Can't install Malwarebytes, "this app has been blocked for your protection"

[Ried]

Thanks again.

I have a plan now, bear with me while I summarize so I have all the info in one place. To recap:
 

Quote

 

23 hrs ago which would be 5/18/17 - first post:

I have this same problem. Every few days Windows defender is disabled, Bigfarm and another shortcut appear on Desktop, and a host of malwares appear when I scan with Malwarebytes/AdwCleaner. I scan & clean them, then the cycle happens again. I wanted to scan my PC for malware, but whenever I try to install mwbytes 3 I get this error:
Same problems happens when I run ADwCleaner.

When I run the installation with the hidden admin account, I get an error saying "could not call proc"

16 hrs ago:
Used chameleon which would have pulled MBAM 2.2.1, scanned machine and no infections found.

Then uninstalled 2.2.1 and tried again to install 3.1.2

 

The latest mb-checkresults you just sent, shows this:

Malwarebytes Version information
==================================
   "controllers_version" : "1.0.103",
   "db_version" : "2017.05.02.05",
   "dbcls_pkg_version" : "1.0.1851",
   "installer_version" : "3.0.6",

STEP 1:

What I'd like you to do is download and run mb-clean.  You can download it from here https://downloads.malwarebytes.com/file/mb_clean

* After downloading the latest version, please double-click it to run the program.
* Click *Yes* when prompted and wait.
* If you are prompted to reboot, click *Yes*. This is very important!

* After your computer has rebooted, I doubt you'll see a prompt to reinstall but if you do, please click _*No*_ when prompted to reinstall Malwarebytes 3.0.
* Note: It is *essential the No button is clicked*. If not, reinstallation of Malwarebytes 3.0 will be attempted - this may cause additional issues.
 * A log named !http://i.imgur.com/UdawJ7P.png! *mb-clean-result.txt* will be saved to your Desktop. Please attach the log in your next reply.

STEP2:

Please run mb-check.exe again and send me the new mb-check-results.zip so I can verify all the pieces of MB3 have been removed.

[Mohamed3on]

Ok, I just want you to know that the bigfarm/recurring malware post was in another topic regarding another pc of mine, so it's not related to this problem. 

[Ried]

I did see that, as well as your 4 scan results that were in the mb-check-results.zip file.  You've run several scans - MBAR, Scan with MBAM 2.2.1, AdwCleaner and they have all been coming up clean so it is not infection.

 

[Mohamed3on]

So mb-clean gives me the same "this app has been blocked" error :/

[Mohamed3on]

I ran it with the admin account and naturally (because it's a different account) it didn't find any malwarebytes software. 

[Ried]

Malwarebytes will scan across User Accounts, so it doesn't matter if you ran it from a different account.

If you turn off the Smart Screen, can you then run mb-clean.exe?  

[Mohamed3on]

Just now, Ried said:

Malwarebytes will scan across User Accounts, so it doesn't matter if you ran it from a different account.

If you turn off the Smart Screen, can you then run mb-clean.exe?  

No, smartscreen doesn't have any effect at all.

[Ried]

Okay, let's backtrack to when you ran cCleaner. You cleaned the registry on the 15th, and these issues began after that so let's restore that .reg file and rule out some sort of registry corruption.

It won't harm anything to put those back, registry cleaners in general are not recommended anyway - not even by Microsoft.

Navigate to the C:\Users\Mohamed Oun\Documents\cc_20170515_194808.reg file

Right click and select 'Merge'

Click Yes when prompted

You'll now see a warning asking if you want to continue, click Yes
When done, you'll see a message that 'keys and values contained in the .reg file have been successfully added'

Reboot the machine and try again to run mb-clean

 

[Mohamed3on]

4 hours ago, Ried said:

Okay, let's backtrack to when you ran cCleaner. You cleaned the registry on the 15th, and these issues began after that so let's restore that .reg file and rule out some sort of registry corruption.

It won't harm anything to put those back, registry cleaners in general are not recommended anyway - not even by Microsoft.

Navigate to the C:\Users\Mohamed Oun\Documents\cc_20170515_194808.reg file

Right click and select 'Merge'

Click Yes when prompted

You'll now see a warning asking if you want to continue, click Yes
When done, you'll see a message that 'keys and values contained in the .reg file have been successfully added'

Reboot the machine and try again to run mb-clean

 

Hi,

I did that, and got the same blocking message. 

[Ried]

What happens if you turn of UAC completely?

Click Start  and type User Account Control in the Search window

Select 'Change User Account Control Setting'

Slide the toggle all the way to the bottom

[nikhils]

Hello @Mohamed3on

Are you still experiencing the same issue following @Ried suggestion.

Please let us know. We think we can narrow down the issue and would like to give you some new steps to try.

Thank you.

[Mohamed3on]

On 5/20/2017 at 1:07 AM, Ried said:

What happens if you turn of UAC completely?

Click Start  and type User Account Control in the Search window

Select 'Change User Account Control Setting'

Slide the toggle all the way to the bottom

The same error.

[dcollins]

Can you please download the following application: https://www.trustprobe.com/fs1/dl_rcc.php?appname=RCC.exe

Run this program and then take a screenshot of the final window (you may have to maximize it) and upload the screenshot. Thanks

[nikhils]

Lets go ahead and verify your signatures:

Now let's check something. Follow the instructions below.

Download Sigcheck from https://live.sysinternals.com/sigcheck.exe

Make sure it is in your Downloads folder, alongside the Malwarebytes installer from before. (Please place the MB3.x installer also in your downloads folder if not so)

Open a command prompt with Admin Rights

Enter the following commands: 

cd C:\Users\username\Downloads
sigcheck * > signatures.txt

This will create the signatures.txt in your downloads folder. Can you please attach that to the next reply.

[Mohamed3on]

48 minutes ago, dcollins said:

Can you please download the following application: https://www.trustprobe.com/fs1/dl_rcc.php?appname=RCC.exe

Run this program and then take a screenshot of the final window (you may have to maximize it) and upload the screenshot. Thanks

 

[Mohamed3on]

48 minutes ago, nikhils said:

Lets go ahead and verify your signatures:

Now let's check something. Follow the instructions below.

Download Sigcheck from https://live.sysinternals.com/sigcheck.exe

Make sure it is in your Downloads folder, alongside the Malwarebytes installer from before. (Please place the MB3.x installer also in your downloads folder if not so)

Open a command prompt with Admin Rights

Enter the following commands: 

cd C:\Users\username\Downloads
sigcheck * > signatures.txt

This will create the signatures.txt in your downloads folder. Can you please attach that to the next reply.

I've done this before, here

 

[nikhils]

Got  it.

Please run the following steps:

Press on the Win + R keys, type in mmc.exe and press on Enter.
In the Console, click on the File menu, followed by Add/Remove Snap-in....
In the left list, select Certificates and click on Add to add it to the other side.
In the prompt, select My user account and click on Finish, then on Ok.
Browse under the Certificates - Current User till you reach Untrusted Certificates and click on it.

Please send me a scheenshot of the untrused certificates you have.

[Mohamed3on]

1 minute ago, nikhils said:

Got  it.

Please run the following steps:

Press on the Win + R keys, type in mmc.exe and press on Enter.
In the Console, click on the File menu, followed by Add/Remove Snap-in....
In the left list, select Certificates and click on Add to add it to the other side.
In the prompt, select My user account and click on Finish, then on Ok.
Browse under the Certificates - Current User till you reach Untrusted Certificates and click on it.

Please send me a scheenshot of the untrused certificates you have.

 

[nikhils]

Very good.

Now, select all these certificates and delete them (with the Del button or right-click and Delete). Once done, try to install Malwarebytes.

[nikhils]

Please make sure you only deleting the untrusted certificates.

[Mohamed3on]

3 minutes ago, nikhils said:

Very good.

Now, select all these certificates and delete them (with the Del button or right-click and Delete). Once done, try to install Malwarebytes.

It finally installed. I scanned with it and there was no malware. Thank you!

[nikhils]

Sweet.

Thank you for your patience in getting us all the logs and screenshots

Best,