Scheduled Scans Problems

[abuela]

On Dashboard next scheduled scan the date doesn't change after a weekly scan.  It is stuck on the previous' week scan.

 

In Settings, Automated Scheduling this line shows:  *repeats once 0 week(s) instead of what it is supposed to be, being once 1 week(1)  When I click on Threat Scan) and click on edit  it will change to what it is supposed to be (once every 1 week) and subsequently the Dashboard will show the next scheduled scan to the correct upcoming date.  (1 week after the last scan)

 

 

[Firefox]

Hello and

Let's try this first....

• Please uninstall your current version of MBAM and reinstall the latest build - MBAM Clean Removal Process 2x
• If that does not correct the issue, then Please read the following and in your next reply ATTACH the 3 requested logs - Diagnostic Logs

  (the three files should be CheckResults.txt, FRST.txt and Addition.txt)

• NOTE: There is an FAQ section with valuable information located here - Common Questions, Issues, and their Solutions

Thank You,

Firefox

[abuela]

Uninstalled and re-installed MBAM yesterday.  Today, the Threat scan in Automated Scheduling shows again: repeats once every 0 weeks.

 

I have run the recommended procedures. 

Addition.txt

FRST.txt

CheckResults.txt

[AdvancedSetup]

The logs indicate that the MBAM CLEAN was either not used or perhaps something prevented it from running fully. Please run the MBAM CLEAN tool 2 times, rebooting each time.

Then DO NOT reinstall just yet, run the MBAM CHECK tool again and post back a new log.

 

Thanks.

[abuela]

Thanks advanced!  I ran the MBAM Clean yesterday prior to posting my previous post and followed all to the letter.

 

Now today I followed your instructions again to the letter and here is the requested log. (check results)

CheckResults.txt

[abuela]

@Advanced.  (Ron) Just to let you know that I will wait to reinstall MBAM paid until you give me the green light to go ahead.  TIA.

[AdvancedSetup]

That looks better, thanks. Please run the following for me.

 

Please download MiniToolBox save it to your desktop and run it.

Checkmark the following check-boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Devices
• List Users, Partitions and Memory size.
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using Reset FF Proxy Settings option Firefox should be closed.
 

 

[abuela]

Thanks Ron.  Here is the Result.txt

 

Result.txt

[AdvancedSetup]

Notice the following in the logs (there are many I just listed one). Some believe this to be due to hardware failures. I'm not sure as it's possible that other security software may be blocking but in any case you should attempt to fix this issue. You might try running a full disk check, checking the hard drive cable is connected well, etc.

 

From an elevated admin command prompt you can run the following.

 

CHKDSK  C:   /R

odeIntegrity Errors:===================================  Date: 2014-11-30 14:09:25.722  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\hmpalert.dll because the set of per-page image hashes could not be found on the system.

Assuming there is no hardware issues you can also try reinstalling MBAM again now and try setting the schedule and let me know the results.

[abuela]

Hi Ron.  I did a chkdsk c: /r and no errors showed as far I can tell.  Don't know if I had to put a disk in and don't have one.  I'm really a noob senior.  Additionally I run PC Doctor software program monthly that Dell included when I purchased this PC.

 

I assume that the *hpmalert* shown in the Result.txt are remnants from Hitmanpro Alert that I tried many moons ago. 

 

I've installed MBAM Premium again, scanned and scheduled a threat scan for tomorrow.  Thus will see after that if will work or not.  A heartfelt thanks for the help and will post back regardless of tomorrows result. 

[abuela]

Hi Ron, I'm back!  Every time I restart or shut down the PC, the same message shows up in the Automated Scheduling appears again as REPEAT ONCE EVERY 0 WEEK(S).  I've done at least 3 restarts and can confirm that that's the problem!  I turn off my PC every night and sometimes I have to restart i.e. when doing Windows Updates and etc.    

 

So the above fixes didn't work.  Bummer!!  Could this be an error in scheduling/programming by MBAM itself?  What can be done further to get rid of the error?  Otherwise I will have to do manual scans instead of automatic scans!!!  Perhaps the techies/programmers at MBAM can look into it. 

[abuela]

I didn't make any exclusions for the antivirus Avast Free and MBAM Premium.  Don't know if it is necessary to do that and don't know how.  I would be willing to try that if you can give me a detailed instruction on how to do that?  If you find it necessary to do that will you be gentle with me as I am a senior noob?

 

Thanks!

[AdvancedSetup]

Very odd. Not sure what would be causing that to show. We have millions of users and this is the first one I've seen reported doing this. I'll see if QA can take a look at at and see if they can duplicate it.

 

Please run the MBAM CHECK scanner again and post back that new log

 

May take a couple days though. Send me a private message as a reminder if I don't get back to you within a couple days.

 

Thanks

[abuela]

Thanks Ron for getting back to me.  Here is the check log that you requested.

CheckResults.txt

[abuela]

Just to clarify.  The Dashboard shows when the next scan does take place and indeed the scan took place.  However the date in the Automatic Scheduling is *stuck*.

 

I've been editing the date in the Automatic Scheduling to match with the Dashboard date (to see if that works) but when shutting down or restarting the PC the date is backdated (last scan) and it says: repeats once every 0 week(s).

[robkarp]

I also have a weekly (custom) scan scheduled which shows "Repeats one every 0 weeks".  If I open up the task to edit it, it shows it is scheduled to repeat once every 1 weeks.  And it will stay that way for a while on the summary display but eventually it will revert back to showing the repeat every 0 weeks.  It is not necessary for me to reboot the computer for the 0 weeks display to eventually return.  But, and this is the important part, the scan runs as scheduled so I think this is purely a cosmetic issue on the summary scheduled task page, at least it is for me.  No concerns here, just FYI.

[Firefox]

Just out of curiosity, what are your date and time settings and Region and Language settings?  Have you changed them from the default settings?

[robkarp]

Language is English (was offered up that way during installation) and I do not recall ever being asked about setting a region during installation so it would still be at whatever the default setting is.

[Firefox]

I also have a weekly (custom) scan scheduled which shows "Repeats one every 0 weeks".  If I open up the task to edit it, it shows it is scheduled to repeat once every 1 weeks.  And it will stay that way for a while on the summary display but eventually it will revert back to showing the repeat every 0 weeks.  It is not necessary for me to reboot the computer for the 0 weeks display to eventually return.  But, and this is the important part, the scan runs as scheduled so I think this is purely a cosmetic issue on the summary scheduled task page, at least it is for me.  No concerns here, just FYI.

Everyone's computer is different, problems that sound the same, could actually not be the same and the solutions could be different, please stick to your own topic HERE as Ron is already helping you there....

 

Thanks for understanding

[AdvancedSetup]

Well the good news is that QA was able to reproduce this issue. The bad news is that it we will not be able to correct this until the next program update. This is hopefully expected in March. There will be a new beta before then so if possible I'd suggest you monitor the site and participate in the beta and let us know if that corrects the issue for you or not.

[abuela]

Hi Ron.  Thank you so much for the update.  That's great news!!       Yes, hopefully we can expect from MBAM to have it corrected in March.  Unfortunately I am just a noob and won't be able to manage a beta version so sadly have to decline your offer.    Hopefully others can and will do so.

 

PS: I will keep on monotoring the site though.

[AdvancedSetup]

No problem. Here is a canned message to help you clean up the tools we've used during this work. Ignore any tools not used, this is just a generic reply to help remove any said tools that might have been used.

 

 

At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.
They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.
 
Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.


 
If there are any other left over Folders, Files, Logs then you can delete them on your own.
 
Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.
How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP


As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.

• How Malware Spreads - How did I get infected
• Best Practices for Safe Computing - Prevention of Malware Infection
• Avoiding those unwanted free applications
• A close look at how Oracle installs deceptive software with Java updates
• IAC / Ask.com toolbars
• Malwarebytes Unpacked Blog

If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.
 

 

 

[abuela]

Hi Ron.

 

Now I'm confused.  There was no infection on my PC and therefore don't understand your response.

 

However, there is a Folder under C:\FRST dated Dec 20, 2015 which consists of 92.9 MB.  Do I have to delete this one?

 

Thanks.

[abuela]

Hi Ron.

 

Now I'm confused.  There was no infection on my PC and therefore don't understand your response.

 

However, there is a Folder under C:\FRST dated Dec 20, 2015 which consists of 92.9 MB.  Do I have to delete this one?

 

Thanks.

Sorry the date of the folder is not Dec 20, 2015 but it is Jan 20, 2015.

[AdvancedSetup]

We used MiniToolbox and FRST - just saying you can remove, delete those programs and log files if you like now as we're done using them.

 

 

Cheers