Malware Defender Issue

[Peter2150]

I've run into one problem, not unique to a particular version of MD. I just ran a windows Update, and now MD tells me I need to download the kernel symbols. But when I try to do so, the download fails.

Any ideas.

Pete

[tony62]

Hi Peter,
are you using Windows XP? I also received several windows updates yesterday and MD downloaded the kernel symbols with no problems.
Have you tried deleting the contents of: C:\Program Files\Malware Defender\symbols?

[Peter2150]

Originally Posted by tony62

Hi Peter,
are you using Windows XP? I also received several windows updates yesterday and MD downloaded the kernel symbols with no problems.
Have you tried deleting the contents of: C:\Program Files\Malware Defender\symbols?

Hi Tony

Yes XP . I will try deleting those contents and see what happens.

Thanks,

[Peter2150]

Figured it out. There was no symbols folder, so I tried manually creating one, and couldn't. Protection issues. So I disabled MD, and shutdown OA, and bingo kernel symbols downloaded fine.

Pete

[bellgamin]

Originally Posted by Peter2150

Figured it out. There was no symbols folder, so I tried manually creating one, and couldn't. Protection issues. So I disabled MD, and shutdown OA, and bingo kernel symbols downloaded fine.

Pete

Hmmm... the defender got screwed by the protector? Ah well, such is life. Some folks get the elevator -- others get the shaft.

[Peter2150]

It's weird, the symbols directory seems to have gotten deleted during the system update. Then the folder was protected so the new symbol folder couldn't be opened.

[xiaolin]

Originally Posted by Peter2150

It's weird, the symbols directory seems to have gotten deleted during the system update. Then the folder was protected so the new symbol folder couldn't be opened.

Thanks for the information. I will look into it.

MD will delete the old symbols before downloading new symbols.

[Peter2150]

Originally Posted by xiaolin

Thanks for the information. I will look into it.

MD will delete the old symbols before downloading new symbols.

Thanks xiaolin. Should new symbols be necessary with a Windows update?

Pete

[Espresso]

I had the same problem, but when I checked with a packet sniffer, I saw that MD was getting a http 404 error when it tried to download the symbols.

[xiaolin]

Originally Posted by Peter2150

Thanks xiaolin. Should new symbols be necessary with a Windows update?

Pete

If the Windows kernel file is updated, MD will download new symbols for the new file.

[xiaolin]

Originally Posted by Espresso

I had the same problem, but when I checked with a packet sniffer, I saw that MD was getting a http 404 error when it tried to download the symbols.

Could you try to download the symbols again after restart?

[Peter2150]

Originally Posted by xiaolin

If the Windows kernel file is updated, MD will download new symbols for the new file.

Makes sense. I run Online Armor, along with MD, and it's clear one of them was protecting the program area. Shutting down OA, and disabling all protections in MD solved my problem.

Pete

[nick s]

It's not unexpected, but I do get "Failed to get kernel symbols." when prompted to download new symbols after upgrading my Vista machines to SP2 RTM (TechNet release)...

HTTP:Request, GET /download/symbols/index2.txt

HTTP:Response, HTTP/1.1, Status Code = 404, URL: /download/symbols/index2.txt

18 0.312001 {HTTP:7, TCP:6, IPv4:3} 192.168.1.116 msdl.microsoft.akadns.net HTTP HTTP:Request, GET /download/symbols/ntkrpamp.pdb/109FACEC7E244C8FAC6D191457B5C7022/ntkrpamp.pdb

HTTP:Response, HTTP/1.1, Status Code = 404, URL: /download/symbols/ntkrpamp.pdb/109FACEC7E244C8FAC6D191457B5C7022/ntkrpamp.pdb

[xiaolin]

Originally Posted by nick s

It's not unexpected, but I do get "Failed to get kernel symbols." when prompted to download new symbols after upgrading my Vista machines to SP2 RTM (TechNet release)...

HTTP:Request, GET /download/symbols/index2.txt

HTTP:Response, HTTP/1.1, Status Code = 404, URL: /download/symbols/index2.txt

18 0.312001 {HTTP:7, TCP:6, IPv4:3} 192.168.1.116 msdl.microsoft.akadns.net HTTP HTTP:Request, GET /download/symbols/ntkrpamp.pdb/109FACEC7E244C8FAC6D191457B5C7022/ntkrpamp.pdb

HTTP:Response, HTTP/1.1, Status Code = 404, URL: /download/symbols/ntkrpamp.pdb/109FACEC7E244C8FAC6D191457B5C7022/ntkrpamp.pdb

The kernel symbols for Vista SP2 may be not provided by MS now.

The HIPS functions will work fine without kernel symbols.

Thanks,
Xiaolin

[demoneye]

same problem like peter in here , its somehow faild to download

also i found another thing , correct me if i wrong , when i del a rule i made to any software and try to lunch it , it lunch without MD alerts

using XP sp3 + MD 2.1.1

cheers

[xiaolin]

Originally Posted by demoneye

same problem like peter in here , its somehow faild to download

also i found another thing , correct me if i wrong , when i del a rule i made to any software and try to lunch it , it lunch without MD alerts

using XP sp3 + MD 2.1.1

cheers

Launching software is controld by child application rule. You need to delete the app from the child application rules of explorer.exe.

thanks

[demoneye]

Originally Posted by xiaolin

Launching software is controld by child application rule. You need to delete the app from the child application rules of explorer.exe.

thanks

yes i know , i did it but no help , i used "find rules" ,enter software name , and Del all related rules(so no missed rules) , software still lunch without any MD warning, btw it goes for all software i checked

any explanation to that?is it a bug ppl somehow missed ?

[xiaolin]

Originally Posted by demoneye

yes i know , i did it but no help , i used "find rules" ,enter software name , and Del all related rules(so no missed rules) , software still lunch without any MD warning, btw it goes for all software i checked

any explanation to that?is it a bug ppl somehow missed ?

The only possible reason is that you are select one of the first two options in Options dialog -> Rules.

[nick s]

Originally Posted by xiaolin

The kernel symbols for Vista SP2 may be not provided by MS now.

The HIPS functions will work fine without kernel symbols.

Thanks,
Xiaolin

Kernel symbols for Vista SP2 are now available .