LuvKhephren

Let me know if this question is not the correct use of this forum. The virtualcustoms url shows 1/71 on virustotal with Dr. Web marked as Malicious (not familiar with that product). This site seems to have a lot of traffic and apparently a good reputation. Does anyone know of a reason not to whitelist it?

I am so sorry, I can't believe it's been ten days. I followed your instructions and attached the procmon file. Now the scan is showing 61 objects whenever a file is scanned. Thanks for your patience (at least you didn't close the thread). Logfile.zip

Addendum to above: However right clicking and scanning the file directly still obtains 78 as the number of objects/items scanned. Also in the above post the second, fifth and eighth images are the right click method and the third, sixth and ninth are from the Scan tab.

All of the custom scans that I referred to in my original post were initiated from the right click context menu in either File (Windows) Explorer or Multi Commander. The possible motive for your question made me initiate a scan from the Scan tab within Malwarebytes to see if it made a difference. It didn't. The files I tested on were rkill.exe, tdsskiller.exe , and AdwCleaner.exe as d/l'ed from a popular website and stored for each test in a folder by themselves. The right click method was performed on the folder itself to duplicate conditions with the Scan tab method (i.e. a single file in a folder). Also Scan Memory Objects and Scan Startup and Registry Settings were disabled for the same reason.

For every custom scan performed the number of objects scanned/items scanned always equals 78. Is this normal and I've just never noticed it before?