Scan stuck on one file

[Necrotos]

During my last 2 scans Malwarebytes got stuck for hours on on one file (in this case C:\Windows\Web\Wallpaper\Windows\img0.jpg).

Can anybody tell me why it got stuck on this specifc file? It looks innocent.

[daledoc1]

Hi:
 
I don't recall reports of that issue for several months (IIRC there was an issue quite a while ago, with an earlier build of version 2.x).
Scans can stall or hang for many reasons (corrupt disk sectors, corrupt files, software conflicts (e.g. AV), malware, etc).
 
Just out of curiosity, what version of MBAM are you running (current is 2.0.2.1012)?

Do you have anti-rootkit scanning enabled? (If so, you might try disabling that feature.)
Do you have an encrypted drive (Bitlocker, Truecrypt, SecureDoc, etc)? (If so, then you will definitely need to disable anti-rootkit scanning if your encryption method is anything other than Truecrypt, as it is not supported under those conditions.)

In any event, I would suggest killing the scan and starting with some routine troubleshooting -- if you are already running 2.0.2.1012, then you might want to skip to step #2 and just post back with the diagnostic logs:

• Please follow the steps in this pinned topic to uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
• If that does not correct the issue, then please read the following and post back attached to your next reply the 3 requested logs - Diagnostic Logs (the 3 logs are: FRST.txt, Addition.txt and CheckResults.txt)
• NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Please let us know how it goes.

Thanks,

[Maurice Naggar]

Howdy and welcome aboard,

 

Did you make a note as to just where in the scan process it was?   on the list of the phases listed on the left side?

Allow me to make one suggestion:

Start the Anti-Malware program.  Don't do anything just yet.  But click on Settings icon up on the top bar and then select History settings on the left.
Then look at the line tagged as Help fight malware by anonymously providing historical information  and UN-check the box if it is selected.
 

[Necrotos]

I have the current version of Malwarebytes, Rootkit scanning is enabled. Also i somehow got 2 FRST.txt and 2 Addition.txt files.

Where can i upload them?

[Maurice Naggar]

In order to attach files you click on the button on the bottom right of your reply called "More Reply Options".  



After you will be taken to a new screen and you can attach files by clicking on the button "Choose Files" at the bottom.

[Necrotos]

Here are the results

CheckResults.txt

Addition (2).txt

Addition.txt

FRST.txt

FRST (2).txt

[Maurice Naggar]

Tell me please, Have you made the tweak in settings like I suggest    https://forums.malwarebytes.org/index.php?/topic/156211-scan-stuck-on-one-file/?p=873459

[Necrotos]

Yes. Also my scan continued now. Just took a few houres.

[Maurice Naggar]

If the scan finished all the way, great !

 

Start the Anti-Malware program.

Click the Settings icon at the top bar.   Then click on Detection and Protection.

Look at yours selections there:

Especially look at the Non-Malware protection
For each of the lines marked
PUP
PUM

be sure your setting is made to Treat detections as malware


Click the Scan icon at the top bar.

Take a first look at the Scan window.

Do you see a green tick mark and a green line of text  ( like from the last scheduled scan).

If you see a button marked Main menu at the bottom right, then click it.

In any event, have the selection selected for Threat scan and then click Scan now.

If it displays a orange sign with Updates are available, press the Update now button.

Have lots of patience as it gets and processes the Update.  Even if your Windows bar shows ( not responding) keep patient and it eventually finishes after a bit.



A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In some cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.



Click on the History tab  > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Copy to Clipboard
Paste the contents of the clipboard into your reply.
then in the body of  reply box, do a Paste by pressing CTRL+V keys on the keyboard.

[Necrotos]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 31.08.2014
Scan Time: 13:09:17
Logfile:
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.31.02
Rootkit Database: v2014.08.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Patrick

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 1103975
Time Elapsed: 8 hr, 26 min, 31 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 5
PUP.Optional.DefaultTab.A, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabSetup.exe, Quarantined, [debb1eabd9a2043271fe70bcbf415ba5],
PUP.Optional.DefaultTab, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabStart.exe, Quarantined, [f1a870590774a0960e2744cec0417e82],
PUP.Optional.DefaultTab, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabStart64.exe, Quarantined, [d3c66960fe7d86b03ef7b55da25f8779],
PUP.Optional.DefaultTab, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabWrap.dll, Quarantined, [7f1ad5f4b9c26acc66cfc84a897844bc],
PUP.Optional.DefaultTab, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabWrap64.dll, Quarantined, [c1d8fbceed8e39fd93a2af63c73a6898],

Physical Sectors: 0
(No malicious items detected)


(end)

[Maurice Naggar]

Ok.  Good.  If you now do another ( new) Threat scan, it ought to find no items.  Please make a new scan run.

 

PUP are potentially unwanted programs ( addons most usually added in by all the "free stuff" off the internet).

Pay close attention when installing 3rd-party programs.

It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet.

If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed. Furthermore, If the license agreement or installation screens state that they are going to install a toolbar or other unwanted adware, it is advised that you cancel the install and not use the free software.