Wildcat1981 Posted October 14, 2014 ID:889797 Share Posted October 14, 2014 I downloaded and installed the new version and the first scan quarantined what looks like Malwarebytes files. I told it to ignore once, so I assume it put them back where they belong. But then this morning I found the problem that others have had where Malicious Website Blocking is not enabled. The only thing that would get it back on was a re-install. I had tried updating the database, restarting, and rebooting. I'm not sure if the files it thinks are threats and the disabling of the website blocking is related? Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 10/13/2014Scan Time: 5:51:17 PMLogfile:Administrator: YesVersion: 2.00.3.1025Malware Database: v2014.10.13.09Rootkit Database: v2014.10.11.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 8.1CPU: x64File System: NTFSUser: KevinScan Type: Threat ScanResult: CompletedObjects Scanned: 391702Time Elapsed: 42 min, 39 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Unknown.Rootkit.Driver, C:\WINDOWS\SYSTEM32\drivers\mbam.sys, No Action By User, [f92b0e478c0faa6d6661e6e977247e60],Unknown.Rootkit.Driver, C:\WINDOWS\SYSTEM32\drivers\mwac.sys, No Action By User, [0664f6335f108f38fe08c3ca747311ee],Physical Sectors: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 14, 2014 Staff ID:889799 Share Posted October 14, 2014 Hi, You can safely ignore these detections - looks like there's a mismatch between reads from the kernel and windows API here. This might happen once in a while.As for the Malicious Website Blocking, please see here: https://forums.malwarebytes.org/index.php?/topic/158722-malicious-website-protection-disabled/ Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 14, 2014 Author ID:889817 Share Posted October 14, 2014 Thanks! Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 14, 2014 Author ID:890186 Share Posted October 14, 2014 I ran another scan and told MBAM to add an exclusion for those two files. But the next time a scan ran, those same to files showed up as threats again. I said to add an exclusion for each of them again, but I don't think it is sticking because the log says "No action by user" just like in the log above where I selected "Ignore this time". Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 14, 2014 Author ID:890187 Share Posted October 14, 2014 Oh, I did want to add that, yes, I did press the button to perform the actions after I selected "Add Exclusion" for each of the files. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 15, 2014 Staff ID:890316 Share Posted October 15, 2014 What do you get/see when you open Settings > Malware Excludions?Do you see both of them there? If not, can you add these manually there via the "Add File" option?Did you reboot afterwards? As for the cause why it sees both files as unknown rootkit drivers...Also, if still the same and still detection, I suggest that you reinstall Malwarebytes, because the fact that it sees those two files as unknown rootkit driver means there's a misread for them.Also, what Antivirus or other Security product do you have installed? Because it could also be interference from the other AV where it sees changes for these new mbam driver files (since this is a new version) and causing these misreads in mbam. So it's always a good idea to add an exclusion for Malwarebytes files in your other AV as well. (If that was the case, please let us know, so we can try to reproduce this). Or, do you have any program installed like Driver Booster or a system optimizer program or something similar? Because we have also seen this behavior where it forges contents of newly installed drivers. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890501 Share Posted October 15, 2014 The exclusions do show up in the settings. However, they still get flagged as threats with each scan. I am about to reboot to see what happens, I have not rebooted yet. If I do a re-install, is it necessary to un-install first? I have both Norton's Internet Security and Webroot Secure Anywhere running at the moment. I do not have any Driver Booster type programs running. I'll let you know if rebooting makes any difference and if not will try re-installing. Thanks! Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890506 Share Posted October 15, 2014 Rebooting did not help, those two files continue to be flagged as threats.I will try re-installing. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 15, 2014 Staff ID:890516 Share Posted October 15, 2014 If reinstalling didn't help either, please disable both Webroot & Norton - and see if a mbam scan still lists the same files. Because it would then really look like interference by a 3rd party program. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890522 Share Posted October 15, 2014 I deleted the old version to be thorough and re-installed again and did another scan right away. Again, those two files show up as threats. Interesting that this did not happen until I downloaded the new version. Even if there is a mismatch, shouldn't those files be ignored if they are in the exclusion list? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted October 15, 2014 Staff ID:890525 Share Posted October 15, 2014 Yes, these should be ignored when in the exclusion list. I'll point QA to this anyway, as this might be a bug. I still believe that either Norton or Webroot is responsible for these detections though. In either way, I'll also point someone from QA to this. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890532 Share Posted October 15, 2014 Disabling Webroot and Nortons did not help either. Same result. Link to post Share on other sites More sharing options...
Staff Jekko Posted October 15, 2014 Staff ID:890566 Share Posted October 15, 2014 Hello Wildcat, could you get us a few logs? First, let's start with mbam-check: http://downloads.malwarebytes.org/file/mbam_check Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890571 Share Posted October 15, 2014 Sure. The log is attached. Thanks! Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890573 Share Posted October 15, 2014 Well, I don't see that the file I attached actually attached to my post. I tried cutting and pasting it into this post but got an error saying the post was too long. How should I send you the log? Link to post Share on other sites More sharing options...
Staff Jekko Posted October 15, 2014 Staff ID:890578 Share Posted October 15, 2014 You can attach the log by clicking the "More Reply Options" button and then there will be an option at the bottom to attach files. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890579 Share Posted October 15, 2014 That's what I did and everything seemed to work ok but I just don't see it attached. I'll try it again. Let's see if I can attach it to this post. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890581 Share Posted October 15, 2014 No, the forum is not letting me use the More Reply Options now, it says as a new member I have posted my limit so I have to wait. It still lets me use the regular way of posting though. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 15, 2014 Author ID:890584 Share Posted October 15, 2014 OK, I guess I have waited long enough. I see what I did wrong previously. I did not click the "Attach This File" after I browsed for the log file. It should be attached now.CheckResults.txt Link to post Share on other sites More sharing options...
Staff Jekko Posted October 15, 2014 Staff ID:890666 Share Posted October 15, 2014 Wildcat, Could you try adding those 2 files to Norton and Webroot's exclusions lists as well? C:\WINDOWS\SYSTEM32\drivers\mbam.sysC:\WINDOWS\SYSTEM32\drivers\mwac.sys Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 16, 2014 Author ID:890708 Share Posted October 16, 2014 Webroot does not have a way to do that and Norton's does but Norton's does not think those two files exist, even if I make system and hidden files visible in file explorer.But if I disable both antivirus programs it still behaves the same, or if right click on those files and have webroot or Nortons scan those files neither one has a problem with them. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 16, 2014 Author ID:890710 Share Posted October 16, 2014 I went ahead and excluded the entire drivers directory in Nortons and totally shut down Webroot and mbam still flags those two files. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 16, 2014 Author ID:890718 Share Posted October 16, 2014 It is interesting to note that, in both Norton's and MBAM, when I go to exclude those files, both are not able to see the drivers in that directory, so if I go to manually add those two files through browse, MBMAM is not able to see them. I can see them in File Explorer though. I don't know if that has anything to do with the issue or not. Link to post Share on other sites More sharing options...
Wildcat1981 Posted October 16, 2014 Author ID:890959 Share Posted October 16, 2014 I think I have an idea what the problem might be. I use Rollback Rx. I was reading another post on this forum and I noticed that someone had a similar problem and you deduced that the problem was because of Rollback RX. Perhaps I should not even turn on rootkit scanning in mbam if I am using Rollback RX. Maybe that doesn't make sense since Rollback RX would likely look like a Rootkit? BTW, the post I was reading said that there was a fix for the Rollback RX incompatibility. Is that not in the current version yet? Link to post Share on other sites More sharing options...
Staff Jekko Posted October 16, 2014 Staff ID:891021 Share Posted October 16, 2014 Let's try a few more things. Please uninstall one of your AVs. Having too much security software on the same machine can cause issues so it's usually recommended to only have one AV. Please try running a scan in safe mode to see if the same detections are found. Please try running a scan with MBAR and see if the same detections are found. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now