Problem Installing Malwarebytes

[Rianne]

On 5/15/2017 at 5:17 AM, dcollins said:

Do you have your %temp% folder on a ramdrive on your machine by chance? If so, can you try changing it to the default location?

If you don't have a temp drive, can you please navigate to %temp% and grab any files that start with Setup Log and upload them here? They should contain the information around setup failure

this is also my problem right now.. here is the log when i tried to install malwarebytes..

 

	2017-05-16 11:21:02.548   Log opened. (Time zone: UTC+08:00)
2017-05-16 11:21:02.548   Setup version: Inno Setup version 5.5.8 (u)
2017-05-16 11:21:02.548   Original Setup EXE: D:\Users\Admin\Downloads\mb3-setup-consumer-3.1.2.1733.exe
2017-05-16 11:21:02.548   Setup command line: /SL5="$703D4,62499111,119296,D:\Users\Admin\Downloads\mb3-setup-consumer-3.1.2.1733.exe"
2017-05-16 11:21:02.548   Windows version: 10.0.14393  (NT platform: Yes)
2017-05-16 11:21:02.548   64-bit Windows: Yes
2017-05-16 11:21:02.548   Processor architecture: x64
2017-05-16 11:21:02.548   User privileges: Administrative
2017-05-16 11:21:02.548   64-bit install mode: Yes
2017-05-16 11:21:03.548   Created temporary directory: C:\Users\Admin\AppData\Local\Temp\is-M8FU8.tmp
2017-05-16 11:21:03.564   Extracting temporary file: C:\Users\Admin\AppData\Local\Temp\is-M8FU8.tmp\suhlpr.dll
2017-05-16 11:21:03.720   InitializeSetup raised an exception (fatal).
2017-05-16 11:21:03.720   Exception message:
2017-05-16 11:21:03.720   Message box (OK):
                          Runtime Error (at 47:120):
                          
                          Could not call proc.
2017-05-16 11:21:04.517   User chose OK.
2017-05-16 11:21:04.517   Deinitializing Setup.
2017-05-16 11:21:04.517   Log closed.

[dcollins]

I split your post out from the original thread as it's easier to troubleshoot in different threads. Can you please perform the following:

1. Download Procmon from https://live.sysinternals.com/procmon.exe
2. Launch Procmon and accept the EULA
   • If you have run this tool before, you may get prompted to change filters. Just click reset and then ok
3. Run the MB3 installer until it fails
4. Once the installer fails, go to Procmon and click the magnifying glass to stop capturing
5. Save the log by clicking the save icon
6. Find the saved log, right click it, and choose Send to -> Compressed (Zipped) folder
7. Upload the zip file as part of your reply

This should give us some more indication of what's wrong

[Rianne]

Yesterday i was infected by bunch of viruses because of a file i downloaded on a torrent site. i tried to clean my system that's why i decided to install malwarebytes.

the first error was Runtime Error (at 47:120): Could not call proc ..

then i tried to use windows defender to clean it instead because i was running out of options..

now this morning i tried to install malwarebytes again and this is what it said

i could really use some help..

Setup Log 2017-05-16 #005.txt

MB-CheckResults.txt

Addition.txt

FRST.txt

[Rianne]

Yesterday i was infected by bunch of viruses because of a file i downloaded on a torrent site. i tried to clean my system that's why i decided to install malwarebytes.

the first error was Runtime Error (at 47:120): Could not call proc ..

then i tried to use windows defender to clean it instead because i was running out of options..

now this morning i tried to install malwarebytes again and this is what it said

i could really use some help..

Setup Log 2017-05-16 #005.txt

MB-CheckResults.txt

Addition.txt

FRST.txt

 

 

Logfile.rar

[nikhils]

Hello @Rianne

Can you try to run Chameleon and see if that will install MBAM 2.x on your system? This is a protected install and should work without issues.

https://www.malwarebytes.com/chameleon/

After you install MBAM 2.x it should automatically scan. Can you please save the scan results as a text file and attach the same.

Thank you,

[Rianne]

thank you for the response. here it is.

Scan Log.txt

[nikhils]

OK. Looks like MBAM detected and quarantined a bunch of stuff. After the scan were you prompted for a reboot?

Also as a next step can you please open the MBAM UI and run a scan again and make sure we don't detect anything. (Basically we want to make sure your machine is clean now)

Let us know how that went.

[dcollins]

I merged your two posts together as they are troubleshooting the same topic.

Edited May 17, 2017 by dcollins

[nikhils]

Hello @Rianne

You system seems to be heavily infected , so I have moved this thread to the Malware Removal Section.

The experts there can help you clean up/ remediate your system and get it into a clean state.

Thank you.

[Rianne]

i scanned > detected malware > quarantined > reboot > scanned again > detected few malwares again > quarantined > reboot

it goes on and on..

some improvements tho. im detecting different malwares each time i scan with MBAM ..

[nikhils]

Can you try one suggestion please:

1. Press Windows + R key and enter %temp%

2. Delete all data within temp folder including all hidden files.

3. Run a scan using MBAM to see if detentions are still happening.

[nikhils]

Hello @Rianne

Please download Malwarebytes Anti-Rootkit (MBAR) from here http://www.malwarebytes.org/products/mbar/ and save it to your desktop. 

NOTE:  You MUST Exit Malwarebytes Anti-Malware before running MBAR.  
Right click the Malwarebytes icon in the system tray and select 'Exit'

1. Double click on the MBAR file and allow it to run.

2. Click OK on the next screen, to allow the package to extract the contents of the file to its own folder named mbar.

3. Mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.

4. After reading the Introduction, click 'Next' if you agree.

5. In the Update Database screen, click on the 'Update' button.

6. Once you see 'Success: Database was successfully updated' click on 'Next', then click the Scan button.

With some infections, you may see two messages boxes:

 1.'Could not load protection driver'. Click 'OK'.
 2.'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.
 
7. If malware is found, do NOT press the Cleanup button when the scan completes. Click EXIT. 

We would like to see the log first so we can see what it may be targeting.   
You'll find the log in that mbar folder as MBAR-log-<date and time>***.txt . Please attach that to your next reply.

[nikhils]

Hello @Rianne

We believe we have identified the reason you saw the clocks.

Can you please run the following instructions:

Download Sigcheck from https://live.sysinternals.com/sigcheck.exe

Make sure it is in your Downloads folder, alongside the Malwarebytes installer from before. (Please place the MB3.x installer also in your downloads folder if not so)

Open a command prompt with Admin Rights

Enter the following commands: 

cd C:\Users\username\Downloads
sigcheck * > signatures.txt

This will create the signatures.txt in your downloads folder. Can you please attach that to the next reply.