37 replies to this topic

[homes32]

File Name: Malwarebytes' Anti-Malware
File Submitter: homes32
File Submitted: 15 Aug 2011
File Updated: 04 Jan 2012
File Category: App scripts

Malwarebytes' Anti-malware is an easy-to-use, simple, and effective anti-malware application. Free for personal use.

Warning: Because of the nature of the scanning engine Malwarebytes' is not as effective in a PE environment and may generate false positives or not detect everything. This script should only be used in situations where the machine is not bootable or is so infected that Malwarebytes' will not install/run. USE AT YOUR OWN RISK!

Script Features:

• Automatically downloads latest version
• Automatically update definitions at build time
• Multi-language support

**************************************************
READ THIS BEFORE POSTING!!!!!!!!
**************************************************

Known Issues:

• Definitions updated at build time appear as missing or corrupt in PE [See This Post] and [this post]

Sorry, This script does not support XP based projects at this time and probably won't until the Malwarebytes's team rewrite their program.

Click here to download this file

[mbushnell]

homes32,
Hello and I hope you are doing well. I have finally got my Win7PE_SE working good with several apps, with the exception of MBAM. It was working when I first started like over a month ago. But I try today after getting Checkpoint to work, and I keep getting this error:
an error has occurred. Please report this error code to our support team.
Program_error_load_resource(0,53)

I have searched on this and found several items, but all relating to true installations with in windows OS, not PE. I am hoping that you can assist me so I can get this working again.

Thanks in advance.
Matt

[homes32]

probably a corrupt file. try pressing the "purge cache" button and rebuilding.
if the issue is still there post a build log.

[neovanmatix]

Hi,

i'm getting following error:
WebGet - [http://data.mbamupda.../version.check] to directory: [%BaseDir%WorkbenchCommonMalwarebytes' Anti-MalwareCurrentDefs.dat] HTTP/1.1 404 Not Found

Is it an temporary offline Server, or has the serveraddress changed?

regards,

Update: I sniffed my tcp traffic with wireshark; it seems that there's a new updatecheck-url: http://data-cdn.mbam...e/version.check
I will update your script and test it.

Update 2: Works with the new url posted in the first update.

Edited by neovanmatix, 27 December 2011 - 03:44 PM.

[homes32]

Hi,

i'm getting following error:
WebGet - [http://data.mbamupda.../version.check] to directory: [%BaseDir%WorkbenchCommonMalwarebytes' Anti-MalwareCurrentDefs.dat] HTTP/1.1 404 Not Found

Is it an temporary offline Server, or has the serveraddress changed?

regards,

Update: I sniffed my tcp traffic with wireshark; it seems that there's a new updatecheck-url: http://data-cdn.mbam...e/version.check
I will update your script and test it.

Update 2: Works with the new url posted in the first update.

updated. the def download URL also changed but everything is good now! well, at least until they release 1.6
thanks for the report!

[joedirt1954]

updated. the def download URL also changed but everything is good now! well, at least until they release 1.6
thanks for the report!

Version 1.6 is out now and I am sad to say this great script does not work. The version checker will not work either because the format was changed to v2011.12.27.05, basically the date of when you updated. homes32 if you can find the time to update your great script I am sure many members would greatly appreciate it.

Thank You

[joedirt1954]

homes32:

Thanks for the updated script, this is a life saver that has cleaned quite a few PCs for me

[joedirt1954]

I just tried the new script and got the following error:

FileRename - Failed to rename file: [%BaseDir%TargetWin7PE_SEProgramsMalwarebytes' Anti-Malwarembam-filter-32.sys] to:[%BaseDir%TargetWin7PE_SEWindowsSystem32driversmbam.sys] :The system cannot find the file specified

I did purge the cache and chose option to download application and reference file. Any thought on what maybe caused the error?

Thank You

[homes32]

damn! that was quick! I started working on an updated script the other day using the beta version of 1.6 so I just have to see what changed between the beta and the release. should be able to update pretty quick though!

Thanks for the updated script, this is a life saver that has cleaned quite a few PCs for me

always nice to hear that my work is useful! thanks

[homes32]

updated for MBAM 1.6

[homes32]

Known issue with Script v11 - MBAM 1.6
when you update the definitions at build time everything works good, but when you run MBAM from inside PE you get a message about the database being missing or corrupt
this is caused by a change in the malwarebytes looks for the definitions. there is a new file:
C:ProgramDataMalwarebytesMalwarebytes' Anti-MalwareConfigurationdatabase.conf
that mbam looks for to see what the database version is. when you do a normal update from inside the program this file is created/updated by MBAM.
when doing a "manual" update I cannot create/modify this file because it appears to be encrypted.

I see this as a design flaw on the part of malwarebytes. removing the ability to do a manual update is not a good idea. what if the virus breaks the network stack and the only way to update malwarebytes is to on that machine so you can scan and remove the virus is to move definitions over from an uninfected machine?

I welcome any help on working around this issue.

[joedirt1954]

damn! that was quick! I started working on an updated script the other day using the beta version of 1.6 so I just have to see what changed between the beta and the release. should be able to update pretty quick though!


always nice to hear that my work is useful! thanks

Hey you have helped me with other issues so a well deserved Thank You goes a long way.

I actual run Malwarebytes on all of my PCs and saw the update when updating the definition on my test PC.

Another tech needs to work on a invested PC so I wanted to update the image and that is how I came upon the issues.

[neovanmatix]

Hi,

i'm getting the following error on build with the actual mbam-script:
FileRename - Failed to rename file: [%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext,1.dll] to:[%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext.dll] :Eine Datei kann nicht erstellt werden, wenn sie bereits vorhanden ist

I've already purged the cache..

[homes32]

Hi,

i'm getting the following error on build with the actual mbam-script:
FileRename - Failed to rename file: [%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext,1.dll] to:[%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext.dll] :Eine Datei kann nicht erstellt werden, wenn sie bereits vorhanden ist

I've already purged the cache..

that happens when the file already exists. I have uploaded script v11b which should fix the issue for you.

[neovanmatix]

that happens when the file already exists. I have uploaded script v11b which should fix the issue for you.

... updated to the latest version of your script; now on build:
FileDelete - Failed to delete [%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext]: Der Vorgang wurde erfolgreich beendet
(-> like "The process was successfully").
:-/

[homes32]

... updated to the latest version of your script; now on build:
FileDelete - Failed to delete [%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext]: Der Vorgang wurde erfolgreich beendet
(-> like "The process was successfully").
:-/

thats strange. there is no FileDelete commands for removing that file. Please the full log file.

[pscEx]

@Homes32:

Maybe you look intensivelly into your script code.

In one of the above log lines

FileRename - Failed to rename file: [%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext,1.dll]

I saw a rename to 1.dll, which is rather strange for me.
IF I'm wrong, sorry! I just looked into some post, and I did not do any trials.

Peter

[homes32]

@Homes32:

Maybe you look intensivelly into your script code.

In one of the above log lines

I saw a rename to 1.dll, which is rather strange for me.
IF I'm wrong, sorry! I just looked into some post, and I did not do any trials.

Peter

mbam uses the innosetup system. unpacking with innounp.exe results in 2 files:

• mbamext,1.dll --- x86 shell extension
• mbamext,2.dll --- x64 shell extension

it must be renamed to mbamext.dll

If,%SourceArch%,Equal,x64,Begin

  FileCopy,"%GlobalTemplates%%ProgramFolder%{sys}driversmbam,3.sys","%target_win%SysWOW64mbam.sys"

  FileRename,"%Target_prog%%ProgramFolder%mbamext,2.dll","%Target_prog%%ProgramFolder%mbamext.dll"

  If,EXISTFILE,"%Target_prog%%ProgramFolder%mbamext,1.dll",FileDelete,"%Target_prog%%ProgramFolder%mbamext,1.dll"

End

Else,Begin

  FileCopy,"%GlobalTemplates%%ProgramFolder%{sys}driversmbam,2.sys","%target_sys%mbam.sys"

  FileRename,"%Target_prog%%ProgramFolder%mbamext,1.dll","%Target_prog%%ProgramFolder%mbamext.dll"

  If,EXISTFILE,"%Target_prog%%ProgramFolder%mbamext,2.dll",FileDelete,"%Target_prog%%ProgramFolder%mbamext,2.dll"

End

there is no code anywhere in the script to delete mbamext

the only thing I can think of is that perhaps neovanmatix's winbuilder is confused and dispute quotes being around the path is stopping processing at the comma when deleting the "extra" mbamext,#.dll
I need to see his log to be sure though.

regards,
Homes32

[pscEx]

Maybe we have here an until now unknown feature of WinBuilder.

Try to replace the comma by the escape.

Peter

EDIT: OOPS!
Sometimes people like me see facts only on the fifth view!
Delete the eventually present file before rename.

If,EXISTFILE,%Target_prog%%ProgramFolder%mbamext.dll,FileDelete,%Target_prog%%ProgramFolder%mbamext.dll,NOWARN

[homes32]

Maybe we have here an until now unknown feature of WinBuilder.

Try to replace the comma by the escape.

Peter

EDIT: OOPS!
Sometimes people like me see facts only on the fifth view!
Delete the eventually present file before rename.

If,EXISTFILE,%Target_prog%%ProgramFolder%mbamext.dll,FileDelete,%Target_prog%%ProgramFolder%mbamext.dll,NOWARN

that is already done earlier in the script. (script ver 11b)

If,ExistDir,"%Target_prog%%ProgramFolder%",DirDelete,"%Target_prog%%ProgramFolder%"

DirMake,"%Target_prog%%ProgramFolder%"

fixed his original problem but then he got

... updated to the latest version of your script; now on build:
FileDelete - Failed to delete [%BaseDir%TargetWin7PE_SEProgram FilesMalwarebytes' Anti-Malwarembamext]: Der Vorgang wurde erfolgreich beendet

which looks like wb stopped delete on the comma in the file name(after correctly evaluating the file exist statement with the same file name!)
why it only happens to him and not anybody else is a mystery.

[pscEx]

Looks like you have a script version which reproduces the issue.

Can you PM / mediafire, ... to me.

I'll try to examine inside WinBuilder under debugger.

Peter

[pscEx]

Looks like you have a script version which reproduces the issue.

Can you PM / mediafire, ... to me.

I'll try to examine inside WinBuilder under debugger.

Peter

On my system (XP host) the issue does not appear.

I think that without log nobody can help here.

Peter

[homes32]

On my system (XP host) the issue does not appear.

I think that without log nobody can help here.

Peter

agreed.

[joedirt1954]

homes32 I see you are back in good form again and got this issue whipped. I have been busy and not able to get back to this forum until today. i downloaded your newest script and itworked without any flaw on my Windows 7 PE build.

[joedirt1954]

I built an image with the new script without any problems. After booting my test PC with the new image I tried to open Malwarebytes and an error message stating the install was corrupt. Malwarebytes did open but the definition files were not current anf the button to update it was grayed out. I am going to work with it some more to document the error messages.

While doing some searching on the Internet I came up with a site that has a portable version of the current Malwarebytes, if anyone is interested I can post the link. I am going to incorporate that version in my build and do some testing.