Windows 8.1 and Custom Scan

[uhbijn]

Alright so here is the situation.

I have Malwarebytes 2.0.2.1012 (Free) with the latest database. I had a Windows 8 machine and I would always run a custom scan with everything checked (look for rootkit, etc). I would check all drives. The scans would finish just fine.

Now, using the exact same machine I installed Windows 8.1 Pro and it was a clean install. I installed only Malwarebytes, activated Windows and performed Windows Update.

After this, I ran a Custom Scan just like before and around the 11 minute mark the scan is scanning, but it isn't really. I repeated this and the same thing. The scan would get to the C:\Windows\SoftwareDistribution directory and then not scan.

Each time it would be scanning a file in a folder in the Software Distribution directory. I noticed that with Task Manager and Resource Monitor opened, I can see that once it reach some file or time, mbam.exe won't be doing any disk activity.

I let the scan run for 2 hours and nothing, like other users have mentioned, cancel scan doesn't do anything.

So more information, all I really did on this machine is install Windows 8.1 Pro, Malwarebytes, then Windows Update. Nothing else, no browsing nothing. Only one machine was connected to the network (this machine). Threat Scan (with Scan for Rootkits enabled in Settings tab) works and in Safe Mode, the Custom Scan seems to have gotten past the Software Distribution directory.

Finally, the question is why is it stopping either at that directory or at a specific time. All I know is when it reach "the file" (different file each time, but is in the Software Distribution directory), mbam.exe doesn't show any disk activity (which it should since it is scanning). Is there any fix, other than a Threat Scan or doing it in Safe Mode?

[1PW]

Hello uhbijn and
 
We recommend that Malwarebytes Anti-Malware (MBAM) not be operated in the Safe Mode.
 
Please open the MBAM GUI/UI and left-click Settings > Detection and Protection. Then, under Detection Options, please uncheck:

• Scan for rootkits
• Scan within archives

Then please rerun the Custom scan and let us know your results in your next reply to this thread.

 

Thank you.

[uhbijn]

Could I ask why we shouldn't scan in Safe Mode? I read a couple of posts where it was suggested to try Malwarebytes in Safe Mode, if a scan hangs or doesn't complete.

Interestingly enough, I ran the custom scan and the scan completed with Archive amd Rootkit enabled.

It seems that the C:\Windows\SoftwareDistribution directory has a couple of folders, but the download folder (which caused the problem) only contains 5 or 6 folders but the directory is empty.

Any idea why the directory would be empty after one day after Windows Update?

[1PW]

Could I ask why we shouldn't scan in Safe Mode? I read a couple of posts where it was suggested to try Malwarebytes in Safe Mode, if a scan hangs or doesn't complete.

Of course. If a Windows system is so infected that MBAM can not run in Normal Mode, then other applications and techniques must precede the running of MBAM. Speculation as to what those applications might be can be best answered by following 20-30 successful Malware Removal cases where the sub-forum Expert must first try to identify the tool with which to begin. Farbar's FRST is frequently the best, first information gathering tool.

Simply forcing MBAM to run in an un-conventional mode and perhaps followed only by the user's favorite Anti-Virus application may leave the system with un-resolved infections. A guided pathway must be followed for proper, efficient clean-up if the computer can be cleaned up at all.

 

Any idea why the directory would be empty after one day after Windows Update?

I sorry but I haven't a clue. Speculation here is quite un-productive. If you believe your system is in good order, we will close this topic.

Thank you.