Malwarebytes 2 Premium Stops Working During Scanning File System

[garioch7]

Good day.  I have Antimalware Bytes Premium.  Recently, over the last few days, scanning stops part way through the file system scan, and Windows reports that Malwarebytes Antimalware has stopped working and that it will check for a solution, which is never found.  After this occurred for several days in a row, I concluded that it wasn't just a possible defective database update from MBAM.  I uninstalled MBAM using the mbam_clean tool, cold booted, and then reinstalled MBAM Premium.  Same result.  Scanning stops on different files.  Both times I have observed the actual file name, it was in my old PowerDirector 9 (Cyberlink) folder, where the scan stalled and died.

 

I don't think that the laptop is infected.  Bitdefender Total Security 2015 full scans have been negative, and this laptop is not used for much in the way of surfing.

 

As directed in the sticky thread, I ran the Farbar Scan Recovery tool and the files are attached.  I know that I was supposed to copy and paste them here, but the paste function doesn't seem to work; or, more probably, I am too dumb to figure it out, so I apologize in advance.

 

Any advice will be appreciated.  I am going to run an sfc /scannow to see if it detects any issues.  Windows 7 HP x64 is totally up to date with even the patches from today.  Thank you, and have a great day.

 

Regards,

-Phil

 

 

[daledoc1]

Hi:

 

While we wait for staff/experts to review your FRST logs...

 

Please read the following and post back attached to your next reply the other requested log from Logset 2 - Diagnostic Logs (CheckResults.txt)

 

Thanks,

[garioch7]

I am sorry, Daledoc, that I missed the second set of instructions.  I have remedied that.  sfc /scannow did report errors that it was unable to fix, so I am attaching my cbs.log file was well in case that might help.

 

Thank you for your VERY prompt reply and please accept my apologies for not doing things correctly the first time.

 

Have a great day.

 

Regards,

-Phil

[daledoc1]

Hi:

 

No problem.

 

We'll need to wait for AdvancedSetup or someone else qualified to review your logs.

 

Until then: what happens if you disable archive scanning and anti-rootkit scanning (dashboard > settings > detection and protection)?

 

Also, it might help to see a scan log (dashboard > history > application logs; then DOUBLE click a scan log to view it > click "export to .txt" > save to your desktop > attach it here with your next reply).

 

Thanks,

[garioch7]

Daledoc:

 

Thank you for your reply.  Attached are the MBAM app and scan logs.  The scan did complete when anti-rootkit and scan within archives were disabled.

 

I am going offline now until tomorrow afternoon.   I thank you for your assistance, but I do feel guilty since I have been checking the MBAM Forums for about six months on a daily basis and I know that there are folks with very serious problems.  This issue seems to me to be more of a nuisance, so I feel guilty for "stealing" your expertise when others are in need of it much more than I am.  I have no indication of any computer issues other than that the MBAM full scans would not complete, failing on the file system scan.

 

This matter is definitely not urgent, but, having said that, I will, and do, appreciate all assistance provided.  Thank you again, and have a great day.

 

Regards,

-Phil

[AdvancedSetup]

The logs indicate that the computer appears to be infected or possibly damaged from a previous infection or the use of one of these products. Personally I would recommend not using these products. Windows can already manage almost all maintenance with native tools.

 

Wise Care 365

ParetoLogic

 

I would highly recommend you read the following.

Do I need a Windows Registry Cleaner?
 

 

I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.
 

Thank you

[garioch7]

Advanced Setup:

 

Thank you for your reply.  The culprit will be WiseCare 365.  I use it weekly to remove junk files and clean the registry.  Paretologic products were removed from this laptop over a year ago and replaced with WiseCare 365.  I have tried restoring the registry back a few weeks to undo what WiseCare did, last Friday when I last cleaned the registry with it, but that makes no difference.  It was after last Friday's WiseCare registry clean that the MBAM problem appeared.  I will DEFINITELY heed your advice to cease using registry cleaners.  I am most grateful for your assistance.  As a further update, I re-enabled scanning within archives and the MBAM scan completed successfully, reporting OpenCandy detected in the MediaInfo app.  I quarantined that.  As soon as I enable rootkit scanning, the scan halts during the file system scan and Windows reports that Malwarebytes has stopped working.

 

Before imposing on the experts in the malware removal Forum, I am going to try running the Windows System Update Readiness Tool, followed by another sfc, just to see if I can't get the Windows system repaired.  I know that there are folks with really serious issues, so I don't want to take up the expert's time for what is, so far, just a nuisance mainly, and I have no concrete reason to believe that the laptop is infected.  I definitely would like to have the anti-rootkit scanning capability, and I definitely want to get my Windows system made whole, so I will try what I can locally, and if it doesn't work, then I will follow up in the removal Forum.  Thank you very sincerely, and Daledoc too, for your invaluable help.  It is really appreciated.  Have a great day.

 

Regards,

-Phil

[AdvancedSetup]

Hi Phil

 

There is no issue or concern about starting a topic with the Experts. That's what we're here for to help users with possible infections. It could be an infection or it could be something that is blocking our scanner.

I'd still recommend letting someone that is trained assist you for one-on-one free support.

 

Cheers

[garioch7]

AdvancedSetup:

 

Please accept my sincere apologies for the delay in responding to your post.  I was on the road travelling for several days and never got back to my computer.  I will take you up on your suggestion to have one of your experts check things out for me.  I have been unable to fix the problem myself so far.  I did find that the sfc integrity errors were related to the Windows 7 Sample Pictures being missing (Wise Care did kill them), but putting them back into the proper folder has not resolved the problem, so there are undoubtedly missing related registry entries.

 

I would like also to confirm that my laptop is not infected, so when I get a chance in the next few days, I will post with new and updated diagnostic files in the Malware Removal Forum, just in case my amateur mucking about has changed any configurations that might interfere with MBAM doing an anti-rootkit scan.

 

Thank you again, and Daledoc, for your assistance.  It is very much appreciated.  Have a great day, and once again, sorry to take so long to acknowledge your last post.

 

Regards,

-Phil

[daledoc1]

OK, no problem.

 

Please feel free to create your new topic in the malware removal section any time you are ready.

As several days have elapsed since your original post, it's probably a good idea to include with your new topic a fresh set of Diagnostic Logs.

(Please be sure to place a check-mark in the "Addition.txt" option before you run FRST again.)

 

Take care,

[garioch7]

Thanks, Daledoc.  I will post, probably on the weekend, and I will include fresh logs.  Thanks for the heads-up about "Addition.txt."  Have a great day.

 

Regards,

-Phil

[garioch7]

Hello again.  I posted in the Malware Removal Help Forum on the 19th.  My fresh logs were downloaded three times, but no one ever responded.  I am assuming that they did find an infection.  I have been trying to paste the link to that thread, but when I click on the hyperlink button and paste in the link, it will not exit or paste the link and I have to exit my browser entirely.  What obvious trick is this old guy missing?  I am using the "More Reply" option.

 

Does anyone have any ideas as to how I can re-enable MBAM anti-rootkit scanning so it does not stall out MBAM?

 

Any assistance appreciated - no rush as I know others have more serious issues.  Have a great day.

 

Regards,

-Phil

 

 

[daledoc1]

Hi:
 
It appears that your Malware Removal Section topic might have been inadvertently overlooked.
(The forum has been quite busy lately, although that is nothing new.)
 
As @AdvancedSetup has replied here in this thread, it's likely he will spot your new reply here and will look into helping you in the other topic, or asking one of the other helpers to assist you there.

(I am just a home user & forum volunteer, so I am neither qualified nor authorized to provide assistance in that area.)
 
As it is the weekend, you might want to wait until later today, to give him a chance to respond.
Otherwise, I would suggest sending him a PM, including both of the links below, so that he can look into getting you assistance:
 

https://forums.malwarebytes.org/index.php?/topic/156817-malwarebytes-2-premium-stops-working-during-scanning-file-system/https://forums.malwarebytes.org/index.php?/topic/157486-mbam-premium-stops-working-during-file-system-scan-when-anti-rootkit-scanning-enabled/

I apologize for the delay.
Thanks for your patience,

[garioch7]

Thank you, Daledoc, for your quick reply.  Yes I do know that the Forums have been VERY busy and I am happy to wait for a response.  I just had concluded that perhaps because my post wasn't urgent, it kind of got dropped.

 

Would you be so kind as to tell me how I can insert a hyperlink into a posting on this Forum?  I just haven't been able to figure that out.  Perhaps it is my browser (IE11)?

 

Have a great day, Daledoc.  I really appreciate your assistance.

 

Regards,

-Phil

[daledoc1]

Hi:

 

Sorry, I don't use IE, but you ought to be able to click on the "link" icon in the toolbar?

 

(If you end up sending a PM to the mod team to get help in your malware removal topic, you just need to copy/paste the contents of that code box in my previous reply. That will add the links to both of your topics, so that the mods will know the relevant threads.)

 

Cheers,

[garioch7]

Hello Daledoc:

 

It seems to be an issue with IE11.  I tried Chrome and was able to add a link without an issue.  I was selecting the link button.  Below is my test link in Chrome.

 

https://forums.malwarebytes.org/index.php?/topic/156817-malwarebytes-2-premium-stops-working-during-scanning-file-system/

 

 

I have attached a snipping tool capture of the IE11 version of the more reply screen and you can see that OK and Cancel are greyed out and one cannot exit the link screen.  Might be some add-on or extension on my IE11 browser.  Any ways, mystery solved.  Thanks again, and have a great day.

 

Regards,

-Phil

[AdvancedSetup]

Yes there is a known issue with copy/pasting to the forum using IE 11

[Firefox]

Yes there is a known issue with copy/pasting to the forum using IE 11

Just to add... if you put the Malwarebytes forum page into compatibility mode when using IE11 it should solve it.

[garioch7]

Thanks for your advice re: copying and pasting in the Malwarebytes Forum.  I will use Chrome when I come here, as I have to do with some other sites that I visit daily.

 

I will await the advice on how to enable anti-rootkit scanning again, once someone has the time to check out my logs.  No big rush.  Have a great day.

 

Regards,

-Phil

[AdvancedSetup]

Just to add... if you put Malwarebytes into compatibility mode when using IE11 it should solve it.

 

I assume you mean to add the Malwarebytes forum into the Internet Explorer, Tools, Compatibility View mode and not the Malwarebytes program. Just want to clarify for anyone else coming along that might read this.

 

Thanks

[AdvancedSetup]

I have replied to your topic in the malware removal forum.  Thanks

[Firefox]

Thanks Ron that is what I meant...

[garioch7]

Thank you, AdvancedSetup.  I have responded in the Malware Removal Forum and will run the requested scans tomorrow morning and post back the results in that Forum.  This thread can be closed.  Thanks again and have a great day.

 

Regards,

-Phil