Kay Posted October 4, 2008 ID:29733 Share Posted October 4, 2008 Hi,I just ran a McAfee scan and the program quarantined the following: " C:\PROGRAMFILES\MALWAREBYTES'ANTI-MALWARE\MBAM-DOR.EXE" as a trojan. I'm assuming this is incorrect.Kay Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 4, 2008 Root Admin ID:29735 Share Posted October 4, 2008 Yes it is a False Positive. Thank you for your feedback and McAfee has been contacted about it. Link to post Share on other sites More sharing options...
Kay Posted October 4, 2008 Author ID:29742 Share Posted October 4, 2008 Yes it is a False Positive. Thank you for your feedback and McAfee has been contacted about it.Thanks for the quick response re: McAfee. Out of curiosity, I ran MBAM in the developer mode and nothing was detected but there was an error msg: "SwissArmy failed to initialize, error code:0Kay Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 4, 2008 Root Admin ID:29746 Share Posted October 4, 2008 I've not heard of that error before and a quick Google search did not bring up anything promising.I'm sure one of the Developers will be along within a day or two and if they have an answer they will respond here.Is there anything running on your system that would lead you to think that you might be infected? IF so then you may want to open a new log in the HJT forum and we can take a look further. Link to post Share on other sites More sharing options...
GT500 Posted October 5, 2008 ID:29785 Share Posted October 5, 2008 Thanks for the quick response re: McAfee. Out of curiosity, I ran MBAM in the developer mode and nothing was detected but there was an error msg: "SwissArmy failed to initialize, error code:0SwissArmy is the name for the driver Malwarebytes uses to do Direct Disk Access (DDA). That error message means that the driver could not load. This normally happens on x64 versions of Windows (Malwarebytes drivers are not compatible with x64 editions of Windows).Are you running an x64 edition of Windows? Link to post Share on other sites More sharing options...
elero Posted October 5, 2008 ID:29796 Share Posted October 5, 2008 SwissArmy is the name for the driver Malwarebytes uses to do Direct Disk Access (DDA).I thought MBAM has no DDA functionality? Is it new? Link to post Share on other sites More sharing options...
blue Posted October 5, 2008 ID:29812 Share Posted October 5, 2008 hi just got the samething today when run my scanner with mcafee this is the first time i have had this prob it driving me nuts Link to post Share on other sites More sharing options...
sho-dan Posted October 5, 2008 ID:29815 Share Posted October 5, 2008 Yes it is a False Positive. Thank you for your feedback and McAfee has been contacted about it.This is also found C:\Program Files\...\mbam-dor.exe Generic.dx, using the Link to post Share on other sites More sharing options...
JeanInMontana Posted October 5, 2008 ID:29822 Share Posted October 5, 2008 I thought MBAM has no DDA functionality? Is it new? Yes it is new. Cool 'eh? Link to post Share on other sites More sharing options...
GT500 Posted October 5, 2008 ID:29824 Share Posted October 5, 2008 Yes it is new. Cool 'eh?I thought we'd had it for a few months. It seems like it's been forever since I beta tested it. Link to post Share on other sites More sharing options...
VirusPING Posted October 5, 2008 ID:29838 Share Posted October 5, 2008 actaully Bitdefender detected the file it Created when i ran it. It does not recognize the file itself. Can anyone explain? Link to post Share on other sites More sharing options...
GT500 Posted October 5, 2008 ID:29847 Share Posted October 5, 2008 VirusPING, I think you replied to the wrong topic... Link to post Share on other sites More sharing options...
DaChew Posted October 5, 2008 ID:29849 Share Posted October 5, 2008 VirusPING, I think you replied to the wrong topic...he may be having a similar problem with bitdefenderhttp://www.malwarebytes.org/forums/index.p...amp;#entry29836 Link to post Share on other sites More sharing options...
Kay Posted October 6, 2008 Author ID:29886 Share Posted October 6, 2008 SwissArmy is the name for the driver Malwarebytes uses to do Direct Disk Access (DDA). That error message means that the driver could not load. This normally happens on x64 versions of Windows (Malwarebytes drivers are not compatible with x64 editions of Windows).Are you running an x64 edition of Windows?No, I have Vista 32 bit OS. This message only pops up when I run MBAM in the developer mode. It does not show up when I run a regular scan. The program seems to be working OK with the updates and quick scans. Kay Link to post Share on other sites More sharing options...
GT500 Posted October 6, 2008 ID:29887 Share Posted October 6, 2008 No, I have Vista 32 bit OS. This message only pops up when I run MBAM in the developer mode. It does not show up when I run a regular scan. The program seems to be working OK with the updates and quick scans. KayYou should not get that error in 32-bit Vista, even in Developer mode. We may need to have Marcin take a look at this one.Try uninstalling Malwarebytes' Anti-Malware, then reboot, and then download and reinstall the latest version. Link to post Share on other sites More sharing options...
Kay Posted October 6, 2008 Author ID:29935 Share Posted October 6, 2008 You should not get that error in 32-bit Vista, even in Developer mode. We may need to have Marcin take a look at this one.Try uninstalling Malwarebytes' Anti-Malware, then reboot, and then download and reinstall the latest version.Hi,I uninstalled MBAM and attempted to reinstall; but McAfee blocked the installation. So I totally disabled McAfee (firewall and AV) and was then able to reinstall MBAM. However, I question that MBAM was completely uninstalled because my previous logs were still listed and I did not have to re-enter my key code. The regular quick scan ran OK but the Developer mode still has the message pop up re: SwissArmy.KayI forgot to reboot; so I will try the process again and let you know the results. Link to post Share on other sites More sharing options...
Kay Posted October 6, 2008 Author ID:29938 Share Posted October 6, 2008 The first time I uninstalled MBAM, I was not asked to restart the computer. This time I was asked to restart the computer after uninstalling MBAM; I had toally disabled McAfee and had no problems reinstalling; however. the log and keycode are still there. I reactivated McAfee and ran MBAM in the regular mode and developer mode and the SwissArmy message still pops up at the beginning of the developer mode scan.Kay Link to post Share on other sites More sharing options...
GT500 Posted October 6, 2008 ID:29948 Share Posted October 6, 2008 The first time I uninstalled MBAM, I was not asked to restart the computer. This time I was asked to restart the computer after uninstalling MBAM; I had toally disabled McAfee and had no problems reinstalling; however. the log and keycode are still there. I reactivated McAfee and ran MBAM in the regular mode and developer mode and the SwissArmy message still pops up at the beginning of the developer mode scan.KayI'll ask Marcin about this. This could just be McAfee supressing the Swiss Army driver... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 6, 2008 Root Admin ID:29954 Share Posted October 6, 2008 Yes I'm pretty sure McAfee is still blocking it. Marcin needs to contact McAfee again about it and get them to white list it. Link to post Share on other sites More sharing options...
Raid Posted October 7, 2008 ID:30013 Share Posted October 7, 2008 I'll ask Marcin about this. This could just be McAfee supressing the Swiss Army driver...I can confirm Mcafee is supressing our driver. Which disables DDA and a few others...Essentially, Mcafee is crippling our software. Link to post Share on other sites More sharing options...
Raid Posted October 7, 2008 ID:30014 Share Posted October 7, 2008 Hi,I uninstalled MBAM and attempted to reinstall; but McAfee blocked the installation. So I totally disabled McAfee (firewall and AV) and was then able to reinstall MBAM. However, I question that MBAM was completely uninstalled because my previous logs were still listed and I did not have to re-enter my key code. The regular quick scan ran OK but the Developer mode still has the message pop up re: SwissArmy.KayI forgot to reboot; so I will try the process again and let you know the results.Your key-code is stored in the registry. Your logs are stored in the application data folder, and wouldn't normally be deleted if you just uninstalled. Link to post Share on other sites More sharing options...
Raid Posted October 7, 2008 ID:30015 Share Posted October 7, 2008 No, I have Vista 32 bit OS. This message only pops up when I run MBAM in the developer mode. It does not show up when I run a regular scan. The program seems to be working OK with the updates and quick scans. KayHi Kay.When mbam is running in developer mode, if it has an issue, such as driver loading failure, it will report it. When not running in developer mode, such errors are surpressed and MBAM will fall back to API calls.This has drawbacks. Without swissarmy being able to load, MBAM loses some detection abilities, with non static named rootkits, and it also looses the ability to break a files header on the fly to kill it. Things may appear to be okay, but without our drivers, mbam is crippled and has been hindered.If at all possible, You should get the file out of quarantine, and tell mcafee to ignore it in the future. It's very important for mbam to have access to it's drivers. It allows us to bypass the tricks rootkits use to hide. Link to post Share on other sites More sharing options...
nosirrah Posted October 7, 2008 ID:30016 Share Posted October 7, 2008 The Mcafee issues are shocking given how often we save their butts on their support forums . Best I can tell we are either cleanup tool 1 or 2 in most Mcafee HJT threads . Link to post Share on other sites More sharing options...
GT500 Posted October 7, 2008 ID:30042 Share Posted October 7, 2008 The Mcafee issues are shocking given how often we save their butts on their support forums . Best I can tell we are either cleanup tool 1 or 2 in most Mcafee HJT threads .I'm not surprised. McAfee has been worthless for years, and it's fairly obvious that they aren't getting better because of bad management. It seems like everyone that tries to work with them winds up getting hurt by them... Link to post Share on other sites More sharing options...
Kay Posted October 7, 2008 Author ID:30046 Share Posted October 7, 2008 If at all possible, You should get the file out of quarantine, and tell mcafee to ignore it in the future. It's very important for mbam to have access to it's drivers. It allows us to bypass the tricks rootkits use to hide.Thanks, I already removed it from quarantine and will have to figure out how to have McAfee ignore the file. Failing that, since McAfee is a freebee from my IP, I can change to another AV and firewall.Kay Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now