Scan locks up

[TOH]

I upgraded to version 3.0 today and tried to do a threat scan 4 times and it keeps locking up , each time on a different AOL file. 

I have attached a word file of 4 screenshots which show the files that the scan locked up on and also the MBAM log file for your review.

Malwarebytes Scan Screenshot 12-12-16.docx

MBAMSERVICE.LOG

[Ried]

Thank you for the logs.  As per our conversation via PM, you also have an issue with malware protection stuck on 'starting...'

I'll need to gather more information regarding what's running on this machine to check for possible conflicts. This next scanner will not make any changes to your machine on its own, nor will it divulge any personal information that may compromise your security.

  Please download Farbar Recovery Scan Tool from here http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ and save it to your desktop.

Note: You need to run the version compatible with your system

  **After you click the Download Now 64-bit, or the Download Now 32-bit, another page will open -- DO NOT CLICK ANY ADDITIONAL 'download now' buttons, just wait and look toward the bottom of your browser for the option to Run or Save. Click Save.

•Double-click to run it. When the tool opens click Yes to the disclaimer.

Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.

•Click the Scan button.

•When the scan has finished, it will make produce 2 logs in the same directory the tool was run from. Please attach the following logs to your next reply:

FRST.txt

Addition.txt.

[Ried]

TOH, I replied to your HelpDesk ticket, please, let's continue in here

 

 

[TOH]

The two files you requested are attached.

What do you want me to do next?

FRST.txt

Addition.txt

[Jekko]

36 minutes ago, TOH said:

The two files you requested are attached.

What do you want me to do next?

FRST.txt

Addition.txt

Hello TOH!

We would like you to:

1. Enable Event Log Data under Application Settings.
2. Run a threat scan.
3. See if you reproduce the scan hang.

Then please attach the MBAMSERVICE.log and any MBAMSERIVCE.log.bk files that are in the folder: C:\ProgramData\Malwarebytes\MBAMService\logs

This will give us more detailed logging about what is happening during the scan.

[TOH]

One file that you requested is attached and a screenshot of what file stopped the scan.

This forum page will not let me attach the other file because it ends in log.bk1 not log.bk

I am heading out for tonight but can continue in the morning for next steps.

MBAMSERVICE.LOG

[Ried]

@Jekko   see attached received via HelpDesk

 

.bk1 MBAMSERVICE.LOG..zip

[Jekko]

TOH,

Thank you for the logs!  We want to see if anything is crashing silently during your scan.  Can you please do the following:

1. Run the attached file "SetupLocalAndFullMemoryDump.reg".
2. Run a threat scan to reproduce the issue.
3. After the scan hangs (and maybe wait 10 or so minutes to be sure), check the folder: C:\LocalDumps

If something crashed during the scan silently, that folder should be created automatically by Windows and will have a memory dump file.  If it exists, please send it our way.

SetupLocalAndFullMemoryDump.zip

[TOH]

I downloaded and ran the attached memorydump file.

When I tried to do a threat scan it would not run and no local dump folder or file was created on the C drive.

Below is a copy of the screenshot with no items scanned.

 

[TOH]

FYI, since I downloaded the fullmemorydump zip file above,  I can't run any scans now, Threat, Custom or Hyper.

[dcollins]

@TOH, that's very strange. Can you try this file here? This will reset the above values back to their Windows default. Once reset, try running a scan again and see what the result is. Thanks!

DisableDumps.zip

[TOH]

I downloaded and ran the disable dumps file and then tried to do a threat scan.

Scan stopped after 26 seconds with no items scanned again.

Summary screenshot is below.

I still can't run any scans now, Threat, Custom or Hyper.

[Jekko]

TOH,

Thanks for following up.

• Did you have any MBAM versions installed previously?
• What versions were they?
• Did you uninstall them or install MBAM 3.0 over the previous version?

It sounds like your installation of MBAM has issues and before we try to get a work around to fix the issue, I want to know how your installation of MBAM got like this in the first place.  Any hints would be appreciated in knowing the past history of what you did regarding installing, uninstalling, or upgrading MBAM.

[TOH]

I have been using MBAM since 12/1/10  without any problems and upgraded from version 2 to version 3.0 on 12/13/16.

I installed MBAM 3.0 over the previous version on 12/13/16 and tried to do a threat scan 4 times and it kept locking up , each time on a different AOL file  as indicated in my original post above back on Tuesday, Dec 13th.

[TOH]

Jekko,   FYI, Lisa was helping me in the forum last week and she suggested that I exclude the AOL folders that were causing the six threat scans to stop. I did that and was able to get a completed threat scan to finish in 8 minutes after excluding AOL & AOL Download folders and it found 2 PUP threats which were quarantined.   I was concerned that version 3.0  was then not scanning those two AOL folders which contain hundreds if not thousands of files. After running http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ , I sent her the five files that she requested. AEConfig.json. mbae-default.log MBAMService.log frst.txt addition.txt   Thanks, TOH

[TOH]

She then asked me to continue the discussion in here on Friday at 5:37pm

[Jekko]

TOH,

Thank you for being so responsive.  We really want to figure out what happened with your MBAM 3.0 installation. Could you do the following?

1. Reboot the system (if you haven't done so already).
2. Open MBAM and enable Event Log Data under Application Settings.
3. Download the following tool procmon.exe: https://download.sysinternals.com/files/ProcessMonitor.zip
4. Run procmon.exe.
5. Start a threat scan.
6. Let the scan hang (or stop).
7. Stop the capture in procmon.
   
8. Save the procmon capture.
9. Attach the mbamservice.log and procmon log here.

[TOH]

Jon,

I followed your instructions above and have attached the mbamservice.log and procmon log files.

TOH

MBAMSERVICE.LOG

Logfile.zip

[Jekko]

@TOH,

Thanks for the logs!  I took a look and it looks like MBAM is having trouble loading both the database and your computer's registry hives.  I've forwarded the logs to our developers and we will see what else we need to collect from your system.

Thank you for being patient with us and very cooperative.

[dcollins]

@TOH if you don't mind, can you follow the instructions below to get us a bit more information from your machine please?

1. Please download the attached fixlist.txt file and save it to your desktop
2. Then download Farbar Recovery Scan Tool from here http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ and save it to your desktop.
   Note: You need to run the version compatible with your system.
   **After you click the Download Now 64-bit, or the Download Now 32-bit, another page will open — DO NOT CLICK ANY ADDITIONAL 'download now' buttons, just wait and look toward the bottom of your browser for the option to Run or Save. Click Save.
3. Double-click to run it. When the tool opens click Yes to the disclaimer.
   Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
4. Click the Fix button.
5. When the process has finished, it will save a log in the same directory the tool was run from.  Please attach the following log file to your response
   Fixlog.txt

Fixlist.txt

[TOH]

Here is the file you requested:Fixlog.txt

[dcollins]

Thanks @TOH, appreciate the prompt reply

[dcollins]

@TOH unfortunately that didn't point us in the right direction, can you please follow those same instructions I posted above, but use this version of fixlist.txt instead? Thank you. It should also produce a zip file that contains all of your logs if you could upload those too please

 

Fixlist.txt

Edited December 20, 2016 by dcollins

[TOH]

Devin,

Here is the file you requested

Fixlog.txt

[dcollins]

@TOH sorry, I updated the fixlist.txt above, but it looks like it didn't go through. If you use this one I just attached, it will create a zip file that I'll need you to upload please.

Fixlist.txt