Scanner Failed with Error Code 20026

[Drawingman]

Hi,

 

5 days ago I upgraded from the free Malwarebytes Anti-Malware to the Premium version 2.0.2.1012 along with Anti-Exploit version 1.03.1.1220.   I have the 'scan for rootkits' & 'the self-protection module enabled'.  I have set the anti-malware scan to run multiple times daily.  In the last 24 hours, I have received pop ups indicating the rootkit driver was not able to load and asking me to restart the computer to reattempt loading the driver.  Restarts do not appear to resolve the issue - during the subsequent scans Anti-malware returns a pop up saying "Scanner Failed with Error Code 20026".  Would you please suggest how to proceed to determine what is causing the problem and what I might do to correct it?

 

Some other information that might be helpful: 

• My computer is a Dell M4600, with an Intel i7-2960XM processor, 16GB RAM & 512GB Dell Mobility solid state 3 hard drive
• Windows 7 Professional Service Pack 1
• I've had the machine for 2 years and have had Norton Anti-virus on the machine from the beginning.  The current version is 21.3.0.12. 
• The free version of Malwarebytes Anti-virus has been on the machine for 10 months.
• I typically store larger directories on an external hard drive: a WD My passport 1GB

Thank you very much

[1PW]

Hello Drawingman and

Let's begin here:

• Please try the following and let us know if this corrects your issue: MBAM Clean Removal Process 2.x.
• If that does not correct the issue, then please read the following and attach the 3 requested logs in a reply to this thread: Diagnostic Logs.
• The 3 files, from Step 2, to be attached from your desktop are: 1) CheckResults.txt 2) FRST.txt 3) Addition.txt. Please do not Copy and Paste them into a reply.
• NOTE: There is an FAQ section with valuable information located in Common Questions, Issues, and their Solutions.

Please let us know the status of your issue in a reply to this thread.

Thank You.

[daledoc1]

Hi:

 

In addition to 1PW's excellent advice....

 

You mention that you have anti-rootkit (ARK) scanning enabled.

Is your drive encrypted with any method other than Truecrypt?

 

This error you report is commonly seen when ARK scanning is enabled for a drive encrypted by unsupported encryption methods (BitLocker, SecureDoc, etc).

For technical reasons, Truecrypt is the only encryption method for which MBAM ARK scanning is supported (regular scans without ARK are fine).

 

So, if you disable ARK from both the Settings > Detection and Protection area, as well as from the advanced settings for your scheduled scans, that should stop the error message.

 

If this scenario doesn't apply to your system, or disabling ARK doesn't resolve your issue, then, by all means, do please proceed with 1PW's suggested troubleshooting steps.

 

Please post back and let us know.

 

Thanks,

[Drawingman]

1PW & daledoc 1,

 

 

Thank you for your suggestions.  I will follow the procedure per 1PW's entry and attach the logs if required.

 

I'm not aware whether either of the two hard drives I use are encrypted.  Is there a directory I can go to in order to find that information?  If there is, what should I look for?

 

 

Thank you,

Drawingman 

[Drawingman]

1PW & daledoc 1,

 

I verified with Dell that the hard drive in the build of my laptop is not self-encrypting.  I browsed the documentation loaded on my external hard drive and found no mention of encryption.  I've also read the FAQs per 1PW's suggestion.

 

I did the re-install per the instructions for MBAM Clean Removal Process 2X.  The scan at the end of the re-installation was fine - no threats, no issues.

 

Threat Scan is set to investigate the internal hard drive only.  During the first scan I initiated following the re-install, the 'Check for Updates' function appeared to hang up for several minutes and a "(Not Responding)" text was added in the title bar of the function's dialog box.  It cleared itself and the scan proceeded normally.

 

I next enabled 'Scan for Rootkits' and initiated another scan.  As Anti-Malware was checking for updates, it returned a dialog box saying:

 

"Malwarebytes was unable to load the Anti-Rootkit DDA Driver, this error may be caused by rootkit activity.  Do you want to reboot the system and attempt to install the Driver?  (If you don't choose to reboot, Anti-Rootkit scanning will be disabled for this session)."

 

I restarted the machine and the scan continued automatically.  The scan appeared to work normally.  When the scan was finished, the computer screen went back-lit black except for the Anti-Malware dialog box.  Cntl+Alt+Del was the only option I found to cause the computer to respond.  I tried logging off and back on - no change.  Next I tried logging off and logging on to another user - the screen was normal.  I logged off the second user and re-logged on to the first user and the screen was back to normal; however, the customized functions of the mouse had been disabled (Logitech - Anywhere MX).

 

As a test, (without restarting the machine), I disabled 'Scan for Rootkits' and initiated another Threat Scan.  The scan ran with no issues and the computer screen was normal at the end of the scan.

 

Please find attached the log files you requested.  I'd welcome suggestions on what to try next.

 

 

 

Thank you,

Drawingman

CheckResults.txt

FRST.txt

Addition.txt

[1PW]

Hello Drawingman:

 

 

During the first scan I initiated following the re-install, the 'Check for Updates' function appeared to hang up for several minutes and a "(Not Responding)" text was added in the title bar of the function's dialog box.  It cleared itself and the scan proceeded normally.

 

This has the earmarks of a temporary troubles in the Internet path between your computer and the regional Content Delivery Network (CDN) server which I believe is dynamically assigned.

 

At this point it's best if we escalate your remaining issues to a Malwarebytes staffer.

 

Thank you.

[Drawingman]

Thank you 1PW and thank you daledoc 1.

 

Drawingman

[Drawingman]

I was able to resolve the mouse functioning issues by adding its main executables to the Malware Exclusions.

 

 

 

 

Drawingman 

[Drawingman]

Firefox,

Would you like for me start again with a new thread?

Thank you,

Drawingman

[Firefox]

No Drawingman those posts were meant for the folks that tagged along to your topic... if you are having any issues let us know otherwise your good to go...

[AdvancedSetup]

That error code indicates that you have one or more drives encrypted which is not supported. We can still do normal scans of the drive but most encrypted drives except for TrueCrypt are not supported for rootkit scanning as that is proprietary code.

[Drawingman]

Ron,

 

Thank you for your response.  I contacted Dell customer service and asked them to verify the build of my specific machine, and they indicate that the hard drive is not encryped.  Although the manual for the WD external hard drive that I use does not mention encryption, newer models of that drive are encrypted.  As a next step, I will run further tests without the external hard drive connected to the system. 

 

 

Drawingman

[AdvancedSetup]

You should be able to uncheck the Anti-Rootkit scanner setting and then run the scan without an issue. If you still get an error with that disabled please let me know.