New Version Fails

[PollyKate]

I installed the new version today and the scan fails (error 6). How can I revert to the previous version? Thanks for any help!

[Firefox]

Hello and

Let's try this first....

• Please uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
• If that does not correct the issue, then Please read the following and in your next reply ATTACH the 3 requested logs - Diagnostic Logs

  (the three files should be CheckResults.txt, FRST.txt and Addition.txt)

• NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Thank You,

Firefox

[PollyKate]

Thank you!

 

I did everything you said - uninstalled, reinstalled, ran a scan - with the same result as before, failure (error 6).

 

The three log files - CheckResults, FRST, Addition.txt - are attached.

 

I hope you can find the problem in there.

 

Many thanks.

CheckResults.txt

FRST.txt

Addition.txt

[NCStafford]

Hello PollyKate,

 

I am sorry that you are having difficulties with Malwarebytes Anti-Malware. There are a couple of actions that I would like you to take for me, so that I can better understand the issue that you are having.

 

1) First, if you could post the scan log where your error occurred along with the protection log of the day when this issue occurred.

 

2) Second, if you could run mbam-check and post that log:

 

Create and mbam-check log:
 

• Download mbam-check.exe from here and save it to your desktop
• Double-click on mbam-check.exe to run it, it should then open a log file
• Please copy and paste the entire contents of the log into your next post, or, if you prefer, you may attach theCheckResults.txt file which should now be located on your desktop to your next post instead

3) Third, it would be great if you could run another threat scan and get a process monitor log during that scan:

 

Create a Process Monitor Log:
 

• Create a new folder on your desktop called Logs
• Please download Process Monitor from here and save it to your desktop
• Double-click on Procmon.exe to run it
• In Process Monitor, click on File at the top and select Backing Files...
• Click the circle to the left of Use file named: and click the ... button
• Browse to the Logs folder you just created and type MBAM Log in the File name: box and click Save
• Exit Process Monitor and open it again so that it starts creating the logs
• INSERT INSTRUCTIONS FOR USER TO REPLICATE ISSUE HERE, I.E., SCAN WITH MBAM ETC.
• Close Process Monitor
• Right-click on the Logs folder on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
• Please attach the Logs.zip file you just created to your next reply.

 

All of these will greatly help us in determining the issue you are experiencing.

 

Thank You,

 

Noah

[PollyKate]

Hello Noah,

 

The first things are easy and are attached - the Protection log, Scan log and CheckResults.txt.

 

The process log thing has me confused. I'm running a scan now and it just keeps making logs, I think I've got 11 of them and it's maybe halfway through. Do you want me to zip up ALL of those logs and post them?

 

Thank you!

PollyKate

CheckResults.txt

ProtectionLog.txt

ScanLog.txt

[NCStafford]

Hello PollyKate,

 

Thank you for the logs and checkresult. And yes, please have all the log(s) zipped when you post.

 

Thank you,

 

Noah

[PollyKate]

Hi Noah,

 

I zipped the logs but the zip file is too big to upload. It's 402MB, I must have done something wrong.

 

What can I do now? Could you confirm the instructions? I thought it was:

Start Procmon.exe

Start scan

Zip logs

If that's it, I'll delete all the logs and try again...?

 

thank you,

PollyKate

[PollyKate]

Hi Noah,

 

I tried again, just starting the process monitor near the end - I got three log files and zipped they're too big to upload. So I zipped only the last two and it's attached, hopefully. Yes, the scan did end with the same error 6.

 

Many thanks,

PollyKate

[NCStafford]

Hello PollyKate,

 

Thanks for all your help, we here really do appreciate your efforts . If you still have all those zip files, we can try another method for sending them. Please zip the file and then upload it as mentioned below... (if the zip file is still that large after zipping that is)

Upload File(s) to WeTransfer:

• Visit WeTransfer.com
• Click on I Agree
  
• Click on the icon on the lower left indicated in the below image
  
• Select the Link option
  
• Click on +Add Files
  
• Browse to the location of the file and double-click on it or click once on it and select Open
  
• Click on Transfer
  
• Once the transfer completes, click on Copy link
  
• Once you receive the Copied! message as indicated below, paste the link into your next reply
  

[PollyKate]

Hi Noah,

 

At least I'm learning about a lot of tools I didn't know existed!

 

Here's the link:

http://we.tl/Vp1axhOffK

that's to a 402MB zipped file from yesterday.

 

Many thanks for your help! I truly appreciate your efforts!

PollyKate

[NCStafford]

Hello PollyKate,

 

I am glad that we can help learn about new tools. Learning something new each day is something I try to do . Thank you very much for the proc mon logs. I will be handing these over to the development team for analysis.

 

In the meantime, I have been informed by support that you may have an infection:

 

The FRST shows this:
HKU\S-1-5-21-2602612520-1628966450-300582549-1001\...\Run: [bRS] => C:\Program Files (x86)\WSE_Astromenda\BRS\brs.exe -runBRS
HKU\S-1-5-21-2602612520-1628966450-300582549-1001\...\RunOnce: [WSE_Astromenda] => wscript /E:vbscript /B "C:\Users\penny\AppData\Roaming\WSE_Astromenda\UpdateProc\bkup.dat"

Which sure looks like an infection --- astromenda.

 

The error MIGHT be the result of that malware infection, software conflicts or other problems.

Moreover, the absence of symptoms does NOT mean that a computer is clean -- some malware hides very well.

And malware is one possible reason for MBAM scans to have errors.

Further investigation and repair will require tools whose use is not permitted in this particular section of the forum.

 

So, that is why @AdvancedSetup suggested posting a new topic in the malware removal section after reading the advice here: Available Assistance for Possibly Infected Computers

 

I would suggest that you go ahead and click on that link. The experts there will assist you with looking into your issue and with getting MBAM up and running properly. Please let me know afterwards if those steps help you with your issue.

 

Thanks again for all your assistance,

 

Noah

[PollyKate]

 

In the meantime, I have been informed by support that you may have an infection:

 

The FRST shows this:

HKU\S-1-5-21-2602612520-1628966450-300582549-1001\...\Run: [bRS] => C:\Program Files (x86)\WSE_Astromenda\BRS\brs.exe -runBRS

HKU\S-1-5-21-2602612520-1628966450-300582549-1001\...\RunOnce: [WSE_Astromenda] => wscript /E:vbscript /B "C:\Users\penny\AppData\Roaming\WSE_Astromenda\UpdateProc\bkup.dat"

Which sure looks like an infection --- astromenda.

 

 

Hello Noah,

 

I have searched the FRST.txt and those lines you have above are not in it. That doesn't make any sense to me, can you please explain?

 

Thank you,

PollyKate

[AdvancedSetup]

Hi PollyKate

 

Not sure what's up but I've replied to your topic in the malware removal forum.

https://forums.malwarebytes.org/index.php?/topic/158798-new-version-of-malwarebytes-anti-malware-fails-because-of-infection/

 

I'll go ahead and close this topic here and assist you in your other one.

 

Thank you