malwarebytes restarted my computer about 40 minutes into a scan

[CaptainHindsight]

I downloaded the latest free version (2.0.2.1012) of malwarebytes from the official website last night.

 

Twice, I tried to scan my computer.  Both times, it ran for ~40 minutes, but when I came back to check on its progress, the computer had restarted!

 

The second time this happened was this afternoon.

 

I took a screenshot of the Windows error dialog that I was presented with upon login.  (I am running Win 7 Pro 64 bit.)  The screen shot of this error dialog is attached.  Unfortunately, Microsoft, in typical stupidity, made the error dialog unresizable, so I had to take 3 shots to get all the text...

 

I alo looked in Event Viewer, and found these ERROR/CRITICAL log messages around the restart time (the bugcheck one, in particular, may be the culprit?):

The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

The previous system shutdown at 10:34:37 AM on ?8/?26/?2014 was unexpected.

Audit events have been dropped by the transport.  0

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002ea9be6, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 082614-29608-01.

The following boot-start or system-start driver(s) failed to load:
cdrom

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

 

Are problems like this typical?  Can anyone decipher the stuff I captured above and tell me if it represents malware infection, file system corruption, or a hardware issue?

 

I have never seen a restart on my box like this before.

 

I am next going to try running malwarebytes after first booting in Safe Mode, as some reports on the web I found suggest that.

[CaptainHindsight]

Update: rebooting Win 7 in Safe Mode, I was able to run malwarebytes last night on my C: drive.  It found no malware.

 

I have 2 other drives, actually both are TrueCrypt volumes (one file hosted, the other an entire hard drive).  TrueCrypt could not mount them in Safe Mode, so they were not scanned at this point.  When I rebooted into normal mode, I mounted these 2 TrueCrypt volumes, and attempted to scan just them, skipping my C: drive.  Once again malwarebytes restarted my computer after several minutes into the scan.

 

So, it appears that malwarebytes does not play nice with TrueCrypt.

 

Web searching, it seems that others report this as well: link1, link2, link3, link4.

 

One of the posts above suggested turning off rootkit scanning. I did have that turned on during these restarts, so will try that next...

[CaptainHindsight]

...One of the posts above suggested turning off rootkit scanning. I did have that turned on during these restarts, so will try that next...

 

No dice: unchecking scan for rootkits made no difference.  I think that as soon as malwarebytes started scanning file system objects on my first Truecrypt volume, it blue screened once again.

 

Any help that anyone can offer at this point iss much appreciated.

[AdvancedSetup]

Hello and

1. Please uninstall your current version of MBAM and reinstall the latest version. MBAM Clean Removal Process 2x
2. If that does not correct the issue then please read the following and post back the requested logs. - Diagnostic Logs
3. NOTE: There is an FAQ section with valuable information located here: - Common Questions, Issues, and their Solutions
   

Thank You
 

[CaptainHindsight]

Hello and

• Please uninstall your current version of MBAM and reinstall the latest version. MBAM Clean Removal Process 2x
• If that does not correct the issue then please read the following and post back the requested logs. - Diagnostic Logs
• NOTE: There is an FAQ section with valuable information located here: - Common Questions, Issues, and their Solutions

Thank You

 

 

 

AdvancedSetup: thanks for the reply.

 

I am out travelling,and will be unable to acess my normal desktop until Sepy 7th, so will try again then.

[CaptainHindsight]

One more quick note concerning MBAM and TrueCrypt.

 

I found that TrueCrypt started behaved strangely: I could initially open the program and mount my encrypted volumes just fine.  But if I wanted to open TrueCrypt before shutting down my box for some reason to dismount all those volumes, then TrueCrypt would not open.  In particular, the GUI would not apear.  If I went to Task Manager and killed the TrueCrypt process tree that I found there, then I could reopen TrueCrypt.  But I have never had to do this before.

 

This strange behavior happened when MBAM was not running a scan, and furthermore, it continued even after I uninstalled MBAM!

 

I found that I had to additionally uninstall and reinstall TrueCrypt to get TC to work normally.

 

So, I guess that my first MBAM scan somehow muckd with TrueCrypt...

[AdvancedSetup]

First I've heard of MBAM causing an issue with TrueCrypt. There are reports of our scanner not working with it but none that I recall of it every breaking it.

Please run the clean removal as requested and if it does not fix it then run the other scans as requested and post back the logs when you're ready.

Thanks again

[CaptainHindsight]

First I've heard of MBAM causing an issue with TrueCrypt. There are reports of our scanner not working with it but none that I recall of it every breaking it.

Please run the clean removal as requested and if it does not fix it then run the other scans as requested and post back the logs when you're ready.

Thanks again

 

Thanks for your response.  I am back now from my travels, so I can once again resume this.

 

Early this morningbefore work, I went thru the clean removal procedure exactly as described, even tho I had previously uninstalled MBAM.  I then installed the latest version.

 

I then started a complete scan of my entire system before leaving for work.  When I got home, I found that my computer had once again rebooted, and when I logged in, I was presented with a Windows dialog box once again saying that my system had recoved from an unexpected shutdown.  I assume that it is the same exact error described above (did not bother checking, since I assume that the attached log files will capture the necessary logs).

 

I am attaching all 3 requested log files.

 

I eagerly await your diagnosis for why MBAM croaks when it starts scanning my TrueCrypt volume.  (I assume that that is where the latest run crashed.  The proof last time was when I did not mount my TrueCryot volumes, then the scan worked fine on my C: drive alone which is a raw native drive.)

Addition.txt

FRST.txt

CheckResults.txt

[CaptainHindsight]

p.s. I note that this time TrueCrypt at least was still able to mount my partitions after today's MBAM crash.  I did not need to go thru the TruCrypt uninstall/reinstall procedure described in my 01 September 2014 - 06:19 AM post.

[AdvancedSetup]

There is a known bug with TrueCrypt where it can hang or crash MBAM that has been corrected and will be available in the next release. There is no known or reported issue with MBAM corrupting or preventing TrueCrypt volumes from loading that I'm aware of.

 

 

You do have some odd entries that are not the cause of the issue (the next release of MBAM should fix that), for now just do not do rootkit scanning.

 

Did you create these?

 

AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:107
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:149
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:250

[CaptainHindsight]

There is a known bug with TrueCrypt where it can hang or crash MBAM that has been corrected and will be available in the next release. There is no known or reported issue with MBAM corrupting or preventing TrueCrypt volumes from loading that I'm aware of.

 

Great, I am looking forward to that release.  You have any idea when I should start looking for it to come out?

 

 

You do have some odd entries that are not the cause of the issue (the next release of MBAM should fix that), for now just do not do rootkit scanning.

 

Thanks for the suggestion.  I will start a scan before leaving for work today which unchecks rootkit detection.

 

 

Did you create these?

 

AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:107

AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:149

AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:250

 

I certainly did not explicitly create those.  From what I understand of WoW64, they should have been created automaticly by Windows.  I do use some 32 bit programs because 64 bit alternatives are still not available.  Is there something in those particular files that jumps out at you?

[CaptainHindsight]

AdvancedSetup: I made sure that scan for rootkits was unchecked before my run this morning.  When I got home from work, once more my box had blue screened and restarted.

 

Very annoying....

 

Attached are the latest diagnostic files.

 

When is the next version of MBAM coming out?  I can't wait.

FRST.txt

CheckResults.txt

[AdvancedSetup]

I'm sorry I was not asking about the SysWOW64 folder but the name on the end. I'm pretty sure you did not create them but need to ask.

 

C:\Windows\SysWOW64  is valid and okay.

 

C:\Windows\SysWOW64\MSIHANDLE:107    is probably not okay

 

As for the next release I don't have a specific date but hopeful that it will be later this year.

[CaptainHindsight]

AdvancedSetup: to be explicit: I did not create any those alternate data streams for the file C:\Windows\SysWOW64\MSIHANDLE.

 

In fact, I did not know that Windows (NTSF) even supported alternate data streams until I researched it just now.

 

My C:\Windows\SysWOW64\MSIHANDLE file now shows up as having 0 KB size in Windows Explorer.  Should I assume that my last MBAM scan wiped it clean, including all of the alternate data streams?

 

By the way, from my logs, do you happen to knw what malware may have been lurking in those alternate data streams?

[AdvancedSetup]

Just those numbers. It could have been due to anything including an installer.

 

Please just make sure your Windows updates are up to date and that your antivirus is also up to date and running.

 

Then hopefully sometime by the end of the year we'll release the new update that should correct this for you.

 

 

 

[CaptainHindsight]

Please just make sure your Windows updates are up to date and that your antivirus is also up to date and running.

 

Altho I disable autoupdates, I do have autonotifies on, as I want to require manual approval of all software updates (e.g. from Windows, Firefox, Java, etc).  That said, I almost always accept all updates as soon as I am notified of them.  I think that my system is totally up to date.

 

Speaking of antivirus, I got the paid for version of AVG years ago, before ever hearing of MBAM, and have been using it ever since.  AVG is about the only program that does autoupdate, so it is totally current.

 

To my knowledge, I have never been the victim of any malware.  But recently I had some paranoid reasons to believe that some malware may have slipped thru my defences.  I did some research, and found that MBAM is highly regarded.  Hence, I downloaded the free version and attempted a complete scan with it.

 

Now AVG is set to auto renew (charge my credit card) in a couple of days.  If MBAM did not crash upon trying to scan my TrueCrypt partitions, I might consider switching to MBAM paid version.  But if an MBAM release that works for me is months away, that will not do.

 

Given all that, what is your objective opinion of AVG paid version?  Do you respect its malware detection abilities?  Or is there another product (free or paid--I care most about quality than price) that you recommend which can scan TrueCrypt partitions?

 

 

Then hopefully sometime by the end of the year we'll release the new update that should correct this for you.

 

I so wish that it was coming out in a week or so!

[AdvancedSetup]

Well unfortunately MBAM is not an antivirus and not a replacement. Our product is an add-on to your antivirus to often find and prevent zero day infections that many antivirus products seem to miss.

 

At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.
They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.
 
Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot
  

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.
 
 
If there are any other left over Folders, Files, Logs then you can delete them on your own.
 
Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.
How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP


As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.

• How Malware Spreads - How did I get infected
• Best Practices for Safe Computing - Prevention of Malware Infection
• Avoiding those unwanted free applications
• A close look at how Oracle installs deceptive software with Java updates
• IAC / Ask.com toolbars
• Malwarebytes Unpacked Blog
  

If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.
 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!