More than one user

[cypriana]

Hi

The laptop I use has two users, myself and my wife, and Malwarebytes is installed on both sections. What I would like to know is do I/we have to run MWB on each section, or if I run it as administrator will it scan both sections at the same time.

Thanks,

cypriana.

[1PW]

Hi

The laptop I use has two users, myself and my wife, and Malwarebytes is installed on both sections. What I would like to know is do I/we have to run MWB on each section, or if I run it as administrator will it scan both sections at the same time.

Thanks,

cypriana.

Hello cypriana:

MBAM should usually be run from the Administrator's account and therefore all files and partitions can be scanned.

[Firefox]

Just to add to what 1PW has posted....

Yes Malwarebytes should be run as an Administrator so that it can scan all files and profiles as well. If something is detected, it will remove the files and the entries from the registry as well.

It will however need to be run as the other user as well. (run as admin if the other user is a limited account). This will ensure that all registry items for that user get removed as well.

The first scan with the first user will get all the files that will prevent the computer from getting infected again when you log in as the second user, but the registry for the second user can not be cleaned unless you are logged in as that user. This is only because the registry for the second user does not get loaded until the user logs on.

Hope that makes sense....

[MWPollard]

Unfortunately, the agent does not seem to run as admin, even though it's startup is in Local_Machine. Either it's not running as an admin or it's spinoff tasks aren't. This means that scheduled updates and scheduled scans all fail.

[exile360]

MBAMService, which handles scheduled updates and scans runs with SYSTEM privileges (that's higher than admin) so scheduled updates and scans will run with the necessary privileges, however, for scans you will need to use the option Perform scheduled scan silently from system account.

[MWPollard]

If the Agent runs as System for updates, please give some suggestions why it's not sucessfully updating on a new-install Win7 x64 system.

Installed and registered as Admin user, but normal user is Standard. Agent says it's updating but the ref file is from when I last did a manual update when run as admin. A manual update from the Agent returns Access Denied.

[cypriana]

Thanks 1PW and Firefox for your replies.

If I understand it correctly what you are saying is, if both users are logged on, and then if I scan as administator, the scan will cover both registry sections etc, removing the need for separate scans.?

cypriana

Windows 7 64 bit

[exile360]

If the Agent runs as System for updates, please give some suggestions why it's not sucessfully updating on a new-install Win7 x64 system.

Installed and registered as Admin user, but normal user is Standard. Agent says it's updating but the ref file is from when I last did a manual update when run as admin. A manual update from the Agent returns Access Denied.

Hello again, I'll clarify a bit. The word "Agent" in this instance needs to be defined a bit more clearly I think. The user interface/process for the tray icon of Malwarebytes' Anti-Malware is mbamgui.exe, this is the front end for the protection module and runs in user mode (i.e., limited privileges). mbamservice.exe is the system level service that executes scheduled items. Items scheduled from an administrative user account should execute under all user accounts but for full removal of threats, a scan should be scheduled to run silently from the system account if you're using limited/standard user accounts on your setup. mbam.exe is the scanner, it executes with the highest level of privileges allowed by the current user account. So for an admin account, it requests administrative privileges, allowing it to update, for a limited/standard account, it only requests the limited privileges that those types of accounts have so it would not be able to update unless executed with administrative privileges.

As for the registry hives, that is correct. It does not scan offline registry hives or the registry hives of other user accounts, only HKCU for the current user, so after threat removal from an admin account, you can log into your other accounts and run a scan to look for traces that may have been left under HKCU for those accounts (this will not require admin privileges, since HKCU can be read/modified with normal user privileges).