KEL1

The "Block Penetration Testing attacks WAS NOT TURNED ON. Also, a second topic for me on this issue was opened by Maurice Nagger,. If you look at it you will see what has taken place over the last day. I really don't want to have two topics to address the same issue. Maybe they can be combined somehow. That would be great!

Maurice, XXX is back and has contacted me about my other topic on this same issue. Is there anyway you can work together and address this on only one topic? Thanks!

Here is a MWB Scan that was just run... Also there were 2 Detection History Logs created today. The indicaExploit Blocked part 2 (9-5-2023).txtExploit Blocked part 1 (9-5-2023).txtScan Report 9-5-2023.txtted a different path from the previous ones.

OK...here is the Avast Targeted Scan on the C drive log. Targeted Scan.txt

Do you want me to run an Avast Full System Scan or a Targeted Scan on the C drive?

Followed your Instructions. Attached is the Fixlog that was generated. Fixlog.txt

Tried to run FRSTENGLISH. It was flagged by AVAST as a threat, infected with IDP.ALEXA.53 and Quarantined. (see attachments) What should I do next? Ignore AVAST , remove it from Quarantine and create it as an exception in AVAST? Please let me know what I should do next. Thanks. (Note: will not be upgrading this PC to Windows 10 at this time. Thanks for asking)

ESET scan log attached. ESET Scan Log 9-4-2023.txt

Attached are the results of running Microsoft Safety Scanner. It also reported that it had removed PUABundler:Win32/PiriformBundler msert.log

Are you asking me to DO a Microsoft Safety Scanner run?

Hello Maurice, Thank you for contacting me. I was only commenting on the topic by LanDroid ,(Blocked: sysnative\cmd.exe ..... \crytography\v MachinGuid ...) I did not mean to create any confusion. I already have an open topic on this issue of my own. https://forums.malwarebytes.com/topic/301888-exploit-payload-process-blocked-quarantined-but-nothing-in-quarantine/ Please take a look at it and see how you would like to proceed. On My Original Topic …. (EXPLOIT Payload Process Blocked & Quarantined but nothing in Quarantine??, ID 1586966), PORTHOS contacted me and had me attach some logs from the MWB SCAN and PROTECTION Logs. Porthos also commented: Exploit protection has become very aggressive in order to block the current exploits. I am waiting for @Arthi to return from the long holiday to advise us. Yours is not the only report like this. In addition to the information on my original topic I have followed your instructions through step 7. Download and run the MalwareBytes Support Tool and attaching the logs generated to this topic. I will wait for your instructions before taking any further steps. mbst-grab-results.zip

Thankyou for your reply. Attached are 3 logs: 1- Block of cmd.exe 2- Quarantine of cmd.exe 3- Block of MachineGuid Blocked cmd exe 9-4-2023.txt Blocked MachineGuid 9-4-2023.txt Quarantined cmd exc 9-4-2023.txt

I am also having the same issue. I started a new topic because I had not seen yours. This started for me 8/31/2023. Messages List these as the Blocked & Quarentined , but nothing is listed in the Quarantine c:\WINDOWS\sysnative\cmd.exe c:\WINDOWS\sysnative\cmd.exe C:Windows\sysnative\cmd.exe \c C:\WindowSystem32\REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography \v MachineGuid Wish I could be of some help. Hopefully an answer will be provided!

Beginning on 8/31/2023 MWB Started frequently executing “ EXPLOIT Payload Process Block”. Message says: Expoit Blocked Exploit attempt detected and blocked. It is no longer a threat. Open quarantine to learn more. This is documented : Under the BELL(Notifications) there is a note documenting it. Under Detection History: Nothing is listed under Quarantined Items Under History there is a list of items that state the date the time and that something was blocked and quarantined. It happened : Logging into GMAIL Logging into Bank site 5 Other times since 8/31/2023 that I am not sure of what was happening. If the time listed for each item are correct, one I was not even using the computer at the time. MWB Version: 4.6.1.280 Update Package Version: 1.0.7.4843 Component Package Version: 1.0.21187 Messages List these as the Blocked & Quarentined: c:\WINDOWS\sysnative\cmd.exe c:\WINDOWS\sysnative\cmd.exe C:Windows\sysnative\cmd.exe \c C:\WindowSystem32\REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography \v MachineGuid I ran all PC Scans to detect Malware and found none. Is this a false negative situation? Or am I missing something? Can you please help? Thankyou.

I am experiencing the same issue today July 27,2022. The internet is up and working fine. As others have mentioned in other posts it seems to be the ability to connect to the update servers. This seems to be an on going issue. Any idea if there will be a fix ?

This is happening to me today. I know my internet is working, but am getting the messages that it can't connect to the update server when I ask for an update. Seems like this has been going on for at least a week. Any idea if this will be fixed or is this just normal? If I am persistent, and keep trying it will occasionally connect and provide an update. Thanks!

My UI would not open after updating MBW. I had to do a clean install to get it to work. I did not have any WINDOWs updates. But I did have an update to Avast and after that MWB UI stopped working.

Thanks for the information. Thank you to everyone willing to share. I learned a lot. For me , I guess I should just let this go now. Good Luck to everyone.

Well, I used the MWB Support Tool to uninstall and reinstall MWB. It made no difference in the scan time. They are still 3 to 4 times longer than before the update to Version: 4.1.2.73,Components Version: 1.0.976. Guess it must be my "old" PC. -Log Details- Scan Date: 7/6/20 Scan Time: 6:41 PM Log File: e04c679a-bfd9-11ea-8ea5-989096b648a3.json -Software Information- Version: 4.1.2.73 Components Version: 1.0.976 Update Package Version: 1.0.26509 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 226836 Threats Detected: 0 Threats Quarantined: 0 Time Elapsed: 12 min, 23 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 0 (No malicious items detected) Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end)

Some clarification on my original information when I started this Topic…. Since upgrading MWB from Version 4.1.0.56 to 4.1.2.73 the scan time has increased by approx. 3X. It just seems strange that the scan time changes so much. Here is some information that might be informative to understanding what is happening…. Software Information- Version: 4.1.2.73 Components Version: 1.0.972 Update Package Version: 1.0.26469 License: Premium System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS Date Manual/Scheduled MWB Version Componant Pkg scan time # files scanned 7/1/2020 sched 4.1.0.56 1.0.955 6:45 227007 7/2/2020 sched 4.1.0.56 1.0.955 6:32 227009 7/3/2020 sched 4.1.2.73 1.0.972 15:19 227202 7/4/2020 sched 4.1.2.73 1.0.972 15:39 227260 7/5/2020 sched 4.1.2.73 1.0.972 17:29 227215 7/6/2020 sched 4.1.2.73 1.0.972 17:20 227246 6/16/2020 Manual 4.1.0.56 1.0.955 2:30 227154 6/29/2020 Manual 4.1.0.56 1.0.955 2:14 227404 7/2/2020 Manual 4.1.2.73 1.0.972 12:59 227248 7/3/2020 Manual 4.1.2.73 1.0.972 11:16 227351 7/5/2020 Manual 4.1.2.73 1.0.972 11:51 227354 7/6/2020 Manual 4.1.2.73 1.0.972 11:57 227422 One of the Previous posters said something that made it sound like an uninstall/reinstall using the MWB support tool improved scan time???? This got me thinking……. Is it my machine OR a change in MWB???? Uninstall/reinstall seems drastic but doable Would hate to think every time there is a MWB Upgrade would need to do this. So I downloaded the MWB Support Tool. Here is the log:mbst-grab-results.zip Can anyone tell what has changed and why this is happening? Thank You!

Thank you for your reply. Hope you have a wonderful Holiday weekend. Stay safe!

Thank you to everyone for your comments. Just to clarify ... 1) Based on the above information, Does it sound like every thing is OK with Malwarebytes update on my PC? 2) Is there any need for me to Download the Malwarebytes Support Tool and generate a log file to post? Thanks!

On this machine which is Win 7 Professional 64 bit , NO SSD the scan time increased by 8-9 minutes. But it is consistent on all runs , so I guess "it is what it is"! Not sure why it would do that with a Version upgrade , but unless someone has an idea that something is wrong ....? Thanks!

Thanks for your fast reply and all your helpful information. 1) Fast Start is not an issue. So we are good there!:-) 2) I did NOT Manually check for Updates before starting a scan.( never had to before, so did not think to check manually first) Now I know and will be sure to Manually check first. Thank you again for your time and for sharing your expertise. It is much appreciated.

Ran the update, got the all ok message. then restarted the PC. After the restart, MWB had the Malware Protection Turned OFF and would not let me turn it on. Shutdown PC and then started it up. Now the Malware Protection was on. Tried to run a scan , but it got stuck on CHECKING For Updates (20 minutes and counting...), it wouldn't allow me to pause or cancel. I went into task manager and ended MWB. But it was still running "Check for updates" when I opened it. So, I shut down the PC. Restarted PC MWB looked ok, so , then I ran the scan that went for 13 minutes. At this time It seems to be working , but I really don't know how to tell. Your thoughts?