INSTALLATION PROBLEM

[RayStA]

INSTALLATION PROBLEM

Windows 10 home 64-bit fully updated, version 1607 Build 14393.693

C:\ProgramData\Malwarebytes\MBAMService\logs\ contained two log files. Each compressed and attached

 

New update from 2 to Malwarebytes3

   did not ask to uninstall previous versions

   did not ask for license code

Auto started MB

 

Changed scan time of day in settings

 Notification area indicated MB running

 

REBOOTED

 

[From memory; see later]

Msg: "Unable to start   -   Unable to connect the Service"

 Clicked ok to remove message

No entry in notification area.

  

Shortcut: double click -> Msg: "Unable to start   -   Unable to connect the Service"

No entry in notification area.

Clicked ok to remove message

 

Shortcut -> right click -> start as administrator -> Msg: "Unable to start   -   Unable to connect the Service"

No entry in notification area.

Clicked ok to remove message

 

At some time above found Task manager -> Background processes ->

   Malware bytes service  - in memory (~170MB); CPU variable (0% to about 5%)

 

Tried to uninstall so as to re-install

   some problem about uninstall file (can't remember detail); aborted

 

After a while BSOD.

Auto rebooted before I could document the message

 

On boot up:

Msg: "Unable to start   -   Unable to connect the Service"

Message disappeared after a while

 

Task manager -> Background processes ->

   Malware bytes service  - in memory (~170MB); CPU variable (0% to about 5%)

No entry in notification area.

 

Computer appears to be ok but without Malwarebytes.

[END]

mbae-default.zip

MBAMSERVICE.zip

[dcollins]

@RayStA sorry to hear about your issues. It sounds like some corruption may have happened during your 2.x to 3.x upgrade. Can you try to uninstall again, perhaps in Safe Mode might work better. If you do get an error, please post the error message you're seeing.

[RayStA]

Thank you Devin. Starting in safe mode allowed uninstall. Then reinstalled and all is well.

[Sorry for the late reply. I was unable to start in safe mode by hitting the F8 key. My expert (son) had the same problem but then started in safe mode after setting msconfig > boot tab > (start in) safe mode. After that it was plain sailing.]

[dcollins]

Glad to hear you got it working!

[RayStA]

I jumped the gun.
After another reboot Malwarebytes "Unable to start. Unable to connect the service."

I have gone back to re-installing Malwarebytes 3 after each boot. During that process I click "ignore" to the error messages (see images). After reinstallation concludes I update and 'Scan Now'. This proceeds normally and in the notification area Malwarebytes indicated that all protection is on.

[dcollins]

Ok, let's try some other troubleshooting steps. First things first, please uninstall the version of Malwarebytes that you have installed and then reboot. Once done, please run mb-check from the following link and upload the mb-checkResult.txt log file that will be placed on your desktop.

Based on the error messages you're posting, when you're doing an re-install every morning, some files are getting left behind and not getting updated properly. This log will show us what's left behind, and then we can manually remove those files.

[RayStA]

Sorry to be a nuisance but where is the mb-check link?
The only ones I see are 'report post', 'Malwarebytes staff'', 'twitter' and 'facebook'.

[dcollins]

I forgot the link, sorry

https://downloads.malwarebytes.org/file/mb3_check

[RayStA]

Boot > MB not running > run msconfig > boot tab > selected safe boot > rebooted in safe mode.
Uninstalled Malwarebytes; soon 'Windows safe centre not running' or similar > turned off internet access.
Downloaded mb-check-3.0.2.1003.exe > When running a window opened VERY briefly and closed so quickly I thought there was a problem, but found mb-checkResult.txt had been generated. Returned to normal boot with internet access.
mb-checkResult.txt is attached.

mb-checkResult.txt

[RayStA]

Just in case it is of interest:

 

Just out of interest, whilst a long backup was running, I looked for
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

I had to unhide C:\ProgramData\ but then C:\ProgramData\Malwarebytes\ contains only \Malwarebytes Anti-Malware\ folder and not \MBAMService folder\.

[dcollins]

Thanks @RayStA, can you perform the following steps to finalize the cleanup?

1. Please download the attached fixlist.txt file and save it to your desktop
2. Then download Farbar Recovery Scan Tool from here http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ and save it to your desktop.
   Note: You need to run the version compatible with your system.
   **After you click the Download Now 64-bit, or the Download Now 32-bit, another page will open — DO NOT CLICK ANY ADDITIONAL 'download now' buttons, just wait and look toward the bottom of your browser for the option to Run or Save. Click Save.
3. Double-click to run it. When the tool opens click Yes to the disclaimer.
   Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
4. Click the Fix button
5. When the process has finished, it will save a log in the same directory the tool was run from.
6. Reboot
7. Download and install the latest version of Malwarebytes (3.0.6.1469)

If the install still fails, please upload the logfile created in step 5, it should be named fixlog.txt

[RayStA]

Got as far as 4 then:
Click the Fix button  >  popup:
"Farbar Recovery Scan Tool (x64)
"No fixlist.txt found
"The fixlist.txt should be in the same folder/directory the tool is located"
On the desktop are FRST64.txt (the program) and mb-checkResult.txt (the earlier diagnostic log)

Should I have run "scan" first?

[dcollins]

Sorry, I forgot to attach the fixlist file, I'm on a role for forgetting things in this thread apparently. I've attached the fixlist.txt file to this post now

 

fixlist.txt

[RayStA]

Doesn't work. Got the same popup as yesterday. See attachement.
I tried putting FRST64.exe and fixlist.txt together in two different locations with the same result.

O/e: Because the fixlist  is a .txt file I tried opening it. All I got was an empty browser window at
https://forums.malwarebytes.com/applications/core/interface/file/attachment.php?id=212476

[dcollins]

It sounds like the download didn't succeed properly. I just verified the file by downloading it from my link above and verified it has contents. Are you saving both FRST64.exe and fixlist.txt to your desktop?

[RayStA]

I re-downloaded the two files.

Downloaded FRST.exe. The only options were 'Open' and 'Show in folder'. There was no option to 'save to desktop'.
Show in folder identified the folder as C:\Users\Ray\Downloads. Previously I dragged it from there to the desktop and tried that again.

Downloading fixlist.txt gave the same response except for the additional option to 'always open files of this type'. Again 'Show in folder' identified the same downloads folder. Dragged that to the desktop too.

This time the fixit.txt file is indeed a text file. I have found that the original download was a fixlist.txt.url file masquerading as a .txt file

I again ran the FRST.exe file from the desktop only to receive a popup "No fixlist.txt file found!

NEXT: Downloaded again and ran FRST.exe from the downloads folder. This time I got a response. A brief short progress bar and a popup "Fix completed. "Fixlog.txt" is saved in the same directory FRST is located.

Rebooted

Reinstalled v.3.0.6.1469; changed scan schedule time; ran -> clean

Rebooted

Malwarebytes failed to start

Fixlog.txt

[dcollins]

OK, well we got it back installed, which is step 1. Now to solve your other issue. Can you post the logs below from FRST as well so we can see what else might be going on:

Create and obtain Farbar Recovery Scan Tool (FRST) logs

1. Download FRST and save it to your desktop
   • Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
2. Double-click to run and when the tool opens click Yes to the disclaimer
3. Press Scan button
4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   • Attach both of these logs to your post by clicking on the "Drag files here to attach, or choose files..." or simply drag the files to the attachment area

[RayStA]

As previously indicated I cannot download to the desktop and dragging from the download folder to the desktop seems to muck some things up.

I have run FRST from the download folder to generate FRST.txt and Addition.txt (this one took a long time to complete). I have attached these two files.

FRST.txt

Addition.txt

[dcollins]

Thanks! I see you have F-Secure installed. Can you open F-Secure, then go into the DeepGuard settings, and turn on compatibility mode. Then reboot and see if you can open Malwarebytes properly. We have seen reports from users with F-Secure where this fixes the issue

[RayStA]

Nearly there.

1. Start up.
I've done two restarts and one 'shutdown - wait - start' without the problem re-appearing. Malwarebytes3 was running each time.

2. Scheduled scans. 
However when I check Settings > Scan Schedule the scan time entry has been unticked following a restart. Despite that the scan was run at the appointed time. Is that normal?

3. F-Secure.
F-Secure carries a warning that use of compatibility mode lowers security. That is not desirable.

F-Secure DeepGuard Help includes "The safety of an application is verified from the trusted cloud service." though it does not say who maintains the "trusted cloud service".
You say that the F-secure problem has been found previously. In that case Malwarebytes should already be talking to F-Secure or the authority that maintains the "trusted cloud service" about the problem so that it allows Malwarebytes3 to connect at boot time. Can you confirm that?

PS. FRST Location: 
The frst.exe file allowed by my F-Secure DeepGuard is located in the downloads folder (my only option for this download) but NOT in the other locations that it has been dragged to and is still there. I siggest that you stipulate that the file must be run from the downloaded location, not specifically the desktop, though that could be suggested.

[dcollins]

Thanks @RayStA, let me see if I can answer your questions

1. Startup: So things are good?
2. Scheduled Scans: Are you saying that the item in scheduled scans is not checked? If so, that's not a problem. The checkbox is there in case you want to delete multiple items
3. F-Secure: We are working on a better long term solution for the DeepGuard compatibility issue
4. FRST Location: Good to know, thanks for the follow up!

[RayStA]

Yes. All is now well.

Thank you for all the help. Although it did stutter at times we got there in the end. That said, the longest delay was my not at first being able to get into safe mode. I am very pleased that the other points I raised are in hand.
Again thank you, I hope I will not need to trouble you again.

PS. I saw that someone in another topic had the same problem of not being given the option to save a download to the desktop. There was not enough detail to see how they got over the problem.

 

[RayStA]

After the initial elation at getting Malwarebytes 3 Premium to connect at boot time further consideration has presented doubts; specifically the abandonment of part of the protection afforded by F-Secure SAFE. The F-Secure DeepGuard setting specifically states that the use of compatibility mode "lowers security". ["DeepGuard blocks new and undiscovered Trojans, worms, exploits, and other harmful applications that try to make changes to your computer, and prevents suspicious applications from accessing the Internet." ]

I have been unable to glean, from the Malwarebytes website or elsewhere, whether Malwarebytes3 Premium would replace the security items removed from F-Secure SAFE by the use of compatibility mode. Can you say whether or not that is so?