Ensuring Avast! 5 and MBAM play nicely together

[sparge]

Hi folks,

I'm in the process of geting my machine shipshape again after a reinstall of Win XP Home SP3, and one of the things I have done is upgraded from Avast 4.8 free to Avast 5.0 paid. The only other security software I have reinstalled is MalwareBytes Anti-Malware (also paid). They seem to get along OK most of the time, but I have noticed that at start-up they often seem to be having a bit of a battle: the Avast system tray icon will have a yellow exclamation mark for several minutes, while the hard disk goes crazy and the machine is completely unresponsive. Task Manager is telling me that when this happens, mbamservice.exe is consuming large amounts of CPU.

MBAM have published a list of their files that AV software needs to be aware of, and a specific file (mbam.exe) that a firewall needs to be aware of, but they only give instructions for how to do this for a small number of AV apps, not including Avast.

The Avast firewall already has an application rule for mbamservice but I think maybe it isn't permissive enough. I changed it from "Internet out (otherwise auto-decide)" to "Friends in and Internet out" and the machine started up much better this morning. I also added a new rule for mbam.exe with the same level of permission. Are these changes correct, please?

What I'm unclear about is where and how I'm supposed to make Avast aware of this other list of files. The MBAM FAQ talks about excluding them from the resident shield, but Avast has eight resident shields ... I'd appreciate it if someone could clarify for me!

[SafeSurf]

Are you using AIS or Avast 5.0?

MBAM Pro (paid) will load on boot up prior to Avast.  The free version is on-demand.

When you see the yellow triangle on the Avast icon in the bottle tool bar, this means it is waiting or in the process of loading on boot up while other things are booting up before it.  In your case, something else is loading up before it.  It is not uncommon for something else to load before Avast and to see this yellow triangle for a few seconds.  I would try looking at your Start Up items to see what is loading up on boot up and see if there is anything that you do not need that is consuming usage.  Yes, MBAM Pro will be one of them, but if you want to keep it you will have to live with it.

So I will need clarification from you...do you have AIS (with firewall) or just the AV?  The reason I ask is because FW's usually load before other items.

[MikeBCda]

So I will need clarification from you...do you have AIS (with firewall) or just the AV?  The reason I ask is because FW's usually load before other items.

Interesting ... My PC Tools firewall is usually the last bootup service to load (before avast's web and email shields, that is).

[steverf]

Interesting...
I have the Avast (Free) and MalwayreBytes (Paid) and everything loads fairly quickly and seems to be ready to go "EXcept" Avast...
System Processes (WinXP Pro SP3) say CPU is sitting Idle 99%, MBam services are all loaded and nothing is happening except the little "yellow" exclamation point for Avast, saying it is not ready yet.... so what is it waiting on ?

Steve
Perdido Beach, AL

[sparge]

Hi Safesurf,

Presumably AIS = Internet Security is the paid version and Avast 5.0 is the free version. I'm using AIS (v5.0.594), sorry for the confusion. It doesn't always happen, but if I do see the yellow triangle (like just now when I logged on) it's more like a few minutes than a few seconds. I monitored the start-up with Task Manager and mbamservice was consuming up to 60% CPU for much of that time, but certainly not all of it by any means.

[YoKenny]

I use System Explorer to see my system performance and I do notice that mbamservice uses a lot of system resources at boot up but it settles down after a while:
http://systemexplorer.mistergroup.org

You need to add MBAM's files to the File System Shield:

See noknojon's advice: 
http://forums.malwarebytes.org/index.php?s=&showtopic=53807&view=findpost&p=276134

[SafeSurf]

Thank you YoKenny for your suggestion.  I also have MBAM Pro on one of my machines and prior to this post have done this and have no problems with it running with Avast.

@ sparge, I would follow YoKenny's suggestion and this should resolve your problem.

@ MikeBCda, I also use PC_Tools on another machine and it loads in between other items.  Since I've also tested FW's with Avast, in general, the FW's tend to load first, but each machine is different and have different software loading on them.  Some of the security software have settings to control how they load, so if it becomes a problem, you can adjust this. 

[sparge]

Thanks all,

I've modified the Avast settings in the ile system shield now, we'll see if it makes any difference (thanks also to YoKenny for the profile-related heads-up).

Curious thing is, about half the time it was OK - like this morning, before I made the changes. It seemed to depend on which icon appeared first in the system tray (I hesitate to say which loads first because they're not necessarily the same thing). Once the wallpaper appeared, if MBAM appeared first in the system tray everything else followed in the space of 20-30 seconds. OTOH if Avast apeared first, I would see the symptoms I described, and it would take maybe five times as long for everything to get sorted out.

[SafeSurf]

It takes a while for all the shields in Avast to load up, while MBAM Pro is trying to load.  Perhaps making the changes already suggested will now fix this problem.  Give it a try and let us know if there are any problems.

[YoKenny]

@  sparge

Andy, I have customized the MBAM startup on my XP Pro system to delay the startup of its services plus I have avast! set to load after other system services.

I had to use regedit to add these delays to HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes' Anti-Malware

Code: [Select]

"delayservicestart"=dword:00000060
"delayipblocking"=dword:00000060

[sparge]

Well, I was all set to report 100% success, but I've learnt not to be too hasty with such things, and after three or four successive boots like greased lightning (for all of which MBAM appeared in the system tray first), tonight Avast appeared first, with its yellow triangle, and it took around five minutes of mbamservice consuming up to 70% CPU and 70 MB RAM before the wireless network icon finally appeared and I was able to do anything.

So there definitely seems to be somethng in my empirical observation that MBAM loading first is good, Avast loading first is bad.

[YoKenny]

Have you added the delayservicestart and delayipblocking items with regedit

See my post:
http://forums.malwarebytes.org/index.php?s=&showtopic=37726&view=findpost&p=191185

By Firefox one of the Trusted Advisors 
http://forums.malwarebytes.org/index.php?s=&showtopic=24497&view=findpost&p=126137

[JerryM]

Although I did not experience this problem when I was using Avast 5 Pro and MBAM, Win Patrol can delay the start. Such capabilities are the reason I am sold on Scotty.

Regards,
Jerry