MBAM updating on XP Pro x64 crash

[noknojon]

Noknojon,

Microsoft does support XP SP2 64 bit as there is no SP3 for XP 64 bit.

http://windows.microsoft.com/en-US/windows...t-service-packs

Thank you for that - Posts crossed as I linked to the fact that XP 64-bit is not supported any more (not for some time) -

This meant you could not have a SP 3 update available - Ever thought of updating ?? Not to Vista as some support also ends soon - (Typical)

But you can update to Win 7 64-bit easily , as far as I am aware - This would solve many current problems with M/$oft support -

As you have already mentioned - Just throwing ideas in the wind

Regards -

If you

[shadowwar]

The termsrv.dll detection could possibly be related to this. I would have support or malware removal forum give your system a through going through to make sure there is no malware present.

A run of sigverif may be a good option also to make sure no files are replaced.

[Firefox]

I do not believe that you can upgrade from XP to windows 7 directly....

You either have to format and do a fresh install or....

You have to upgrade to vista first then upgrade to windows 7.

I thought I read that someplace but can not remember where.

Microsoft has instructions on how you can do it but its basically a clean install take a look RIGHT HERE

[DarkSnakeKobra]

Hello Jim-1:

All of the above mentioned support Windows XP 64-bit. I am unsure how could you single out that the problem is with "MBAM updates after 10/15/10 crash on XP Pro x64", we would like to hear how you have isolated this problem i.e. this isn't AVG2011 or its updates

I would also suggest you to read AVG 2011 Free vs. Malwarebytes and AVG 2011 Resident Shield - File Exclude List Feature Removed! both from AVG Official Forums

Please post back using button

MSE does not support Xp 64 bit only 32 bit. The major issue with xp 64 bit is most security vendors don't support it.

@Firefox

Yes you have to upgrade to vista then 7 for xp. There is no jumping allowed.

[Haider]

Thank you Buttons for correction, and I apologize Jim-1

No one here is a Rocket Scientist either. Same is the case here I am an engineer too. I do agree all changes must be considered while troubleshooting. AVG also updated its definition didn

[YoKenny1]

I chose a clean install of Windows 7.

By the way

Happy First Birthday, Windows 7

5:00 AM - October 22, 2010 by Marcus Yam

Windows 7 Sells 240 Million Licenses in 1 Year

It was a year ago that Microsoft released Windows 7, which many users and critics felt was the best version of Windows since XP.

Surely, Microsoft took a lot of feedback from those who weren't pleased with what Vista brought and changed Windows 7 to be a bit more friendly to

[Firefox]

@Firefox

Yes you have to upgrade to vista then 7 for xp. There is no jumping allowed.

Yes Sir I am aware of that I was just commenting on that since someone mentioned he should upgrade....

[DarkSnakeKobra]

Yes Sir I am aware of that I was just commenting on that since someone mentioned he should upgrade....

Gotcha.

@Haider

You're welcome.

If you have a 32 bit disc of Xp you might consider doing a clean install.

[Jim-1]

Well, MBAM tech support ran me through four different anti virus programs, but he couldn't find a problem. Now it looks like MBAM tech support has given up on my problem. Seems like there isn't much interest at MBAM since I am the only user who is complaining.

Is anyone out there still running XP Pro x64 and MBAM?

Until someone actually says he is using XP Pro x64 and that he has no problem with MBAM, my interpretation is that 100% of us users have had this problem since the 10/16/10 update. Can any of you please contact the MBAM software staff? It would be great if they could take a few minutes to put the 10/15/10 (or earlier) rules.ref update on the left side of their screen (I can email a copy to them if they want) and the 10/16/10 (or more recent) update on the right side of the screen. They could call the older one on the left "Good" and the newer one on the right "Evil" Then they could look through the updates line by line to see what significant change was made on 10/16/10. Since the older updates all work flawlessly, but the newer updates all crash MBAM with a database error on my system, I am convinced that something was done to the rules.ref updates after 10/15/10, and that an unintended consequence of that change is that all the users with a system profile like mine can no longer run MBAM with updated rules.ref.

Any help would be much appreciated.

[nosirrah]

The datebase exists in 2 states, able to be opened and unable to be opened, this is OS independent. If the current database was corrupt 100% of users would not be able to open it.

[shadowwar]

One more thing you can try is to copy an updated database known working from another computer and see if it still crashes.

[Haider]

Until someone actually says he is using XP Pro x64 and that he has no problem with MBAM, my interpretation is that 100% of us users have had this problem since the 10/16/10 update

Nobody will, until they have a problem. Prior to posting this on Oct 19 2010, 07:31 PM, did you post "everything with MBAM is working OK"? Please also see Post #30

[Jim-1]

Is anyone out there still running XP Pro x64 and MBAM?

Until someone actually says he is using XP Pro x64 and that he has no problem with MBAM, my interpretation is that 100% of us users have had this problem since the 10/16/10 update.

Nobody will, until they have a problem. Prior to posting this on Oct 19 2010, 07:31 PM, did you post "everything with MBAM is working OK"? Please also see Post #30

My experience with other forums is that there are an abundance of people who are eager for an opportunity to tell me that I don't know what I am talking about. If someone who is running XP pro x64 and who is having no problems with MBAM, then I am confident that he will quickly tell me I am barking up the wrong tree.

I think my previous reply responded to your post #30. If there is something I did not respond to, please say it again. Thanks.

[noknojon]

Hi Jim -

I noticed 1 or 2 on the board with XP x64 (not 100% sure about Pro version) -

I will look back for you -

Thanks for staying with us -

[Haider]

Hello Jim-1:

If there is something I did not respond to, please say it again

Here you go...

AVG also updated its definition didn

[Jim-1]

I do agree all changes must be considered while troubleshooting. AVG also updated its definition didn

[nosirrah]

Since I am directly involved with development and you are not, it seems the wrong person is sure here.

The database is compressed, it needs to be opened and the contents read. Your error is prior to reading so contents have been eliminated by the very nature of the error.

Again, it can or cannot be opened. The only 2 ways this can fail is broken database (everyone is affected) and error opening (only those with malware or system errors are affected).

Please note that there are not others with XP 64 bit joining this thread with the same error.

[shadowwar]

I confirmed this does work on XP 64 bit. See screenshot attached.

Have you tried what i said about copying a current database over to your computer manually so we can eliminate wether the download on your end is getting corrupted?

Also have you tried doing a manual update using our package?

http://data.mbamupdates.com/tools/mbam-rules.exe

[Jim-1]

Mods: Please change the title of this thread to MBAM updates on XP Pro x64 to better reflect the problem and the solutions offered.

Shadowwar, please accept my thanks for dragging me toward the solution of this problem.

I confirmed this does work on XP 64 bit. See screenshot attached.

Have you tried what i said about copying a current database over to your computer manually so we can eliminate wether the download on your end is getting corrupted?

I previously tried a copy of rules.ref sent to me as an email attachment by tech support and it also failed, so I did not think downloading the rules.ref file a different way would work any better. However, I wanted to cover my bases and I did use a different computer to update MBAM today. After I copied that new rules.ref into this computer, MBAM updated with no problem. As another test, I then used MBAM to update the same version of rules.ref into this computer, but MBAM crashed with the database error again. Restoring the copy of rules.ref that I downloaded on a different computer returned MBAM to normal operation. I looked at the properties of the good rules.ref (that I downloaded on a different computer) and the bad rules.ref (that I obtained by MBAM update on this computer, but both look the same so far as I can see. The screenshots for both files are copied below.

The good rules.ref properties is on the left side below. - - - - - The bad rules.ref properties is on the right side below.

- -

It seems clear that there must be a problem with the way that rules.ref downloads onto my computer now that was not a problem a few weeks ago. The only changes to my computer that I can think of are a switch from IE8 to Google Chrome browser, a major Windows Update, and installation of AVG 2011. Other files and software programs seem to download without problem, but something is obstructing MBAM from properly updating by direct download. To respond to those who continue to think an infection might be the cause of this problem, let me add that I completed a full scan with Dr.Web Cureit, a cleaning process with TFC, and full scans with ESET and Panda Active Scan as guided by tech support, but there was no significant problem detected. I will continue to look into the file downloading problem on my computer. Thanks to all for the help that you have provided.

Also have you tried doing a manual update using our package?

http://data.mbamupdates.com/tools/mbam-rules.exe

I have not yet tried the manual update process. I will try that later after I find a better description of what to do and what to expect. Thanks again Shadowwar!

.

[shadowwar]

You just download that file and run it. It will update automatically. Its usually a few days behind. This isn't a solution but a test.

Also do you know how to calculate a MD5?

Here is a simple program too.

http://download.cnet.com/MD5-Checker/3000-...mendedDownloads

This will make a fingerprint checksum of the file and tell us if there is any difference between the good and the bad one. ]

Please post a fingerprint from two identical database versions if possible one that works and one that doesnt.

Also i did try avg 2011 and outpost and still was able to update fine. I did add the exclusions though.

[Jim-1]

This will make a fingerprint checksum of the file and tell us if there is any difference between the good and the bad one. ]

Please post a fingerprint from two identical database versions if possible one that works and one that doesnt.

I downloaded the checksum program, and captured the checksum (md5 = 121A2F4DA2BA1C4BF33370DA08D2E558) of the good rules.ref. Since I had already overwritten the earlier bad rules.ref, I clicked Update in MABM and downloaded a new rules.ref, which immediately crashed in the database error. That new bad rules.ref is obviously different than the previous bad rules.ref, as shown by the properties below, so no need for a checksum calculator.

Download of bad rules 2b.ref (md5 = 3F4A4EBEB26DF4858DD4EA0F4336E80E):

I tried to download another time to get a different rules.ref for comparison, but after I replaced the bad rules.ref with a good one (either 10/26 or 10/15), MBAM insisted that my files were up to date and it would not download another. I resorted to deleting the rules.ref, so MBAM offered to download another database. Here are the results of downloads 2c, 2d, and 2e. The md5 checksum of each is different, even though the file size is the same. I also briefly tested my file download integrity by comparing the md5 of the md5.exe contained within the md5.zip, and it exactly matched the published md5, so that download worked OK. Here are the results for the last three test downloads of rules.ref tonight:

Download of bad rules 2c.ref (md5 = DD99D726FBD44E5655C1054B243227C1):

Download of bad rules 2d.ref (md5 = 56035A0604E7E5394D15B76C1C719537):

Download of bad rules 2e.ref (md5 = 22679A275C5DFD8BF28E37BE43DCEDF9):

.

[DaChew]

Regarding AVG 2011

http://free.avg.com/ww-en/download.prd-afh

Look at the dates

http://forums.avg.com/gb-en/avg-free-forum...w&id=110317

[shadowwar]

Ok its definitely getting corrupted for some reason.

can you try step 3 in this post.

Also please run the tracert regardless of the ping.

Don't try the other steps yet.

http://forums.malwarebytes.org/index.php?s...st&p=218393

Note: that sometimes happens when replacing rules.ref that it still says you have the current version. This is not normally recommended for this and other reasons but we didn't have a choice for troubleshooting purposes

Also please follow Ron's instruction Below.

[AdvancedSetup]

Please download the following rules update program. It will update your rules to version 4957

Check the MD5 hash of each file please before running them.

MD5 base 16 Hash for file 4957rules.rar

C9FB4FBC0618BAB82E32BB4B214F9219

MD5 base 16 Hash for file 4957.exe included inside 4957rules.rar archive

D4D27284A6EE9450635C6EB3925189CE

Also please run the following and post back the results

Provide System Specifications:

• Please download Speccy from here and save the installer to your desktop or another location where you can easily find it.
  
• Double-click the file to begin installation and follow the onscreen steps to complete the installation and make sure that the checkbox next to Run Speccy is checked before you click on Finish at the end.
  
• Once the program starts it will analyze your system, please be patient as it may take a few moments to complete.
  
• Once it finishes and none of the areas say Analyzing click on the File button at the top and select Save Snapshot...
  
• Save the file to your desktop and click Ok to confirm
  
• Go to your desktop and right click on the file you just created and hover over Send to and select Compressed (zipped) Folder
  
• Please attach the zip file you just created to your next post
  

[Jim-1]

can you try step 3 in this post.

Also please run the tracert regardless of the ping.

Here are the results of five attempts at ping. I also tried to Start -> Run TRACERT mbam-cdn.malwarebytes.org, but nothing happened that I can see.

Thanks again for the help with this problem.

.