Real Time Protection still does not work.

[Cabizzi]

I appreciate any help you may be able to offer.

Thanks, Cabizzi

MBAMSERVICE.zip

MB-CheckResult.txt

FRST.txt

Addition.txt

[dcollins]

It looks like this post is regarding MB3, not the Incident Response Beta, so I moved it. Let me know if that was incorrect.

I see you have Kaspersky installed, can you please add the following exclusions to Kaspersky? You will need to type the paths in manually for the C:\Windows\sysnative\drivers files as you won't find a sysnative folder while navigating.

[Cabizzi]

1 hour ago, dcollins said:

It looks like this post is regarding MB3, not the Incident Response Beta, so I moved it. Let me know if that was incorrect.

I see you have Kaspersky installed, can you please add the following exclusions to Kaspersky? You will need to type the paths in manually for the C:\Windows\sysnative\drivers files as you won't find a sysnative folder while navigating.

 

[Cabizzi]

dcollins,  I have followed your instructions and have certainly learned a great deal in doing so.   You might be interested to know that I am a retired teacher and a 73 year old grandmother.  My point being, you are never too old to learn.

Thank you, I hope it works.

[Cabizzi]

Guess what, RTP went off again.  Any ideas?

Cabizzi

 

[dcollins]

Do you know which protection is turning off? You can find this out by looking at the dashboard on the right side, at least one of these should say "Off"

[Cabizzi]

Dashboard indicates Web Protection is off.

[dcollins]

Thanks @Cabizzi. Looks like you are experiencing an issue that we believe we will have fixed in our next update. Unfortunately we are not aware of a workaround at this time.

[Cabizzi]

Okay, I understand.  Do you have any idea when the update will be available?   In the meantime, I guess I will have to manually turn on RTP.  How will I know when the next update will be available?

Thank you for your persistence.  

[Cabizzi]

I also have a question.  Can I run Malwarebytes without the web protection?

[dcollins]

No ETA on the update, but hopefully soon. Ideally you'll get the next update automatically once it's available, but the forums will also have an announcement.

You can run Malwarebytes without web protection, but you'll get a notification everytime you restart your computer telling you it's turned off. You will also be a little less protected as you won't be prevented from accessing potentially malicious sites, but the other protection modules should help catch anything that might get through

[Cabizzi]

(Ctrl/Cmd+V

Mr. Colllins, something strange happened .  I was going to a legitimate site and up popped warnings that my computer was infected.  This has happened to me before, so escaped and restarted the computer.  When I went to Malwarebytes to see if anything came up with the site, RTP was working.  I laughed and waited for it to go off.  It has not done so.  Can you offer an explanation?

Cabizzi

 

[dcollins]

It's possible whatever site you went to isn't in the blocked list. If you know the URL, you may want to post it over here: https://forums.malwarebytes.com/forum/155-newest-ip-or-url-threats/

[Cabizzi]

The site didn't come at all, just the warning.  When I went back to the site it came up all right.

[Firefox]

@Cabizzi was it something like these (curtosy of @David H. Lipman)

Tech Support Scammers... Fake Infection

Below is a video example of such a popup (Provided courtesy of David H. Lipman)
 
Movie of example: or more samples by David RIGHT HERE
{ It is just a video recording of one such site }
 
The answer is no.  It is not malware per se and as far as the Browser is concerned it is just HTML coding.  Albeit using bad coding to their advantage.
 
Assuming that a malicious script was used then MBAM would still not detect it as MBAM does not target scripted malware.
 
My understanding for Malwarebytes' Anti-Exploit (MBAE) is...
Since it is not using exploit code Malwarebytes' Anti-Exploit( MBAE ) will not block the activity as it would with something like a Buffer Overflow with an Elevation of Privileges.  As far as MBAE is concerned, it is just ordinary HTML code presented to the browser.

 
This link contains a very comprehensive list of resources: http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry3071944
EDIT: Also, if you visit the Malwarebytes Blog HERE, and type "tech support scam" into the search box, you will see many blog-posts/articles.
 
If your friend actually allowed the scammer to take control of the computer, then she might want to create a forum account here and have one of the malware experts guide her through checking the system for malware.
That process begins with the information in this pinned topic: Available Assistance for Possibly Infected Computers

Edited April 12, 2017 by Firefox

[Cabizzi]

It happened so fast that I neither got the name or the number to call.  As I said, a situation like this where a notice appeared indicating my computer was infected, led me to immediately esc and delete.  Sorry I didn't get more information.