mmja

Yep, the older version of Samsung Magician (Samsung_Magician_Installer_Official_7.3.0.1100) works fine! So its not MBAM issue after all! Im so sorry for your troubles. I have to say, I got very, very good help from you folks. Especially you Porthos! Thank you!

This is what I tought too, but that does not explain why the old version of Samsung Magician ran without any problems. I used it just few days ago and it worked fine. The new version does not. I dont remember exact version number and I dont know where I could download the previous version of Samsung Magician to test it.

After several more reboots and manual removals I have managed to get to situation where: - Samsung Magician installs fine, but GUI/app does not open (it does run in the backround with 2-3 processes). - Samsung Magician can be easily/normally installed and uninstalled - MBAM runs normally and can be easily/normally installed and uninstalled Right now I have uninstalled Samsung Magician but have MBAM installed and running.

Ok I reboot again and tryed to install Samsung Magician. Installs, but does not start. Difficult to remove. Removed. Rebooted. WTF? How could MBAM break my computer in such way that I can no longer use Samsung Magician at all, not even after completely uninstalling MBAM?!? WTF? What should I do now?

CORRECTION: I sayed:"Yes told me to disable tamper protection before uninstalling MBAM, but when I uninstalled MBAM it asked for tamper protection password" I meant:"You told me to disable tamper protection before uninstalling MBAB, but when I unistalled MBAM it asked for tamper protection password which I gave to it so it could proceed"

Ok apparently now I have managed to completely uninstall MBAM and SM. Yes told me to disable tamper protection before uninstalling MBAM, but when I uninstalled MBAM it asked for tamper protection password...I did not disable tamper protection because I had not read your message before that. Is this going to mess up something? Im a bit worried about this "File C:\WINDOWS\system32\drivers\wintun.sys move to C:\Users\X\AppData\Local\Temp\6ee921fd-4845-4133-853e-bbfd7792d91c failed with error 5...Failed to delete File C:\WINDOWS\system32\drivers\wintun.sys, reason:(Cannot create a file when that file already exists.(error=183)),...Failed to create PFRO for C:\WINDOWS\system32\drivers\wintun.sys, reason: (Access is denied.(error=5))." WHAT IS THIS?!?! Is something still wrong?!?! Did it not uninstall properly? What is that .sys file and what MBAM uninstall is trying to do it? Why? How? Here is the complete log I got when I ran the support tools uninstaller: 2023-10-07 10:26:49.311 --------LOGGING STARTED---------- 2023-10-07 10:26:49.312 -------------------------------------------------------- 2023-10-07 10:26:49.312 -------------------------------------------------------- 2023-10-07 10:26:49.313 -------------------------------------------------------- 2023-10-07 10:26:49.313 Failed to Determine if Tamper Protection is enabled, PoliciesConfig.json file not found. 2023-10-07 10:26:49.314 Tool Version: 1.9.2.982 2023-10-07 10:26:49.315 Dll Version (LUA): 2.1.3.343 2023-10-07 10:26:49.315 Log Path: C:\Users\X\AppData\Local\Temp\mbst-clean-results.txt 2023-10-07 10:26:49.319 User Account Type: Administrator 2023-10-07 10:26:49.320 Date/Time Log Created: 2023-10-07 10:26:49.319 2023-10-07 10:26:49.320 Operating System: Windows 10 (Build 19045.3448) x64 2023-10-07 10:26:49.321 2023-10-07 10:26:49.321 ====================================================== 2023-10-07 10:26:49.321 Pre-Reboot Cleanup 2023-10-07 10:26:49.322 ====================================================== 2023-10-07 10:26:49.328 OpenService mbamchameleon failed (1060) 2023-10-07 10:26:49.328 The specified service does not exist as an installed service. 2023-10-07 10:26:49.329 Terminate AE Process name:C:\Program Files\Malwarebytes\Privacy\mbamservice.exe 2023-10-07 10:26:49.342 Terminate AE Process name:C:\Program Files\Malwarebytes\Privacy\mbae-cli.exe 2023-10-07 10:26:49.356 Terminate AE Process name:C:\Program Files\Malwarebytes\Privacy\mbae-svc.exe 2023-10-07 10:26:49.369 Terminate AE Process name:C:\Program Files\Malwarebytes\Privacy\mbae.exe 2023-10-07 10:26:49.382 Terminate AE Process name:C:\Program Files\Malwarebytes\Privacy\mbae64.exe 2023-10-07 10:26:49.396 OpenService mbamchameleon failed (1060) 2023-10-07 10:26:49.396 The specified service does not exist as an installed service. 2023-10-07 10:26:49.414 Launching process:C:\Program Files\Malwarebytes\Privacy\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /log="C:\Users\X\AppData\Local\Temp\Mbae.log" 2023-10-07 10:26:49.443 Failed to launch C:\Program Files\Malwarebytes\Privacy\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /log="C:\Users\X\AppData\Local\Temp\Mbae.log", reason:(The system cannot find the file specified.(error=2)) 2023-10-07 10:26:49.444 File C:\WINDOWS\system32\drivers\wintun.sys move to C:\Users\X\AppData\Local\Temp\6ee921fd-4845-4133-853e-bbfd7792d91c failed with error 5 2023-10-07 10:26:49.445 Failed to delete File C:\WINDOWS\system32\drivers\wintun.sys, reason:(Cannot create a file when that file already exists.(error=183)), 2023-10-07 10:26:49.445 Failed to create PFRO for C:\WINDOWS\system32\drivers\wintun.sys, reason: (Access is denied.(error=5)). 2023-10-07 10:26:53.286 Cleanup Succeeded of : MBAM1X. 2023-10-07 10:26:53.286 Cleanup Succeeded of : MBAM2X. 2023-10-07 10:26:53.286 Cleanup Succeeded of : MBAM3X. 2023-10-07 10:26:53.287 Cleanup Succeeded of : MBAE. 2023-10-07 10:26:53.287 Cleanup Succeeded of : MBMC. 2023-10-07 10:26:53.287 Cleanup Succeeded of : MBARW. 2023-10-07 10:26:53.288 Cleanup Succeeded of : MBEPA. 2023-10-07 10:26:53.288 Cleanup Succeeded of : MBPRIVACY. 2023-10-07 10:26:53.288 Cleanup Succeeded of : MBPRIVACYTUNNELDRIVER. 2023-10-07 10:27:05.939 2023-10-07 10:27:05.940 ====================================================== 2023-10-07 10:27:05.940 Install Malwarebytes for Windows 2023-10-07 10:27:05.940 ====================================================== 2023-10-07 10:27:05.941 User choice for reinstall prompt (No clicked)

1) Removed MBAM -> Reboot -> Samsung Magician does not work! 2) Tryed to remove Samsung Magician -> Does not work! Uninstall errors! 3) Killed Samsung Magician services, processes, etc. set them to disable on start -> Reboot 4) Managed to remove Samsung Magician -> Reboot 5) Removed every folder etc. that has anything to do with Samsung Magician -> Reboot 6) Installed Samsung Magician again -> Samsung Magician does not work! 7) Tryed to remove Samsung Magician -> Does not work! Uninstall errors! 8) Cleaned MBAM remains (if there even where any) according to your posts guide. 8) Killed Samsung Magician services, processes, etc. set them to disable on start -> Reboot ....let see what happens now.

Did that, restarted computer, still Samsung Magician (GUI/APP) does not start. Now my cursors is showing this "circle" everywhere, like Windows or something is trying to do something (loading something?) in the backround. Malwarebytes services consumes 16% of CPU all the time. There is also several "Samsung Magician 32bit" processes in the backround popping up and if I kill them they pop up again. "Samsung Rapid service" is also running. I will try to uninstall Samsung Magician comletely, reboot, reinstall it and see what happens.

Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 10/7/23 Protection Event Time: 9:09 AM Log File: 1d372c99-64d8-11ee-af3b-2cfda1e073b2.json -Software Information- Version: 4.6.4.286 Components Version: 1.0.2163 Update Package Version: 1.0.76015 License: Premium -System Information- OS: Windows 10 (Build 19045.3448) CPU: x64 File System: NTFS User: System -Exploit Details- File: 0 (No malicious items detected) Exploit: 1 Exploit.T1055DefenseEvasion, , Blocked, 519, 392684, 0.0.0, , -Exploit Data- Affected Application: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Protection Layer: APT Behavior Protection Protection Technique: T1055 - Defense Evasion File Name: URL: (end)

Thanks for quick reply! Here are the logs: mbst-grab-results.zip

I have same problem, I have updated to Beta and latest updates, still Magician fails to start and "exploit" is detected. There does not seem to be any viable means to just ignore the "exploit warning" and go on? What should I do?