meeshu

Running Windows 7 64 bit SP1 with Malwarebytes version 4.5.29. Doing custom scan of C: drive. Problem is that Malwarebytes is taking a long time scanning "startup items". It has been scanning "startup items" for about 4 and a half hours now!? I don't recall Malwarebytes (earlier versions) taking so long to scan the entire system previously. Should "startup items" scanning take a long time to complete (now)? Or is Malwarebytes possibly bugged? In any case I'm going to stop/cancel the scanning shortly if Malwarebytes fails to finish scanning startup items and move on to the next area to scan (the registry).

Presumably no one knows why?? The issue has now been resolved by using the least desirable method to "fix" the issue.

This one is for an EXPERT in Windows XP operating system, I think. Running a triple boot system with Windows 7 32bit SP1, Windows 7 64bit SP1, and Windows XP Pro 32bit SP3. It IS possible to boot into Windows XP Safe Mode by pressing the F8 key after selecting which operating system to boot into from the multi-boot start up menu. However, when Windows XP has booted up under usual circumstances (Normal Mode), XP will NOT boot into Safe Mode when modifying the Boot.ini settings (selecting SafeBoot and Minimal boot option for example) under msconfig, and restarting. The computer always boots back into Normal Mode despite Boot.ini settings being set to SafeBoot etc!? I've run numerous anti-malware/anti-spyware programs (and some "minor" issues were found and fixed), but otherwise no (major) issues found. Also ran CHKDSK and SFC, but no errors found. Why will Windows XP not boot into Safe Mode after changing the boot settings in Boot.ini (via msconfig), and restarting the computer? This is really odd behavior.

OK. Tried to download SVRT (Sophos Virus Removal Kit), but had considerable difficulty! Download speed was around 1 kB/s ONLY! And download cut-out/stopped and didn't resume either. Tried to download again a bit later, but still only got ~ 1kB/s speed!? So I cancelled the download. Downloaded SVRT and also KVRT (Kaspersky Virus Removal Tool) via a local Internet Cafe. Installed/ran SVRT, but it was quite slow in scanning and it scanned ALL my drives when I only wanted it to scan the boot drive. Eventually stopped the scan and quit the program, it was taking too long. Ran KVRT. It found two non-viral "threats" only (PC_Hunter.exe). But PC_Hunter is a legitimate program, so I didn't remove it. Otherwise there were no other issues found. So it seems my boot drive is now probably clear of any malware. Thank you!

JRT scan result - ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Malwarebytes Version: 8.1.3 (04.10.2017) Operating System: Windows 7 Professional x86 Ran by Administrator (Administrator) on Thu 13/07/2017 at 18:52:13.93 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ File System: 16 Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JJ3NMADD (Temporary Internet Files Folder) Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3I84U77 (Temporary Internet Files Folder) Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KC1QA0SO (Temporary Internet Files Folder) Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ONFWPA4J (Temporary Internet Files Folder) Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PNCLSQXE (Temporary Internet Files Folder) Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U4ES9X9N (Temporary Internet Files Folder) Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W90DPVST (Temporary Internet Files Folder) Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7SI7621 (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JJ3NMADD (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3I84U77 (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KC1QA0SO (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ONFWPA4J (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PNCLSQXE (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U4ES9X9N (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W90DPVST (Temporary Internet Files Folder) Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7SI7621 (Temporary Internet Files Folder) Registry: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Thu 13/07/2017 at 18:53:10.81 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AdwCleaner scan result - # AdwCleaner v6.047 - Logfile created 13/07/2017 at 18:58:56 # Updated on 19/05/2017 by Malwarebytes # Database : 2017-07-11.1 [Server] # Operating System : Windows 7 Professional Service Pack 1 (X86) # Username : Administrator - MINE-PC # Running from : C:\Users\Administrator\Desktop\adwcleaner.exe # Mode: Scan # Support : https://www.malwarebytes.com/support ***** [ Services ] ***** No malicious services found. ***** [ Folders ] ***** No malicious folders found. ***** [ Files ] ***** No malicious files found. ***** [ DLL ] ***** No malicious DLLs found. ***** [ WMI ] ***** No malicious keys found. ***** [ Shortcuts ] ***** No infected shortcut found. ***** [ Scheduled Tasks ] ***** No malicious task found. ***** [ Registry ] ***** No malicious registry entries found. ***** [ Web browsers ] ***** No malicious Firefox based browser items found. No malicious Chromium based browser items found. ************************* C:\AdwCleaner\AdwCleaner[S0].txt - [1172 Bytes] - [10/07/2017 14:55:59] C:\AdwCleaner\AdwCleaner[S1].txt - [1093 Bytes] - [13/07/2017 18:58:56] ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1166 Bytes] ########## Sophos Virus Removal Tool is a large file (~ 160 MB), and as I'm on a dial-up internet connection, this download will take quite a few hours! I'll post results when I can, but will not be until tomorrow. FRST scan results will follow once Sophos VRT has been run.

MBAM is now running again!! What I did was to run Tweaking.com Windows Repair All On One Utility with 'Repair WMI' and 'Remove Policies Set By Infections' and a few other settings as well. That did the trick! The settings were courtesy of someone else on another forum. It appears that the malware had caused some issues related to WMI, so I tried WRAIO again, and it worked! MBAM found a couple of Trojans which were removed. To be sure all malware is clear, I'll run several other anti-malware programs as well. If there are any further issues I'll report back ASAP.

Hello Aura! Thanks for your assistance! But this issue is already being looked into by AdvancedSetup here - I thought that this thread here had been merged with the above thread (by AdvancedSetup ?). It appears that there may be some files "missing" which is causing MBAM not to run. I am awaiting further details from AdvancedSetup, hopefully sometime today. Not sure which is the best way forward? Should this thread here be merged with the above thread? Or should this thread be closed or deleted? Sorry for any inconvenience!

Thanks for the comments! I've already downloaded and used MBAM Clean several times previously, but to no avail. I've also downloaded MBAM-Check. I've tried overwriting the existing MBAM installation with the latest version of MBAM. I've just now re-run MBAM-Clean and reinstalled the latest version of MBAM. And I've tried running MBAM in Safe Mode as well, but again MBAM will not run; and continue to get error message - "Unable to start" "Unable to connect the service" Here are the latest scan logs of MBAM-Check and FRST, even though they were not specifically requested (yet). mb-check-results.zip FRST.txt Addition.txt

I had difficulty in downloading KVRT from Kaspersky website because the file is around 100 MB, AND I'm on a slow internet connection. The downloads ultimately stop downloading before the downloads are complete, and there is no resume function either, apparently. Had to download slightly older version of KVRT from another site. Anyway, initial KVRT scan found a Trojan which was then removed. Computer was rebooted, and additional KVRT scan found three more malware entries which were removed as well. Unfortunately MBAM (version mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251) still fails to run with the error messages "Unable to start" and "Unable to connect the service"!

Thanks for the response! Ran MBAR from the desktop. 5 malware items were found and then supposedly cleaned. Malware was mostly "Ransomware.Wannacrypt" I think it was. Rebooted, but MBAM still will not run (error message "Unable to start" "Unable to connect the service")! And CPU load still jumps to 50% (due to 'WmiApSrv.exe' within 'C:\Windows\Fonts' directory according to Windows Task manager). I can stop this WmiApSrv process temporarily via Windows Task Manager, but this process always restarts no later than a few minutes after stopping it!?

Still can't get MBAM to run! MBAM version mb3-setup-consumer-3.1.2.1733-1.0.141-1.0.2092 ran OK initially, then one day decided not to run any more with message "Unable to start" and "Unable to connect the service". Tried uninstalling, reinstalling, using MBAM Clean and rebooting and even installing version mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251, but MBAM still will not run! Ran system checks (up to ~ 4 times) such as CHKDSK and SFC, but neither found any issues with my computer. There was apparently some malware on my system, and my previous thread at these forums was then redirected to the malware removal section. Unfortunately no one responded in the malware removal section to this malware issue after three days, so I sought assistance elsewhere. And as of this writing, after about 5 days there still hasn't been a response here in the malware removal section, despite 100's of views!? Malware was apparently removed using various software, but MBAM still does not run. MBAM check result , and FRST scan results enclosed. mb-check-results.zip FRST.txt Addition.txt If malware is still present, then please do not redirect to the malware removal section unless it can be guaranteed that there will be a response this time from a helper, please!!

This is in relation to - There has not been a response to that thread, yet, from an anti-malware helper!!?? In addition I'm unable to post an update/add a reply to that thread!? I've already done some attempt at malware removal, but there is still an issue with my computer. On further investigation, although the service WmiApSrv.exe has been "stopped" (under Services under Windows Task Manager), a file with the name WmiApSrv.exe is running under Processes (under Windows Task Manager). I can stop this process, but eventually it returns and loads the CPU to 50%. Additionally, another WmiApSrv.exe process may also occur which then loads the CPU to 100%! The location of this "process" is within C:\Windows\fonts, which I suspect shouldn't be there and is possibly some sort of malware. Also, MBAM will still not run, get error that "Unable to start" and "Unable to connect the service". I have already used MBAM clean to remove MBAM, rebooted the computer and (re)installed MBAM, but again MBAM will not run with the error messages appearing again! Latest FRST scans included (waited until the "Process" WmiApSrv.exe occurred first before re scanning) - FRST.txt Addition.txt

Files attached as requested. Thanks. mb-check-results.zip FRST.txt Addition.txt

Running Windows 7 32 bit SP!. Installed MBAM version mb3-setup-consumer-3.1.2.1733-1.0.141-1.0.2092 a few days ago and it ran fine after installation. But it failed to run as of yesterday or so; keep getting error message that "Unable to start" and "Unable to connect the service". MBAM failed to run, despite trying to run under Safe Mode as well. Tried MBAM-clean exe, and rebooted, and then reinstalled the above MBAM, but again it fails to run with error message appearing again! Ran MBAM-clean exe again and installed MBAM version mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251, but this version also failed to run with the error massage appearing once again!!?? Tried running SUPERAntiSpyware, AdWCleaner, RogueKiller, and maybe one or two other similar programs, but no malware (of concern) was found. Ran Tweaking.com - Windows Repair program a few times after the first time I received MBAM error message, and before installing the latest version, but it didn't seem to help. No hardware changes were made to my computer, but there were a few programs added/uninstalled around this time (mainly anti-malware), so that might have caused some issues with my system, which in turn may have effected the running of MBAM?? Ideas?

Thanks to those who have helped. Fortunately, MBAM has not been purchased, so there is no financial loss involved. Downloaded MBAM 2.1.8.1057 (again) via a download manager and had little or no difficulty downloading this file. But downloading updates still seems to be a problem, possibly because of my slow internet connection to the not so forgiving updating servers. Actually been having similar difficulty in trying to update another anti-malware program, with the updating servers cutting out and not resuming either. But as mentioned previously, MBAM can be still used immediately from a clean install, and as long there is no active internet connection when MBAM is run. Also it is just possible to download "mbam-rules" which provides some degree of updates but these updates lag behind current updates via MBAM automatic updating. So all is not lost.

Thanks for the extra details. Emailed my ISP who responded that most likely due to heavy internet traffic, slow (dial-up) connections would be compromised, and there was basically nothing they can do about it. My ISP suggested trying another download manager, and to try using some sort of "dial up accelerator" program. However, from brief research on this type of program, I doubt they would improve the situation regarding the download difficulties currently being experienced by myself(?) Edited the hosts file and added the six direct IP's. Tried updating MBAM 2.1.8.1057 twice. MBAM then seemed to update OK for 10 minutes or so and stopped and reported that the latest database had been installed (2015.07.11.03; <- I think). Then tried scanning for malware. But MBAM stopped scanning as it reached "Rootkit" stage and an error message appeared "SDKDatabaseLoadDefaults failed with code 20012". This message appeared once again after trying to update MBAM and then scan once more. So there are still some difficulties in not being able to complete updating MBAM properly.

There are more than 10,000 servers that have (latest) MBAM updates?? I understood that there were, maybe, only a few official MBAM updating servers (for access by MBAM when attempting updates)(?) Tried using an older backup computer at home running Windows XP Pro SP3. Installed MBAM 2.1.8.1057 on it and tried updating definitions automatically by running MBAM while connected to the internet. Again, updates either started downloading and then stopped after a few minutes before completion of updates, or, updates failed to start with message "Unable to access update server". So there are still issues updating MBAM the usual way (by running MBAM while connected to the internet). Back to using my main computer (Windows 7 Pro x64 SP1). As an experiment tried a couple of brief downloads from other unrelated websites using Lightning Download download manager. There were some difficulties in completing the downloads, in that there were several disconnections from the servers (with server busy message appearing), and download resuming didn't always occur. Had to manually "Cancel" the download, and then Lightning Download resumed and eventually completed the downloads. This problem of cancelling/resuming downloads seems to be happening a bit more since the last year or so, with little or no change in computer hardware/software at my end. But for most (other) downloads, there are usually little or no major issues in completing the downloads. A recent test of internet bandwidth by a local computer shop indicated that bandwidth locally (within New Zealand) and to nearest Pacific neighbours (Australia, Samoa, Tonga, Fiji etc) was good. But bandwidth dropped off considerably for traffic to/from the United States (and places beyond) which indicates data congestion. This might partly explain why downloads are often slow and why disconnections from servers occur. Servers would probably give priority to broadband connections, with slow (dial-up) connections given lowest priority. So when servers are having to deal with heavy broadband traffic, slow (dial-up) would likely suffer with slow data transfers and eventual server disconnections(?). Not unusual now to get error message in all internet browsers that "Page Can't Be Loaded", or "Disconnected From Server", or messages to that effect. So, the more likely explanation, at this time, for disconnections from servers (and downloads can't be completed) is possibly to due to increased (excessive) internet traffic and slower (dial-up) connections dropped off in favour of broadband connections?

OK. Disabled all third party download managers. Tried downloading "mbam-rules-2015-07-02.zip" file using browser in-built downloaders only. Tried Internet Explorer and later tried Opera. Firefox browser was not used for downloading as it was downloading something in the background despite disabling automatic updates(?). The file started downloading on all attempts. But after around 10 minutes or so, downloading just stopped with "error" appearing in the browser download window. Tried resuming and/or restarting downloads, but downloads did not resume. Browsers then reported the file had been fully downloaded (when it hadn't); the file size was only 1 kB on the HDD. So using just the browsers for downloading doesn't seem to work. Installed Lightning Download download manager. Tried downloading file again using Lightning Download (LD). File started downloading, but again downloading stopped after ~ 10 minutes with LD trying to resume the download. On one or two occasions the download did resume, but on three or four occasions LD stopped trying to resume downloading and an error message appeared something to the effect that the file and/or server could not be found! I clicked on "Cancel" within the error message dialog box, and LD then retried and resumed downloading!! Eventually managed to download mbam-rules-2015-07-02.zip file using LD! Ran "mbam2-rules.exe" file (within the above zip file) which then presumably updated MBAM definitions. With internet disconnected, MBAM ran and completed all scanning tasks (with no malware found). I disconnected from the internet before running MBAM because MBAM will always check for and attempt to update the program/definitions if an internet connection is live. And from previous recent experience, the update(s) will most likely fail with MBAM failing to work properly after that. At present there are only two ways of using/running MBAM, and in both cases MBAM HAS to be run with NO live/active internet connection. 1) Download the latest program (and accompanying definitions), and doing a clean install and running MBAM without any attempt at live/automatic updating. 2) Downloading the latest "mbam-rules" via LD and applying the updates manually this way. Again there can't be a live/active internet connection at any time when MBAM is running. There seems to be as definite server/connection issue going on here which prevents MBAM updating properly and automatically any time MBAM is run with an active internet connection. Can the server(s) be checked for proper functioning? What now please?

Thanks! Have also tried downloading MBAM updates using two different download managers (IDA and IDM). Initially, downloading seemed fine with both download managers reporting downloads could be resumed. But after 5 ~ 10 minutes of downloading, and with download speeds dropping off, downloads stopped. Both download managers then tried to resume downloads, but resuming downloads was not apparently possible (despite download managers reporting resuming was possible). Both download managers then started downloads from the beginning, and then reported that downloads could not be resumed!? The download speeds seemed to be much slower this time, so I manually cancelled downloads. This is unusual behaviour for the download managers. And although this behavior does occur while downloading from a few websites, most of the time downloads resume with no further issues.

Quick update. Tried manually downloading latest definitions directly from data-cdn.mbamupdates.com, which is possible (according to various sources). Tried downloading twice (using browser, not download manager), but after 5 ~ 10 minutes, downloads stopped with error. And downloads could not be resumed. Suspect "mbamupdates" server issue here, as downloading in general (although slow) usually completes without issue from most other download sites. It appears that resuming downloads doesn't seem possible at mbamupdates server(s), and there might be a time limit on downloading the definitions also?

Difficult to determine cause of the system errors as shown in previous Addition.txt log despite searching for causes/solutions on the 'Net. So scanned for further Windows updates and found a few more "Important" updates which were downloaded and applied. Did not include two "Important" updates, which were Malicious Software Removal Tool and Windows Defender definition updates. It should be noted that the Windows downloads totalled in excess of 50 MB, which my system downloaded without issue (apart from being slow due to dial-up connection). After updating Windows, re-ran FRST64 with the results enclosed. It was noted in the latest Additions.txt log that the previous system errors were gone, but some new errors appeared instead. Ran MBAM 2.1.8.1057 again and tried updating the database, but immediately got the message "Unable to Access Update Server", despite trying several times. MBAM 2.1.8.1057 was uninstalled. mbam-clean was then ran to thoroughly remove all traces of MBAM installation. MBAM 2.1.8.1057 was then reinstalled and run once again. MBAM 2.1.8.1057 checked for updates then started downloading updates. But the updates stopped soon, with no (error) message appearing(?) Tried running MBAM again with checking for updates and downloading updates. But again the downloads stopped and I think the message "Unable to Access Update Server" appeared again. Previously, well over a year ago (with no change in ISP and with same or similar dial-up connection), updates to MBAM were possible. And although the updates were slow due to dial-up connection, the updates did complete. Now MBAM updates are not completed for whatever reason(s), although suspect some network/server issue. The update servers, do they allow resuming of downloads? If a server is down, are update requests to the downed server automatically redirected to another running server? MBAM *.conf files, which are presumably configuration files, do not appear to be in (any known) text format and they can't be viewed/edited either(?) It was suggested by a proprietor of a local computer store that problems downloading while using dial-up connection may be due to some servers giving priority for data transfer to fast connections. And slow (dial-up) connections are given lowest priority. So during heavy server loading, disconnections/drop-outs may occur, particularly, for the slow connections. It is understood that the latencies for dial-up modem connection can vary quite a bit, and is dependent on distance. Latencies in excess of 200 ms is not unusual for dial-up modem connections. Is there a problem with the update servers? FRST.txt Addition.txt

The reason for posting the question here, is that malware doesn't appear to be the issue, and the other forum relates to removal of malware, so it seemed appropriate to ask the question in the most logical forum (here).

This issue was posted in Malware Removal Help part of these forums, and at this stage it seems unlikely that some malware is causing these issues as no malware has been found. It appears the problem with inability to complete updating MBAM is more a network/internet related issue. As part of troubleshooting the problem, I've also been trying to examine some MBAM files, in particular the configuration files (*.conf). But I'm unable to view these files (using Notepad, Wordpad, and other similar text editors) as these files seem to be in some unusual format. Maybe they are encrypted, or compressed, or ?. So, what format are the *.conf files in? And how do you view/edit them please?

First, sorry about the "wall" of text in my previous post. My post was separated into paragraphs etc, but all the formatting was apparently removed when my message was posted. I'm in New Zealand (South of South Pacific Ocean). I'm on a dialup connection. That is the main reason why I'm reluctant to download the Windows 7 SP1 fix/update of about 1 GB, which would take at least two days of continuous downloading. Ran the traceroute program with the following results. traceroute_malwarebytes_cdn.txt

The presence of the yellow triangles within the Device Manager has been known for some time. Just didn't bother updating/adding drivers as the system seemed to be basically working OK. Anyway, after another HDD wipe, and re-installation of Windows 7, appropriate drivers have now been installed, so there are no more issues regarding drivers. Screen shot of Device Manager enclosed. Windows is also mostly up to date with latest fixes downloaded and installed. Only Internet Explorer updates, Windows Defender (or similar) updates, and a massive ~ 1 GB W7 x64 SP1 update were not downloaded and installed. Downloaded MBAM version 2.1.8.1057. Had problems downloading this file with - frequent drop-outs, a lot of download resumes, wildly varying download speeds. And initially after 10 minutes of downloading, download stopped with message saying couldn't find server and resume wasn't supported. But I managed to resume download manually using Internet Download Manager. Installed and ran MBAM 2.1.8.1057 with nothing else running (no firewalls apart from Windows 7 firewall, and no anti-virus/anti-malware programs installed/running). MBAM checked for updates for ~ 6 minutes then MBAM started updating database for ~ 1 minute then MBAM stopped with message "Unable to Access Update Server" Tried running MBAM a bit later on. MBAM reported "Databases out of date" clicked on "Update Now" MBAM checked for updates for ~ 4 minutes then MBAM started updating database for ~ 2 minutes and again MBAM stopped with message "Unable to Access Update Server" There is definitely a problem here with updating MBAM. And it seems more likely to be a network/internet issue rather than some sort of malware at this stage. Ran FRST64 with following results. What is the best way to proceed to help identify and solve the problem of updating MBAM? FRST.txt Addition.txt