chartierpw Posted January 26, 2017 Author ID:1096230 Share Posted January 26, 2017 Kevin, No different ..... I attached a screen shot. R/ Prescott .... Without Extensions.docx Link to post Share on other sites More sharing options...
kevinf80 Posted January 26, 2017 ID:1096232 Share Posted January 26, 2017 Open Malwarebytes, Select > Settings > Protection > Advanced Settings > A new window will open, under "Application Hardening" is "Disable Internet Explorer VB scripting" ticked..? Link to post Share on other sites More sharing options...
chartierpw Posted January 26, 2017 Author ID:1096241 Share Posted January 26, 2017 Kevin, Yes Disable Internet Explorer VB scripting is ticked .... see screen shot. I cannot change any of the settings, they are all disabled. Also, I cannot enable rootkit detection, every time I load MalwareBytes, it's disabled. I enable it and scan, but rootkit isn't part of the scan. When I close and reopen MalwareBytes, it's disabled again. R/ Prescott ... Screen Shot.docx Link to post Share on other sites More sharing options...
kevinf80 Posted January 26, 2017 ID:1096266 Share Posted January 26, 2017 That is strange regarding rootkit option, almost as if some kind of protection is holding it off... Lets run TDSSKiller see if we`ve missed anything... Please read carefully and follow these steps. Download TDSSKiller from here http://support.kaspersky.com/downloads/utils/tdsskiller.exe and save it to your Desktop. Doubleclick on to run the application. The "Ready to scan" window will open, Click on "Change parameters" Ensure all entries are Checkmarked under Additionl Options, Ensure all entries are Checkmarked under Objects to scan When Loaded Modules is checkmarked a re-boot will be offered, allow that to happen... Continue after reboot select "Change Parameters" make sure entries are checkmarked and then Select "Start Scan" If an infected file is detected, the default action will be Cure, click on Continue. If a suspicious file is detected, the default action will be Skip, click on Continue. It may ask you to reboot the computer to complete the process. Click on Reboot Now. If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here. If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. Link to post Share on other sites More sharing options...
chartierpw Posted January 26, 2017 Author ID:1096278 Share Posted January 26, 2017 Kevin, Once again, no threats found. Report is attached. R/ Prescott ... TDSSKiller Report.docx Link to post Share on other sites More sharing options...
kevinf80 Posted January 26, 2017 ID:1096282 Share Posted January 26, 2017 I did not expect any threats really, have just been reading an old thread regarding the very problem you have, from the date this would possibly be with MB version 2.xxxxxxx so it is regarding Malwarebytes Anti Exploit, obviously MBAE is now built into version 3 Have a read see what I mean: https://forums.malwarebytes.com/topic/170206-solved-blocking-site-under-ie/ I`ll post to our private forum and see what respons I get. Just for a test can you open Malwarebytes as done in Reply ID 27 and untick VB scripting, then open IE and see what happens.... Link to post Share on other sites More sharing options...
chartierpw Posted January 26, 2017 Author ID:1096288 Share Posted January 26, 2017 Kevin I cannot change any of the settings, they are greyed out. See previously uploaded screenshot in post ID 28. Also, I cannot enable rootkit detections. If I turn it on and. scan, rootkit detections are no included in the scan. When I close and reopen MalwareBytes, rootkit detection is once again disabled. I don't believe we have the same issue here as in that other post. R/ Prescott .... Link to post Share on other sites More sharing options...
kevinf80 Posted January 26, 2017 ID:1096290 Share Posted January 26, 2017 Just a thought, is your version of malwarebytes Free or Premium...? Link to post Share on other sites More sharing options...
chartierpw Posted January 26, 2017 Author ID:1096298 Share Posted January 26, 2017 Kevin, It's premium.... R/ Prescott .... Link to post Share on other sites More sharing options...
kevinf80 Posted January 26, 2017 ID:1096302 Share Posted January 26, 2017 Please create an mbam-check log: Download mbam-check.exe from here: https://downloads.malwarebytes.org/file/mb3_check and save it to your desktop Double-click on mbam-check.exe to run it, it should then open a log file Please do not copy and paste the entire contents of the log into your next post, instead, please attach the log CheckResults.txt file which should now be located on your desktop to your next post. Attach the log to your reply Link to post Share on other sites More sharing options...
chartierpw Posted January 26, 2017 Author ID:1096308 Share Posted January 26, 2017 Kevin, Log is attached. R/ Prescott .... mb-checkResult.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 26, 2017 ID:1096319 Share Posted January 26, 2017 Thanks for that log all looks ok... Run the following :- Please download Security Analysis by Rocket Grannie from here: http://rocketgrannie.spywareinfoforum.org/RGSA.exe Save it to your Desktop. Close your security software to avoid potential conflicts. Double click RGSA.exe Click OK on the copyright-disclaimer It will produce a log named SALog.txt on the Desktop or in the same folder from where the tool is run if installed elsewhere. Please copy and paste the contents of that log in this topic. There maybe a Warning from Windows about running the program, if so click on More info and then click Run Anyway to run it even though Windows says it might put your PC at risk. Note: The link to the most current version of the program will always be in the first post of this topic. Note: (Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run to continue.) Note: The current java version on XP will show as "out of date". Note: Flash Player ActiveX is pre-installed with Internet Explorer in Windows 10 and updates Automatically. Please post your feedback in this topic. Link to post Share on other sites More sharing options...
chartierpw Posted January 26, 2017 Author ID:1096332 Share Posted January 26, 2017 Kevin, No matter what I do, my machine will not let me download this file. I've attached screen shots of the messages I get. No matter how many times I click "Try Again" on the second dialog, it won't download. Eventually I have to cancel. In between the dialogs I get the "do you want to allow this program to make changes to you system" (words to that effect) dialog, I couldn't capture that in a screen shot. R/ Prescott .... Screen Shot RGSA.docx Link to post Share on other sites More sharing options...
kevinf80 Posted January 26, 2017 ID:1096337 Share Posted January 26, 2017 (edited) I`ve attached RGSA as a zip file, see if you can download and unzip to your Desktop, security must be OFF to allow it to run... RGSA.zip Edited January 26, 2017 by kevinf80 Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096340 Share Posted January 27, 2017 Kevin, That worked. Log is attached. R/ Prescott .... SALog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 27, 2017 ID:1096344 Share Posted January 27, 2017 I see McAfee is installed, it is upto date but disabled, I know McAfee can still cause issues for certain software even when disabled as some drivers are still active.... Can you UNinstall McAfee and see if that makes any difference: Removal tool available here: http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096346 Share Posted January 27, 2017 Kevin, Cannot uninstall, see attached document. I have no idea where the tools log is. R/ Prescott ... MalwareBytes Issue.docx Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096347 Share Posted January 27, 2017 Kevin, Also, MalwareBytes realtime protection is in a constant state of "starting" ... see previously uploaded document. R/ Prescott .... Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096349 Share Posted January 27, 2017 Kevin, I was able to uninstall McAfee via control panel. No change otherwise. MalwareBytes real-time protection will not start. R/ Prescott .... Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096350 Share Posted January 27, 2017 Kevin, I rebooted the machine and was able to start real-time protection, but I am still unable to enable rootkit detections. R/ Prescott .... Link to post Share on other sites More sharing options...
kevinf80 Posted January 27, 2017 ID:1096394 Share Posted January 27, 2017 This really frustrating, boot into safe mode and uninstall Malwarebytes http://www.computerhope.com/issues/chsafe.htm Next, Boot back to Normal mode: Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Next, Download and install Malwarebytes from Here: https://www.malwarebytes.com/mwb-download/thankyou/ Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Post FRST logs pre and post MB reinstall... Thank you, Kevin Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096425 Share Posted January 27, 2017 Kevin, Completed. Both set of logs are attached. Still cannot turn rootkit scan on. R/ Prescott .... Pre MBAM Install FRST.txt Pre MBAM Install Addition.txt Post MBAM Install Addition.txt Post MBAM Install FRST.txt Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096427 Share Posted January 27, 2017 Kevin, On an upside note, no longer getting the malware blocked popup. R/ Prescott ... Link to post Share on other sites More sharing options...
kevinf80 Posted January 27, 2017 ID:1096481 Share Posted January 27, 2017 (edited) Not seeing anything wrong in those logs, I want you to turn off Microsoft Security Essentials, see if that is having an impact on Malwarebytes. Or even better still uninstall it and see if that makes a difference. Only uninstall if Malwarebytes has all shields up and realtime protection on.... MSE removal tool https://www.bleepingcomputer.com/download/microsoft-security-essentials-removal-tool/ Does that make any difference...? Edited January 27, 2017 by kevinf80 Link to post Share on other sites More sharing options...
chartierpw Posted January 27, 2017 Author ID:1096504 Share Posted January 27, 2017 Kevin, The "fix It" software has been retired. When I click on the link it sends me to Bleeping Computer and then when I click on the download button I get redirected to a Microsoft article explaining that "fix it" had been retired. I uninstalled Microsoft Security Essentials from control panel. No change, still unable to turn on the rootkit scan. R/ Prescott .... Link to post Share on other sites More sharing options...
Recommended Posts