? I assume it's going to be basicly the same process to set them up again anyway.

yardbird:

I really appreciate your pointer, it was all my fault I haven't used the older versions, I believe I am with MBAM since v1.44. My apologies to MattsComputers too, with a suggestion to upgrade it to the latest version

No problem Sir! Interestingly I was only working on another system today. Must have been an old version of MBAM on it and I noticed the mbam-dor.exe was there.

[yardbird]

yardbird:

I really appreciate your pointer, it was all my fault I haven't used the older versions, I believe I am with MBAM since v1.44. My apologies to MattsComputers too, with a suggestion to upgrade it to the latest version

No Problem at all Haider, I was a little crankey last night, will PM you.

[AdvancedSetup]

The file mbam-dor.exe is no longer used. A clean removal process should remove the file as well as provide opportunity to setup file exclusions which may be required for an updated AV product.

Windows XP:

• Click on Start and select Control Panel
  
• Open Add/Remove Programs
  
• Uninstall Malwarebytes' Anti-Malware
  
• Restart your computer very important
  
• Download and run mbam-clean.exe from here
  
• It will ask to restart your computer, please allow it to do so very important
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here
  
  • Note: You will need to reactivate the program using the license you were sent via email if using the Pro version
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the Pro version. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or post to ask and we'll explain how to do it.
    

Windows Vista and Windows 7:

• Click on the Start button and select Control Panel
  
• Click on Programs and Features
  
• Uninstall Malwarebytes' Anti-Malware
  
• Restart your computer very important
  
• Download and run mbam-clean.exe from here
  
• It will ask to restart your computer, please allow it to do so very important
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here
  
  • Note: You will need to reactivate the program using the license you were sent via email if using the Pro version
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the Pro version. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or post to ask and we'll explain how to do it.
    

[Firefox]

@ advancedsetup

is the file zlib.dll also no longer used?

in XP

C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll

in vista and win7

C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll

in Vista and Win7 64bit

C:\Program Files (x86)\Malwarebytes' Anti-Malware\zlib.dll

[Haider]

Sorry Firefox: Though this isn't addressed to me, and I didn't completely understand your question, however, in my Windows XP Professional SP3 I do have Program Files\Malwarebytes' Anti-Malware\zlib.dll (labeled 1.2.3.0 zlib data compression library)

[Firefox]

NP Haider, I have several computers running it and I do have one laptop running the free version that has that file, but I have a couple that do not, I am wondering if I ran the mbam-clean tool, if it removed that file and then on a fresh install maybe it does not use it any longer, thats why I am asking....

[AdvancedSetup]

I'm sorry but picking apart which files do what will not be discussed in detail. A clean removal and reinstall will only install files used.

Thanks

[Firefox]

Well understood, I was only asking because of the canned speaches that we give for excluding files in AV programs, but no worries will leave them as is.