Can't install Malwarebytes, "this app has been blocked for your protection"

[Mohamed3on]

There you go, I hope that's what you need:

Logfile.zip

[dcollins]

Thanks, I'm going to start looking into this and I'll get back to you when we have more information

[dcollins]

One more thing (sorry, hopefully we're getting closer). Can you take a screenshot of the security tab again, but this time click on each group? Your first screenshot shows the Authenticated Users, but can you screenshot the permissions for System, Administrators, and Users?

[Mohamed3on]

SYSTEM and Admins have the exact same permessions as auth. users. Here's Users:

 

[dcollins]

OK, let's make sure the download isn't being corrupted somehow. Can you please download hashmyfiles from http://www.nirsoft.net/utils/hashmyfiles-x64.zip and use that to get the hashes for the setup file. Please post a screenshot that contains the entire MD5 hash

[Mohamed3on]

[dcollins]

That's look good, can you use the following tool to check the certificates on the machine? We believe that the proc error and the "not allowed to run" error are related.

1. Download Sigcheck from https://live.sysinternals.com/sigcheck.exe
2. Open a command prompt window by pressing Windows Key + R and clicking Ok
3. In the window, change to the folder where you downloaded the file from step by typing cd PATH
   • For example, if you downloaded the file to your desktop, type cd %USERPROFILE%\Desktop or cd %USERPROFILE%\Downloads if the file is in your Downloads folder
4. Now type sigcheck -tv >> signatures.txt
   • You will be prompted to accept the EULA
5. Upload the signatures.txt file from step 4

[Mohamed3on]

signatures.txt

[dcollins]

Sorry, I mistyped the command. Can you do the above steps with the following command instead

sigcheck * > signatures.txt

Also, can you try creating a new user account and running as that user?

[Mohamed3on]

Here it is:

Also the new account gets the same "you are blocked" message.

signatures.txt

[dcollins]

Ok, after speaking with some engineers about these, we are fairly confident the installer proc issue is a permissions issue, which aligns with the "you are blocked" message you get when running the installer normally.

If you haven't made a thread in the Malware Removal Section yet, let's start there: https://forums.malwarebytes.com/forum/7-malware-removal-for-windows/

The Malware Removal Experts in that forum are really good at cleaning off infections from machines and helping you get your machine back to running how it should. I would make a new thread and post your FRST logs so they can take a look and see if they believe it's infected. Once we are sure the machine is free from infection, then we can figure out what's going on with MB3.

[Ried]

Hello Mohamed3on,

When you begin the topic in the Malware Removal Section, please let me know and I'll work with you on this.

 

[Ried]

@Mohamed3on

Can you try something for me before we do anything else?  Uninstall the Internet Download Manager via Control Panel > Programs and features, reboot.

Now please download a fresh installer from here https://downloads.malwarebytes.com/file/mb3  and make sure you are double clicking the new one you've downloaded

Is it still the same message?

[Mohamed3on]

5 hours ago, Ried said:

@Mohamed3on

Can you try something for me before we do anything else?  Uninstall the Internet Download Manager via Control Panel > Programs and features, reboot.

Now please download a fresh installer from here https://downloads.malwarebytes.com/file/mb3  and make sure you are double clicking the new one you've downloaded

Is it still the same message?

Hi Reid, 

Thanks for your help. Unfortunately, it's the same problem, yes.

[Mohamed3on]

8 hours ago, dcollins said:

Ok, after speaking with some engineers about these, we are fairly confident the installer proc issue is a permissions issue, which aligns with the "you are blocked" message you get when running the installer normally.

If you haven't made a thread in the Malware Removal Section yet, let's start there: https://forums.malwarebytes.com/forum/7-malware-removal-for-windows/

The Malware Removal Experts in that forum are really good at cleaning off infections from machines and helping you get your machine back to running how it should. I would make a new thread and post your FRST logs so they can take a look and see if they believe it's infected. Once we are sure the machine is free from infection, then we can figure out what's going on with MB3.

Alright.

Just FYI, before trying to install mb3, I actually had it installed and working well. Then one day it stopped working and gave me "Unable to run the service" whenever I started it, that's why I uninstalled/tried to reinstall.

[Ried]

Ok, thanks.

1. Before you ever installed Malwarebytes 3.0, did you have Malwarebytes 2.2?

2.  Can you send me a new set of logs from FRST?

Thanks!

[Mohamed3on]

1 minute ago, Ried said:

Ok, thanks.

1. Before you ever installed Malwarebytes 3.0, did you have Malwarebytes 2.2?

2.  Can you send me a new set of logs from FRST?

Thanks!

1. No.

2. Sure.

FRST.txt

Addition.txt

[Ried]

Thanks.

Please delete your existing mb-check.exe and download our latest version of mb-check from here https://downloads.malwarebytes.org/file/mb3_check

Double click to run it, and when it has finished, a zipped folder name mb-check-results will be saved to your desktop. Please attach that in your next reply

[Mohamed3on]

16 minutes ago, Ried said:

Ok, thanks.

1. Before you ever installed Malwarebytes 3.0, did you have Malwarebytes 2.2?

2.  Can you send me a new set of logs from FRST?

Thanks!

1. No.

2. Sure.

mb-check-results.zip

[Ried]

Thank you.  I need some time to go over this very long thread and summarize what has been done thus far, and in what order. This will help me determine my next course of action.

From what I see in the mb-check-results.zip, 3.0.6 is installed, it will scan, but none of the protection is running, correct?

[Mohamed3on]

Just now, Ried said:

Thank you.  I need some time to go over this very long thread and summarize what has been done thus far, and in what order. This will help me determine my next course of action.

From what I see in the mb-check-results.zip, 3.0.6 is installed, it will scan, but none of the protection is running, correct?

No, it's not installed.

I'm not sure if the zip file you read is correct. I reuploaded it just in case.

mb-check-results.zip

[Ried]

It had to have installed at some point, otherwise I wouldn't see the logs and mbamservice folder.  Let me go over this thread, I need to figure out at what point it did partially install.

[Mohamed3on]

1 minute ago, Ried said:

It had to have installed at some point, otherwise I wouldn't see the logs and mbamservice folder.  Let me go over this thread, I need to figure out at what point it did partially install.

It was installed but had been uninstalled because it wasn't starting.

[Ried]

You used cCleaner to clean the registry a couple days ago. Can you zip this file and attach it for me please?

C:\Users\Mohamed Oun\Documents\cc_20170515_194808.reg

[Mohamed3on]

cc_20170515_194808.zip