When I temp.disable Mbam it blocked again and replace original file(.exe) to unknown (.exe) file.
I cannot understand what you are trying to say. Which .exe file? Can you show me a screenshot?