periodic "Real-Time Protection layers turned off"

[tcloud]

Not sure when it began, but I get error "Real-Time Protection layers turned off" after several hours of using computer.  A log of when the failures occurred is below.

I'm running Malwarebytes Premium, ver. 3.0.6.1469.  I'm also running VIPRE Internet Security 2016 and SpyWare Blaster and Windows Defender is disabled.

===============

I noticed that some others with similar problem are using VIPRE.

My version is AntiVirus Internet Security 2016 --

Belarc Advisor lists -- Virus Protection:
ThreatTrack Security VIPRE
Malwarebytes

Software Versions:
ThreatTrack Security - VIPRE version 9.3.4.3
ThreatTrack Security - VIPRE Internet Security version 9.3.4.3
ThreatTrack Security - VIPRE SBVIPRE_PREMIUM_EN
ThreatTrack Security - VipreEdgeProtection.exe version 2.3.4.7 (64-bit)

===============

I began a log of the failures, but not immediately after they began.  Note that the computer is turned on before 07:00 every day, so you can see how long it ran before the protection failed.

2017-03-23
Getting popup message saying Malwarebytes Real Time Protection is turned off.  Can't turn it back on unless disable antivirus and reboot.  Actually, don't need to turn off AV, just reboot and it's back on.

rebooted 15:17 ... let's see how long before error message appears.
... running Scan ... complete 15:22

installed Belarc Advisor, got system details and uninstalled -- now restarting
16:00 -- restart

(no date, probably 3-24)
14:12 -- attempt to uninstall Belarc Advisor 8.5c again and rebooted.
15:24 -- MWB still appears to be okay
17:00 (app.) installed Office 2016 after an hour or so with Microsoft tech support ... MWB still seems okay

2017-03-30 - 16:18
Real-Time Protection layers turned off
One or more Real-Time Protection layers are turned off. Turn on all ...
-- Web Protection turned off -- hangs with "Starting"

2017-04-02 -- not sure when, noticed at 16:25
reooted -- then 14:35, same as above -- Web Protection turned off -- hangs with "Starting"
rebooted -- 16:40 -- all protection enabled

2017-04-04
-- Web Protection turned off
-- not sure when, noticed at 16:25

2017-04-05 -- 14:30
had removed Win7GamesForWin8-Setup.exe with Revo and restarted
.Rensomware Protection: Prevents ransomware from encrypting your files

15:45 -- noticed protection off again -- ransomware again
15:52 - after reboot, all protections okay

2017-04-17
10:00 -- no problem observed
00:44 (Monday morning) problem -- Web Protection turned off

2017-04-19
08:50 -- Web Protection turned off

2017-04-19
sometime between 1900 and 22:20
-- Web Protection turned off

2017-04-20
18:26  -- Web Protection turned off

2017-04-22
14:24 -- Web Protection turned off

MB-CheckResult-.txt

FRST.txt

Addition.txt

2017-04-22 mwbytes-scan-report.txt

logs.zip

Edited April 22, 2017 by tcloud

[Firefox]

Since you have Viper Antivirus try excluding the Malwarebytes Files below to see if it helps your issue. (the link will show you how)...

https://support.threattracksecurity.com/support/solutions/articles/1000126419-how-to-add-exceptions-in-vipre-home

I would like you to add these files to your Anti-Virus exclusions list
 

• C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
• C:\Windows\System32\drivers\mbae64.sys
• C:\Windows\System32\drivers\mbam.sys
• C:\Windows\System32\drivers\MBAMChameleon.sys
• C:\Windows\System32\drivers\MBAMSwissArmy.sys
• C:\Windows\System32\drivers\mwac.sys
• C:\Windows\system32\Drivers\farflt.sys
  

 

 

[tcloud]

thanks ... I thought I'd already done that.  It's late now and I may not be able to attend to this until Monday, but I will take your suggestion.

thanks again.

[tcloud]

I stayed behind to do it .. didn't take long.

The only file that was already excluded was mbam.exe

It is a little perplexing that I could see none of the files in the system32\drivers folder from the VIPRE browse menu even though I could see them when I opened the folder in explorer.  Then, after I entered the path directly into the file input field, there was no way to tell VIPRE to accept them, so I used the Return key and they now appear on the list.  I hope that means it found the files.

 

[Firefox]

after excluding the files, are you still having issues?

[tcloud]

It can go for days before it fails.  I'll report any issues when they occur.

thanks

[Firefox]

OK if the issue returns then provide the requested logs below and we can have a look...

*** If that does not correct the issue, then please read the following and attach to your next reply the 4 requested logs - Diagnostic Logs (the 4 logs are: mbam logs zipped, FRST.txt, Addition.txt and mb-checkResult.txt)

[davephx]

I wonder if tcloud is running grammerly?

I just starting having the same issue real time turned off and starting hangs.  
About a month ago issue solved by a Malwarebytes update I did direct from website - may have been Beta but now latest update brings back the issue?

Edited April 25, 2017 by davephx

[tcloud]

problem has returned --   (and I'm not running grammerly)

• Windows 10 updated a couple of days ago
• then Windows crashed on me yesterday.
• This morning (5-12-2017) MWB reported Web Protection turned off.
• Rebooted and Malware Protection was off, but turned on without need for reboot.
• Checked the VIPRE file exclusions and modified all files to have full path
  • I notice there is no "rules.ref" file anywhere on my C drive.

believe it should be located - C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\rules.ref

Since all has been good until this morning, I will wait to see if problem recurs before posting logs.

[dcollins]

MB3 doesn't use the .ref files any longer, we use the .mbdb files. That being said, please make sure you update to 3.1.2 as we have fixed some issues we've identified in regards to protections not starting.