tommytiko

Thanks Porthos and Imacri. I ended up updating via the repair tool because I thought I should obey the automated response to my initial post, where it says: If you are having technical issues with our Windows product, please do the following: Malwarebytes Support Tool - Advanced Options etc.. When I ran the repair function to see what it involved, the support tool proceeded to update my version of MWB without warning me that that was what it was going to do. I gather that I should uninstall v2.2.1.1043, which is the currently installed version, and instal v3.5.1.2522, otherwise than via the support tool. It is not clear whether I need to use a clean up tool, but if I do it seems that the favoured version is mb-clean-3.1.0.1035.exe. I think I will try the process without using the clean up tool first, and then use it if I am still having trouble. I will report back.

Thanks Porthos and Imacri. I updated from v2.2.1.1043 to 3.5.1.2522, which I assume is the same as the verion downloaded from the link you provided (mb3-setup-legacywos-3.5.1.2522-1.0.365-1.0.5292.exe) by running the repair function in mb-support-1.8.7.918.exe. Then I found that windows kept crashing and Whocrashed attributed the crashes to a Malwarebytes driver. I have stopped the crashes by restoring my system from an image made before I ran the repair function and thus updated to v3.5.1.2522. Should I try to install v3.5.1.2522 in a different way?

mbst-grab-results.zip Logs herwith as requested by automated reply.

My last update was 2022.4.2.5. I know my system is a touch out of date. I wonder why it is not updating, and whether this can be fixed.

Thanks Ron, but I tried that, and I am afraid that the one persistent issue is that the anti-exploit protection does not work. I have however suffered system damage from trying out the repair programs and therefore restored the system to a time prior to my installing version 3 of MWB and reinstalled all subsequent new programs and updates etc that I wanted to retain, and the system is working fine again. I'd be happy to help to investigate this by restoring my current system to a spare drive and then working on that, however, and glad to discover any remediable problem on my system that is interfering with MWB Anti-exploit. I used to run MWB Anti-Exploit together with MWB v2, but at some point Anti-exploit stopped working - as I recall, it would not run atall. At the time (August 2016), I tried to analyse what was causing this by restoring my system to earlier states when MWB Anti-Exploit had been working, but with confusing results, and I never established what had caused it to stop working. I suspected an update to some long ago installed product such as MS Office or Java, but never got to the bottom of it. Are you sure that the anti-exploit protection should work on XP? I vaguely seem to recall reading in the MWB forum that anti-exploit protection would not be available in MWB v3 running on XP, but if I did I have not found where it was.

Thanks Ron. I am afraid that combofix seemed to hang, and I left it running for ages in case it needed time - about 5hours. So that failed. The VSS errors you identified are probably due to VeraCrypt - the VSS does not work on files in mounted bins, and VeraCrypt cannot fix it because Microsoft will not provide the information needed - something to do with the API.

Herewith logs. I might mention that I had to enter safe mode to run FRST.exe without a hang. I notice that for some reason the fixlist.txt file has disappeared, which seems very odd. Does it get deleted by running FRST.exe? Fixlog.txt Addition.txt mb-cleanresult.txt mb-clean-results.txt

Thanks for your amended instructions. I have followed them, but to no avail. Anti exploit protection appeared to start and then stopped, not to be restarted. The icon at first appeared in the system tray, but then disappeared, although mbamtray.exe appears in the windows taks manager. I note that I had to go into safe mode to run the cleanup tool without the system hanging, and that to install mbam without the system hanging I had to boot windows with all of the startups and non-windows services stopped by msconfig. Does this shed any light?

Thanks. My understanding is: 1. run FRST.exe, informed by the new fixlist.txt file, with additions selected, using the Fix option and then reboot; 2. run the cleanup tool and reboot; 3. run FRST.exe, informed by the same fixlist.txt file, with additions selected, using the Fix option, and reboot; 4. send the logs from FRST.txt and additions.txt from 1, and the same logs from 3. Is that right?

I am so sorry, but I am still not clear. I don't have a fix file. I think you mean me to run the FRST.exe file, which appears to be informed by a file named fixlist.txt. Do you mean that I should run the FRST.exe file, and if so, do you mean that when I do so I should run the Scan function, or that I should run the Fix function?

Thanks for your reply. Is the fixlog.txt file produced by running the fix option in FRST.exe? And would you like me to create the file before or after running the clean up tool? Shall I run the clean up tool with mbam still running, or should I stop it somehow - I suppose by turning off self protection in safe mode - before doing so? If I do not reply at some time tomorrow, it is because I shall be travelling then.

I have to add that while running FRST, Malwarebytes appeared to report the detection of some malware, for which it requested a reboot. I am afraid I did not record the name of the alleged malware. After rebooting, Malwarebytes no longer appears in the system tray, although mbam.exe and mbamservice.exe appear to be running in the windows task manager. Double clicking on mbamtray.exe in the program files folder does not produce an icon in the system tray, although after doing so it appears to be running in the windows task manager. I can terminate mbam.exe and restart it, but doing so does not produce a gui. Attempting to terminate mbamservice.exe causes a hang, so I am unable to reinstall mbam and I suspect that the self protection mode may be enabled, although I would have turned it off unless I forgot to do so after reinstalling mbam recently. I have yet to reboot in safe mode in order to turn off self protection mode in case it is activated. I thought I should report back before taking any action in case this is related to the other problems that I have been having and you would advise a particular course of action.

Ron, Thank you for your post and for taking an interest in this problem. I attach the first additions.txt, which I must have omitted to upload, and have renamed additions1.txt to distinguish it from the additions.txt file generated by following your instructions above. I believe I have followed your instructions and attach the 2 logs thus generated. I am reasonably relaxed about undertaking actions that might render the system unbootable, since I have a comprehensive system for imaging the system, but of course would prefer to do so in a way that leads to identification of the problem if possible. Thanks for your help, and I hope you will be able to shed light on what the problem is or may be. Please let me know if there is any further information I might provide that would assist. Addition1.txt Addition.txt FRST.txt

Thanks for the suggestion Devin. But I am afraid that after re-running the clean up tool in safe mode, and deleting any files or registry entries that still showed as not having been deleted in the resultant clean up log, I have got exactly the same result as before. The anti-exploit protection appears to be running for a few seconds but then ceases to do so and cannot be restarted. Can you suggest anything else, please?

I am still building a W10 machine. It is a big job and is taking time.

Thanks Devin. Herewith requested file. mb-check-results.zip

I have now uninstalled MBAM, cleaned up both MBAM and MBAE using Total Uninstall, then I ran the cleanup tool downloaded from the link you provided, ran the MBAM cleanup tool, and then I reinstalled MBAM. Although anti-exploit protection appeared to be on at first, it then turned itself off after perhaps 20 seconds, and when I try to turn it on, it turns off again within about 5 seconds or less. Can you suggest anything further, please?

Thanks again Devin. I will take you advice and report back. Perhaps I should mention that I had MB Anti-Exploit installed at one time. I think I uninstalled it before installing MBAM 3, or it went with the installation of MBAM 3. However, I monitor installations with Total Uninstall, and I have not removed traces of the program using Total Uninstall yet. I think I should perhaps do so before using the MBAM cleanup tool, unless you have a separate cleanup tool for MB Anti-Exploit. I can find no more instructions on removal of MBAE than are here: https://support.malwarebytes.com/docs/DOC-1203. If you are aware of a clean up tool for MBAE, please let me know.

Thanks Devin. That is most helpful. I have now updated to v3 by installing the download you provided a link for, and I can indeed now run Firefox with it installed. However, that leaves a couple of questions; 1. Should exploit protection be available in v3 running on xp? Is there any configuration of the advanced settings for exploit protection that will enable it to run on XP? 2. Is there anything I can do about the fact that I could not disable self protection mode? Or should I ignore it? 3. Having installed v3, I now have a warning, both on the dashboard and on the system tray icon, that protection is disabled, presumably because I cannot turn on exploit protection. If there is no way to turn exploit protection on, is there any way to turn off the constant warning on the dashboard and on the icon in the system tray?.

Thanks Firefox. That is most helpful. I have taken steps 1 and 2 in your post that you referred me to - deselecting check for program updates and checking that the self-protection module is not enabled. I do not have C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware on my computer, which I dare say is because it is an XP system and your instructions apply to a more modern system. However, I found the file you refer to in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Malware, and dealt with it by adding a ~to the file extension. If it does not work, I will report back with a further post here.

So, I now have 3 queries: 1. should anti-exploit protection be available in v3 running on xp; 2. is there anything I can do about the fact that I could not disable self protection mode; and 3. how can I turn off the nagger now working in v2 to tell me to update to v3, since I cannot update to v3 because v3 is not compatible with my internet browser, Firefox. Can anybody advise, please?

Thanks Porthos. Acting on your further advice, I reinstalled v3, but found that I was unable to turn off the self protection module - the slider switch in the GUI would not respond. I then found that I could not uninstall v3 via the uninstall link in the start menu or via add/remove programs in the control panel, and so I had to rip it out using Total Uninstall before I could reinstall v2. I might add, though it would appear to be a separate matter, that whereas anti-ransomware protection was shown in the GUI of v3 as unavailable (because it was running on XP Pro SP3, of course), anti-exploit protection appeared to be available - the slider switch would move to the on position - but the slider switch would turn off spontaneously a second or so after I had switched it on.

Thanks for the thought. I did not, but, although I could be wrong, I do not think it was turned on. It would not have been turned on before I installed v3. Is there reason to think that the problem with Firefox is due to self protection mode being activated?

It is a little irritating to be pestered constantly to upgrade to v3 of MWB when Firefox will not run when v3 is installed, so that I have to remain with v2 until I manage to update to windows 10.

Thank you both for that advice, my understanding of which is that in the update and subsequent versions the installer file will overwrite the signature files on the computer only if those on the computer are earlier versions than those in the installer file. With kind regards, Tom