meeshu

OK. I have made some changes to my system before I was aware of the previous post, Completely wiped, reformatted and reinstalled Windows 7 x64 SP1 on C: drive, with minimum number of applications reinstalled. Installed and ran MBAM version 2.1.7.1055. MBAM checked for updates for 10 minutes briefly got "Unable to access update server" message for a few seconds MBAM then continues to update for nearly two hours with no further issues MBAM then restarted to install latest version (2.1.8.1057) MBAM 2.1.8.1057 then checked for updates for 6 minutes then MBAM started updating database for 18 minutes, but stopped updating with error message "Unable to access update server". So there are still issues with updating, despite cleaning my HDD and reinstalling minimum number of applications. As my system had changed, decided to run FRST64 with the following results. Also included is a screenshot of Device Manager as requested. My system is a custom built desktop. Principle components are - motherboard - AsRock Z77 Performance <- INF chipset and Intel USB 3 drivers installed from disk supplied with motherboard CPU - i5-3570K video card - Radeon HD 7770 <- video drivers installed from download (from AMD website) sound card - Creative Sound Blaster X-Fi <- drivers installed automatically by W7, didn't have to use driver disk supplied with sound card internal modem - Netcomm IN5920 <- drivers installed automatically by W7, didn't have to use driver disk supplied with modem Note that I am on a dial-up internet connection also. FRST.txt Addition.txt

Unfortunately MBAM is still not updating properly. Ran MBAM V 2.1.7.1055 (free version). clicked on Update Now for updating database MBAM then checked for updates for ~ 3 minutes MBAM then started downloading updates but after ~ 7 minutes MBAM stopped downloading updates with error message, once again, "Unable to access update server". So, if there is no malware, then it seems there is a network issue, either on my computer, or at the server(s), or maybe both on my computer and at server(s)? Have been reading some other posts elsewhere here for people also having difficulty updating MBAM. Some users are able to resolve the issue by reinstalling MBAM, but this doesn't seem to work for other users. So far, it appears that there may be issues with some servers depending on geographical location of the downloader/MBAM user. In my case I live in NZ. Is there some issue with server(s) providing service to NZ? What should we do now?

Downloaded and ran latest version of ComboFix (15.6.23.1) with the following result. I had a quick look through the log, and there doesn't appear to be any obvious sign of malware. If there is no evidence of malware, then what would be the best way forward to help resolve this issue of inability to complete MBAM and MBAR updates? ComboFix.txt

Yesterday, downloaded and ran 'Complete Internet Repair'. Unfortunately it was not entirely obvious as to what parameters needed to be selected for repairs to be attempted. So selected several parameters as a best guess and ran the program which ended in requiring the computer to be rebooted. Today, uninstalled MBAM 2.1.7.1055 ran mbam-clean reinstalled MBAM 2.1.7.1055 ran MBAM which then checked for updates for ~ 17 minutes MBAM then updating database for ~ 2 minutes and then stopped with message "Database Out of Date" selected MBAM update MBAM then checked for updates for ~ 1 minute MBAM then updating database for ~ 6 minutes and stopped updating with message "Unable to Access Update Server" So there is still a problem with updating. Either have persistent, well hidden malware? Or there is a problem with the update server? Or incorrect/corrupted computer internet settings? Or ? Remember I'm on a dial-up connection, so does this slow connection maybe cause these updating issues? Maybe need internet connection expert? Would running Combofix and/or some other anti-malware scanner help?

Tried updating MBAR BETA 1.09.1.1004, but updating stopped after ~ 20 minutes with download uncompleted. However, MBAR claimed update was successful. So tried MBAR scan, but after brief delay got error message "Could not initialize database" and MBAR stopped running. So updates still a problem. Possibly related is that while using download managers (Getright in particular), it is not unusual to have downloads stop before completion and error message appearing that the download URL/server can't be found!? However in most cases I can usually manually resume downloads. This didn't use to happen (often), but seems to have been occurring more often since about a year ago or so. And around this time is when I started having MBAM and MBAR update problems also. Previously didn't have much difficulty updating MBAM. Another possible relation is roughly a year or so ago tried using an internet optimizing program TCPOptimizer. But this didn't seem to have any appreciable effect, so reverted to the original configuration (theoretically according to TCPOptimizer), But this program may have messed up some internet settings? Also have been using Registry cleaner often which again might have messed up internet settings? Anyway ran FRST64 fix with the following result. Fixlog.txt

Re-ran FRST64 again with results enclosed below. As a long shot, tried adding MBAM exceptions to Windows firewall, but made no difference regarding MBAM updating (updates still not finishing downloading, and still get "Unable to access update server" message after awhile). FRST.txt Addition.txt

Just tried updating MBAM V 2.1.7.1055 database again. But after 7 minutes of downloading the updates, MBAM stopped downloading and got message "Unable to access update server", once again.

OK. Applied TermService.reg fix, and ran FRST64 with fix function. Results below. Fixlog.txt

Ran FRST64 again and searched registry for wanted text string with the results attached below. However, the registry fix file linked to Zippyshare appears to be the same NlaSvc.reg file as before? TermService.reg file is not seen at Zippyshare site as linked. Search.txt

Ran mbam-check with the following result. CheckResults.txt

Reinstalled and ran MBAM version 2.1.7.1055. MBAM then started searching for database updates. But after about 10 minutes of waiting for updates to actually start downloading I stopped MBAM as it seemed to be taking a bit too long to find updates. Restarted MBAM, and after searching for database updates for about 5 minutes, MBAM started downloading updates. Unfortunately after 6 minutes of downloading updates, MBAM stopped downloading and an error message appeared "Unable to access update server". So there is still an issue with inability to complete update downloads.

Downloaded and merged "registry fix". Although forgot to make backup of registry first. Sorry about that! Re-ran FRST64 with following results. FRST.txt Addition.txt

TDSSKiller downloaded and run with no obvivious threats detected. Log enclosed. FRST64 ran again. No obvious threats or concerns noted. Logs enclosed. TDSSKiller.3.0.0.44_21.06.2015_00.37.47_log.txt FRST.txt Addition.txt

Again had some difficulty in downloading MBAR using a download manager. But managed to download it and extract/run it. Trying to update MBAR database, but, once again, the update stopped after approximately 10 minutes or so. And the download progress had not shown the update as being finished yet. Message on MBAR stated something to the effect that the update was successful anyway. Tried to scan but got error message "Could not initialize database", and MBAR stopped. Tried updating database again, but after a minute or so MBAR claimed update was successful. Tried again to scan but got the same error message Could not initiliaze database, and MBAR stopped once again. I vaguely recall having some similar issue sometime ago with MBAR (that is, the updates didn't work and/or scans didn't work?), but I think it was suggested by someone that MBAM with Scan for Rootkits option was the better option instead of using MBAR. In any case updates seem to be impossible at the moment. There seems to be a definite problem in trying to update MBAM and MBAR! The updates are not being downloaded completely and/or not installed properly (although it seems more like the updates are not being fully downloaded). Again, some hidden malware may be causing the failure of updates? Or is there a problem with the update server(s)? Or some other issue? What do we do now? As a last resort I might have to do a complete wipe of the HDD, reformat it etc., but only if there is no other option.

Thanks for the link! Despite using a download manager, there were difficulties in downloading this file. Although resuming downloads was supported, it appears that this download site uses time limited tokens/codes in which the download link would expire after a set amount of time. And downloads would not be able to be resumed after expiration of tokens/codes. The download stopped three times and would not resume, presumably because of expired tokens/codes. So, I had to manually restart the downloads three times and then copy the new token/code into the download manager in order to complete downloading. It seems the download site assumes everyone is using a fast (broadband) internet connection, so not a lot of download time is allocated for downloading this file. Unfortunately and very inconveniently, this causes issues for those trying to download files using slower internet connections (such as myself). Eventually downloaded and installed version 2.1.7.1055 of MBAM. Then tried updating MBAM database twice. Database appeared to be downloading/updating, but after approximately 10 ~ 15 minutes the updating stopped and got message "Unable to access update server" on both update attempts. Beginning to suspect that the "update server" (is it the same as the server for downloading programs as above?) may have download time limited tokens/codes as well? If so, then the time limits should be removed, or at the very least the time allowed for downloading updates should be extended substantially to allow plenty time for those using slow internet connections. Suggestions? Comments?

Thanks for the help so far! Unfortunately there still seems to be a problem with updating MBAM definitions/program. It seems that updates are attempted to be downloaded but eventually they stop being downloaded before downloads are completed for whatever reason(s)? And trying to run a (Threat) Scan, get error message "SDKDatabaseLoadDefaults failed with code: 20012" once the scan reaches Scan for Rootkits part of scan procedure and MBAM then stops running and shows a message that "Threat Scan completed successfully", when it hasn't!? I removed MBAM by using mbam-clean utility, then reinstalled MBAM 2.1.6.1022 free version, but still had above errors occuring. Either there is some well hidden malware causing these problems? Or maybe MBAM is bugged? Or maybe because I'm on a slow internet connection updates are not being downloaded fast enough? Or? Unfortunately at this time the issue has not as yet been resolved.

Downloaded fixlog.txt and re-ran FRST64 and this time using "Fix" function. Following log generated after FRST finished. Fixlog.txt

Re-ran FRST64 with the following results - FRST.txt Addition.txt

Thanks for prompt reply! Downloaded and ran Zoek. Computer was rebooted after Zoek finished scanning etc. Zoek log file attached. zoek-results.txt

Referred to this section from https://forums.malwarebytes.org/index.php?/topic/169455-mbam-version-2161022-not-working-properly/. Basically MBAM does work properly after trying to update (definitions) online. Suspected there may be some malware hidden somewhere causing this issue, and possibly causing some other (minor) computer issues also? MBAM works from clean install and provided that no updates have been attempted. As soon as updates have been attempted, MBAM only runs briefly and then stops/quits with one of two error messages appearing. Note that I'm using a dial-up (slow) internet connection, so what effect that may have on updates (if any) is unknown. Either the error is - "SDK. . database . . 21002" or similar message; or get "Threat Scan was canceled". MBAM stops with either of these error messages about the time the scan procedure reaches "Rootkits" stage (Rootkits scan enabled in MBAM settings). Running 2.1.6.1022 FREE version of MBAM. Attached are logs from FRST64 and mbam-check. FRST.txt Addition.txt CheckResults.txt

Ran FRST64 and then mabam-check . . with the following results. A quickish look through the results didn't appear to show any malware, although it was noted that MBAM update fileds were showing showing something like "00000.0000" which suggests the updates are/were not being downloaded/applied properly. FRST.txt Addition.txt CheckResults.txt

Running Windows 7 Professional x64 SP1. And using a slow DIAL-UP connection for the internet. After removing previous version of MBAM (version 2.0.4.1028) using mbam-clean......exe, downloaded and installed version 2.1.6.1022 of MBAM as a FREE version. While disconnected from the internet, MBAM ran through the process of scanning for threats (using default Threat Scan) and found none. MBAM seemed to work fine. However, as soon as the internet connection was restored, MBAM would automatically (try to) update itself. After the updates were (supposedly) finished after a few minutes or so, MBAM would then attempt to continue the Threat Scan. But as soon as it reaches around the "Rootkits" part of the scan procedure (I enabled Rootkits scan option in the settings), one of two errors would now always occur and MBAM would stop running. One error message box pops up saying something about "SDK. . .database . . error code 21002" <- or some similar number, don't recall the exact number. Other error is that a message appears saying that the "Threat Scan was canceled", yet the scan was not canceled by myself!? Briefly, the previous version of MBAM (V2.0.4.1028) basically worked OK, except the updates did not always seem to work or did not apply. But despite this, MBAM was still able to complete scans without any errors occuring. In summary. New/clean installation of MBAM V2.1.6.1022 seems to work properly while computer disconnected from the internet. But as soon as updates via internet are attempted, MBAM no longer works properly. What's going on? Updates via the internet are often a problem for MBAM. Is it because of my slow connection? Is there another way to download updates instead of via MBAM program?

Thanks for the response. MBAR Beta has subsequently been deleted from my computer. However, before that, I temporarily deleted MBAR then reinstalled it. This time database update was NOT made, and MBAR did scan as requested with no issues! Then database was updated and received message database was successfully installed. Tried scanning again, but got error "Initializing Database Failed" (or similar message). That suggests that perhaps there is/was an issue with the database, or maybe the database wasn't successfully installed despite the message to the contrary? Downloaded FRST to my desktop and running (as administrator) produced the files FRST.txt and Addition.txt FRST.txt Addition.txt MBAM is already installed on my system. But downloaded another copy to my desktop. But this downloaded executable is an installer, and it is not clear from the "Diagnostic Logs" link where MBAM is supposed to be installed (to the Desktop, or to C:\Progarm Files . . . by default)? I installed it to the default location. Ran and updated MBAM database, then clicked Scan Now. By default NO log file was produced. At the end of the scan a message box appeared and you had to click on "View Detailed Log" and then Export the log in text format and save it as "Checkresults.txt". Checkresults.txt file attached also. checkresults.txt

Last night downloaded and "installed" Malwarebytes Anti-Rootkit BETA to a folder "mbar" in C: drive (C:\mbar). Using Windows 7 X64 SP1. Ran the mbar.exe file within the above directory to start the program. Then updated programs database via internet. Message appeared within the programs window showing "Initializing . . ". Waited for a minute or so, but nothing seemed to have changed. Clicked on "Scan" button but got error message saying something about "Database Initializing Failed" (or something to that effect). Clicked "Previous" button to try again. Message "Initializing . . : once again appeared in the programs window. Waited for about two minutes and nothing seemed to have changed. Tried clicking the "Scan" button and again got error message about "initializing failed"!? Switched off computer overnight. Tried running the program again this morning. Did not attempt database updating via internet this time. Clicked "Scan" button and this time another error message appeared "Could not initialize database". Tried several times to scan but got the same error message!? What is wrong? Why isn't the program working properly?