PunkBuster / BC2

[Kaldari]

I've enjoyed MWB Pro for a while now, but I've run into a deal-breaker.

Bad Company 2 uses PunkBuster as an anti-cheat. "PnkbstrA.exe" and "PnkbstrB.exe" run as services, but the real-time protection of Pro both stops and deletes the PunkbstrA.exe service and blocks port 8 that PnkbstrB.exe tries to communicate through. This results in me being booted a short time after joining servers. I have to uninstall and reinstall Punkbuster to get PnkbstrA.exe back as a service.

It didn't used to do this, but I guess this last major patch that came out recently changed something to cause the heuristics or something to trigger.

Is there a way to make service exceptions to prevent this? I technically could turn MWB on and off each time I play, but that is a bit of a pain and shouldn't be necessary in my opinion.

Thanks.

[shadowwar]

Could you please follow the instructions here:

http://forums.malwarebytes.org/index.php?showtopic=3228

also can you attach the file that gets deleted and some logs so we can try to look at this and fix it?

Thanks.

These can be added to the ignore list but they shouldnt get deleted if they are a valid part of the program. Please attach the files and logs and we will see about getting this fixed right away.

[Kaldari]

Nothing is detected on a manual scan. The real-time protection "catches" it once I actually join a server and Punkbuster tries to work. All I can provide is the PnkBstrA.exe and my log from yesterday, when I was trying to figure out what the problem was.

PnkBstrA.exe normally resides in both C:\Windows\SysWOW64 and C:\Users\User\AppData\Local\BC2\pb. I know the SysWOW64 exe gets deleted, but I believe the other does too. That, and the service gets stopped and deleted, as I said.

You'll see in my log where it was also catching the Java thing before I updated my database yesterday. My problem still occurs after I updated though.

punk.zip

[nosirrah]

20:56:49 Ryan DETECTION C:\Program Files (x86)\Java\jre6\bin\java.exe

This was fixed already I believe. To verify this please zip and attach java.exe to your next post.

[Kaldari]

This was fixed already I believe. To verify this please zip and attach java.exe to your next post.

Yes, the java thing isn't triggering anymore. I just mentioned it because I wanted to point at that I had updated my database since then, since it was listed in the log file, and the PnkBstrA thing is still occurring.

[shadowwar]

Well i can find nothing that jumps out in the database that should be hitting. I would really need to see a log of this hitting. The log you posted doesnt show us hitting it and there would normally be a few more more posts if it was us.

[king kaos]

MBAM still blocks punkbuster on my computers, what i did was put the punkbusterA and pnkbusterB into MBAM's ignore list. works for me. also you can disable website protection when you use punkbuster services with your games. but this is my opinion

[shadowwar]

Can you post a log showing the block please? Is this just an ip block or is it attaching the files?