Can't install Malwarebytes, "this app has been blocked for your protection"

[Mohamed3on]

I have this same problem. Every few days Windows defender is disabled, Bigfarm and another shortcut appear on Desktop, and a host of malwares appear when I scan with Malwarebytes/AdwCleaner. I scan & clean them, then the cycle happens again.

[Mohamed3on]

Hello,

I wanted to scan my PC for malware, but whenever I try to install mwbytes 3 I get this error:

 

Same problems happens when I run ADwCleaner.

When I run the installation with the hidden admin account, I get an error saying "could not call proc"

What do I do?

I'm on Windows 10 btw.

 

[nikhils]

Hello @Mohamed3on

Can you please try something for me :

Can you try one suggestion please:

1. Press Windows + R key and enter %temp%

2. Delete all data within temp folder including all hidden files. You need to enable "View hidden items"

3. Run the installer again.

Let us know if that worked.

[Mohamed3on]

3 minutes ago, nikhils said:

Hello @Mohamed3on

Can you please try something for me :

Can you try one suggestion please:

1. Press Windows + R key and enter %temp%

2. Delete all data within temp folder including all hidden files. You need to enable "View hidden items"

3. Run the installer again.

Let us know if that worked.

Hi,

I did that, still blocked from installing. "An administrator has blocked you from running this app"

[Firefox]

Something to try... when you download the software, click save and save it to your downloads folder (instead of clicking on Run) UAC may just be preventing you from running files from a temp file locations...

[Mohamed3on]

Just now, Firefox said:

Something to try... when you download the software, click save and save it to your downloads folder (instead of clicking on Run) UAC may just be preventing you from running files from a temp file locations...

It's already saved, I tried running it from a couple of locations, same result.

[nikhils]

Hello @Mohamed3on

There is a possibility your system might be infected.

Can you please use the forum post below and post the FRST.txt, Addition.txt and MB-Check results file.

Thank you

 

[Firefox]

 

[Mohamed3on]

There you go:

MB-CheckResults.txt

Addition.txt

FRST.txt

[nikhils]

Thank you , will get back to you soon.

[Porthos]

19 minutes ago, Mohamed3on said:

There you go:

MB-CheckResults.txt

Addition.txt

FRST.txt

 

The FRST and Addition are incomplete please try again.

[nikhils]

Can you please run FRST tool again. Your logs might be corrupted as I am not seeing any entries in it.

[Mohamed3on]

1 minute ago, Porthos said:

The FRST and Addition are incomplete please try again.

I've run them twice and that's what I got each time. Should I enable the optional scans too?

[Mohamed3on]

Ok, here are the full logs:

 

FRST.txt

Addition.txt

[nikhils]

Please download Malwarebytes Anti-Rootkit (MBAR) from here http://www.malwarebytes.org/products/mbar/ and save it to your desktop. 

NOTE:  You MUST Exit Malwarebytes Anti-Malware before running MBAR.  
Right click the Malwarebytes icon in the system tray and select 'Exit'

1. Double click on the MBAR file and allow it to run.

2. Click OK on the next screen, to allow the package to extract the contents of the file to its own folder named mbar.

3. Mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.

4. After reading the Introduction, click 'Next' if you agree.

5. In the Update Database screen, click on the 'Update' button.

6. Once you see 'Success: Database was successfully updated' click on 'Next', then click the Scan button.

With some infections, you may see two messages boxes:

 1.'Could not load protection driver'. Click 'OK'.
 2.'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.
 
7. If malware is found, do NOT press the Cleanup button when the scan completes. Click EXIT. 

We would like to see the log first so we can see what it may be targeting.   
You'll find the log in that mbar folder as MBAR-log-<date and time>***.txt . Please attach that to your next reply.

[Mohamed3on]

I ran it, and there was no malware detected.

 

mbar-log-2017-05-18 (19-20-54).txt

[nikhils]

Hello @Mohamed3on

Can you please try disabling the windows smart screen and then try to run the installer and see if you get the same error?

http://www.windowscentral.com/how-fix-app-has-been-blocked-your-protection-windows-10

Thank you,

[Mohamed3on]

10 minutes ago, nikhils said:

Hello @Mohamed3on

Can you please try disabling the windows smart screen and then try to run the installer and see if you get the same error?

http://www.windowscentral.com/how-fix-app-has-been-blocked-your-protection-windows-10

Thank you,

Hi, it still produces the same result.

When I enable the administrator account and login with it, I get this error instead:

 

[nikhils]

Ok, thank you for your patience. We are trying to get to the bottom of this.

Can you try renaming the installer from mb3-setup-consumer-3.x exe to just Setup.exe

Turn on Smart screen and try and run it. Want to check if you get the same error.

 

[Mohamed3on]

9 minutes ago, nikhils said:

Ok, thank you for your patience. We are trying to get to the bottom of this.

Can you try renaming the installer from mb3-setup-consumer-3.x exe to just Setup.exe

Turn on Smart screen and try and run it. Want to check if you get the same error.

 

Thank you for your persistence! I did that and still got the same error.

[nikhils]

What error are you seeing? The runtime error or the Admin has blocked smart screen error

[Mohamed3on]

1 minute ago, nikhils said:

What error are you seeing? The runtime error or the Admin has blocked smart screen error

The "this app has been blocked" error. I'm back to my main account now, not the hidden admin one.

[nikhils]

Can you please send us  a screen shot of complete windows version?

1. Press Windows+R

2. type in Winver and run it.

Please attach      the windows version screen shot

[Mohamed3on]

[nikhils]

Thank you @Mohamed3on, The windows version might not be the issue here.

One more suggestion for you.

1. Go to https://www.malwarebytes.com/chameleon/ and download that tool.

2. Reboot your machine into safe mode with networking and run the tool.

3. Open the Chameleon HTML help page and click on the Chameleon #2 button.

4. This will download MBAM and run a scan. Please save the scan results and post it here.

Also if MBAM will quarantine files it will prompt you for a reboot. Reboot back in to  safe mode  and run MBAM scan again to make sure there are no more detections.