ajw1100

Hi Ron. Thank you for your reply, I take your point on registry cleaners and will read from the suggested link. In the mean time attached are the two logs you have requested. I hope they show something that can correct the problem. I tried to run the CHKDSK command on my PC, that resulted in a message "Chk Disc cannot run because the volume is in use by another process..............Do you wish to force dismount?" Didn't fancy that as it was bound to go wrong, so I turned off the PC and removed the lead and plugged it into my laptop, then ran CHKDSK. the result is below: Microsoft Windows [Version 10.0.15063] (c) 2017 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>chkdsk d: /f The type of the file system is NTFS. Volume label is WD Removable Drive. Stage 1: Examining basic file system structure ... 76032 file records processed. File verification completed. 4 large file records processed. 0 bad file records processed. Stage 2: Examining file name linkage ... 85730 index entries processed. Index verification completed. CHKDSK is scanning unindexed files for reconnect to their original directory. 1 unindexed files scanned. Recovering orphaned file OFFICE~1.ISO (6F8C) into directory file 2982. 1 unindexed files recovered to original directory. 0 unindexed files recovered to lost and found. Stage 3: Examining security descriptors ... Security descriptor verification completed. 4850 data files processed. CHKDSK is verifying Usn Journal... Usn Journal verification completed. CHKDSK discovered free space marked as allocated in the volume bitmap. Windows has made corrections to the file system. No further action is required. 117218240 KB total disk space. 76877316 KB in 45022 files. 19056 KB in 4851 indexes. 0 KB in bad sectors. 145604 KB in use by the system. 65536 KB occupied by the log file. 40176264 KB available on disk. 4096 bytes in each allocation unit. 29304560 total allocation units on disk. 10044066 allocation units available on disk. C:\WINDOWS\system32> Thanks for your help on this. Alan. mb-check-results.zip mb-clean-results.txt

Problems not over yet I am sorry to say. This seems a bit odd to me....... 'My Picture' folder is on my I:Drive, a removable WD 500GB drive. This has all my main folders, Data, Pictures, Downloads and a host of other stuff, had it for years. I have uninstalled, reinstalled, PSPA, cleaned registry with CCleaner manually removed all folders containing PSPA from drives and the registry and for the umpteenth time reinstalled it. When I attempt to modify a photo in any sub folder of My Pictures on my I: Drive the message appears "Error writing to file". I have copied the My Pictures folder and sub folders to two other drives and can amend and modify any photo in any folder on either drive so far without a problem. I copied the folder from one of the new drives back to my I: Drive calling it 'My Pictures 1', so that was a new folder on the I: Drive; however when I attempt to modify a photo the same message appears. It would seem to me from the above that something happened to my I: Drive when MWB threw a spanner in the works! But I have no idea as to what that was!! Having My Pictures on another drive is not really practical and makes things more complicated in terms of backups and 'Save In' commands for various programs etc. My options seem limited, either transfer everything to one of the other drives and call that I: Drive, or copy across temporarily, format my WD I: Drive and copy it all back again and hope the problem has been eradicated. Any suggestions folks?

Hi Rich. Thank you for your assistance, looks like the problem was the repetition of an action that triggered the Ransomware protection. As a point of possible interest I also have Bitdefender total security 2018 with ransomware but that did not react. I have added the .exe file to the exclusions and updated to the latest version. I am investigating how I can further protect my files and folders from ransomware, I back up to external drives but have left these attached so they would probably be attacked as well, . I also have BT Cloud, Google Drive and Dropbox storage in use and am now about to use an external drive that I will only connect to do backups and remove once done. While typing this, I note another post from Ron Lewis, I will follow his link which may help to correct the problem I still have.

I hope you can find the problem, if it is as I guess then excluding the program should be all that is needed. MBAMSERVICE.LOG

Well, good news and not so good news. After uninstalling, CCleaning, Reg' cleaning and re-installing I got PSPA up and running again, and seemed to be functioning as before, except the update program could still not find the program. So I continued to work on my cruise folder. After about 20+ minutes, you guessed it........... As the snippets below show, MWB killed PSPA in its tracks and again no choice other than a reboot. This time I selected restore! I will see how things go with the program which is now in the excluded list. Thinking about the two instances of program death, I was doing the same operation. There were some thumbnails that were shown as 90 degrees out, these needed to be rotated to the right by 90 degrees, early on in the folder there were batches on 3~5 that needed to be rotated, using Ctrl I selected each one then hit Ctrl +R, they then rotated as needed. Then I found a about a dozen or so and selected them all using shift on first and last, then Ctrl +R- exactly as I had last time - I watched as the thumbnails rotated, about half way through MWB Struck as below. It could be coincidence or perhaps MWB thinks repetition of the same command constitutes a ransomware threat? That's not based on any logical reason other than the same problem at roughly the same point. This does not explain why its not occurred during the last year or so or why I can no longer install the update file.

Here goes: ticket 2131851 I have kept things simple and given a link to this thread, I hope that that will be sufficient for them. I did select the dropdown regarding ransomware but that linked to me emailing some logs and to do that it took me to a webpage 'GURU' which required me to register, which I thought was odd, surely MWB can sort its own problems out. I will be quite busy today, my 92 year old Mother-in Law was taken into hospital late last night so our plans for the next few days have gone out the window.

Will do. I am in the UK and I assume you are not so time differences come into play, we are on GMT so no idea what our times would be to match yours. Strange thing is I have been using MWB Premium for around a year and during that time have run PSPA without any intrusion from MWB. Indeed I was using PSPA for around 30 min when MWB jumped in. I hope there is a simple and straightforward remedy, I am not very knowledgeable with computer sorting, although I did build this PC some time ago. I may, if things get too complicated just forget PSPA and use another photo program. However I do think it's down to the false positive by MWB that has caused this problem so hopefully MWB can fix it.

That seemed to have been accepted as no error reported. Thanks for the corrected text. However it has not made any difference to Save or Save As in PSPA they are both still greyed out. I need both so that I can mod a photo and 'Save As' and still keep the original. if it's just a rotate then a quick 'Save' and get on to the next one. I tried on my latest cruise photo folder and one from years ago to see if the problem is only on the folder at the time of the false detection, both folders are having the same save problem. I use PSPA on this PC, my laptop and my wife's laptop so obviously wish to keep the same program across all, PSPA is not complicated and so easier to use for the wife, I have tried Finestone Image Viewer but that has more knobs and buttons so she will most likely not want to use it. Where to now?

Somethings not quite right. Ctrl C'd your text across to Admin Command Prompt: Showed the following: Microsoft Windows [Version 10.0.15063] (c) 2017 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>attrib -h I:\My Pictures /s /d Parameter format not correct - C:\WINDOWS\system32> PSPA is sort of working, I can access the photos but 'Save' and 'Save as' are still greyed out and I am still unable to update as the update program cannot find the program itself, even though it is installed where it should be and always has been. C:\Program Files (x86)\Jasc Software Inc\Paint Shop Photo Album. The update program on a separate CD has previously found and updated without any problem.

This is the folder that had the first problem with MWB Ransomware. Med cruise scan.txt This folder contains 258 photos.

Huh? Folder properties list 7.30GB, 3394 files, in 60 folders. There are 4 odd .jpg photos not in any of the 60 folders. I set the scan to run the parent folder I guess it did not scan the others?

Here goes: My Pictures Scan.txt

I think I got it wrong so here it is again. This time its: c:\users\(your profile name) inside the tool. AccessEnum Alan.txt

Thank you for your help. I only hope I get this right. The folder is on a WD Drive I: I:\My Pictures I have downloaded the program above, the result is a text file which I have attached below. I opened the program within my User folder and clicked 'Scan' the directory shown was 'Windows' If I get it wrong I will try again. Yip, I got it wrong...... numpty

Been playing with this for most of the evening, I have a lot of photo folders on my 'I' drive and it seems none of the photos in any of the sub folders can be modified, every one reports that the file cannot be modified as it may be 'read only'. I downloaded and installed the program Faststone Image Viewer and that gave the same result on the same folders. I copied 'My Pictures' and all sub folders to another drive and tried again. PSPA again had save and save as greyed out but I could modify the photos ( just used rotate to test it out) and after closing the changes remained when the folder was re-opened. Faststone allowed changes and saving with no problems. From this I can only assume - rightly or wrongly- that something went badly wrong when MWB closed off PSPA suddenly and somehow my 'My Pictures' structure got screwed up some how. I had been using it to mod a new set of holiday photos and had been working with PSPA for about half an hour before the ransomware problem. The only way I can think of sorting it out is to delete 'My Pictures' folder and all sub folders from 'I' then copy them back from the second drive I have just copied them to. If they still have a problem I suppose I could just use the other drive, but that is mainly a back up drive and not used for main files. It would be best to get back to where I was before the problem occurred.

Hi. Not been able to find a fix so far but will keep trying. If all else fails I can always download a different photo album app. PSPA is around 14 years old and it has always installed without the need for registration or had a license key to enter. Those were the days eh?! I'm used to it so didn't want the usual hassle of learning a new program. Thanks for the tip, I will know for next time, pity I did not know before. Best regards Alan.

Hi Shadowwar. Thanks for your reply. Since this problem the 'view hidden files and folders' had reverted to hidden. could be a coincidence though. MBAMSERVICE.LOG

Hi. I've been using Jasc Paint Shop Photo Album since 2003 without any problems. Yesterday evening while working on a new photo file MWB suddenly came up with pop-ups stating pspa was ransom ware and had been quarantined and that I needed to restart my PC. I tried to get out of this as I knew pspa was not ransomware but nothing seemed to work and I had to restart my PC. From then on things went from bad to worse, so bad I ended up uninstalling the program and running CCleaner to remove traces from the registry. I have reinstalled the program but am unable to install the subsequent pspa patch I have that has always installed previously, through win 98 to win 10 64. Worked fine in Win 10 for about 2+ years. When attempting install the patch it advises the program in not installed or the patch is wrong for the program. The program is installed in the same 'program files (x86)' as it was before so don't understand why the patch cannot find it. The program now allows me to access my photo files but am unable to save any changes, the 'save' and 'save as' or both greyed out, I can change and rotate photos but not save them. I am not sure what has gone wrong and being a pensioner not too hot on these subjects. I can only guess that somewhere along the screw up a setting has changed. I have checked the security tab of the files and this seems to show full access for all users, but hey guys I am just poking and hoping I stumble across something that might sort it. 14 years without a problem in all incarnations of Windows then MWB comes along and ...............!! This is very annoying as I was working on a set of photos just back from a cruise and pray that the files are not corrupted after the false ransomware error. Hopefully someone will be able to give me some idea as to what may be the problem and more importantly, how to fix it. Thanks for any help. Alan. MWB Log for pspa.txt