Chameleon can't install MBAM. Scan failure since 4/29.

[PaulL]

I'm running windows 10 home. I have an old perpetual license for MBAM. On 4/29 I installed Cybereason RansomFree 2.2.26.0 which I read about. It seemed to be running fine and it established its honeypot directories which seemed like a good idea. Automatic MBAM scans failed to run from 4/30 until 5/9. On 5/3 windows updated itself. On 5/8 Cybereason failed to run. On 5/11 Macrium Reflect failed to make an image backup of drive C: to drive K: (an internal hard disk). The VSS log from that failure shows mbamservice.exe in the faulting application path.

On 5/14 MBAM displayed an automatic warning that it could not start a service. I could not manually start MBAM. I downloaded Chameleon and ran it. It downloaded, installed and ran an MBAM scan which which quarantined a bunch of PUPS including two from MindSpark which looked suspicious. On 5/15 an MBAM scan showed no infection but I could not turn on the exploit protection. Since 5/16 MBAM will not start and no automatic scans have run. Chameleon reports that it can't download mbamsetup.exe and closes.

I have scanned repeatedly with FRST64.exe, msert.exe, McAfee Stinger, kss, and a McAfee suite which my ISP provides for free. All these scans have found nothing significant, only a few minor PUPs. Interestingly, the FRST Addition.txt file reports that MBAM is enabled and up to date, but MBAM won't run. I have attached the FRST.txt and Addition.txt files. I have an available VSS log from the failure of Macrium Reflect on 5/11 available which I can attach if you want to see it. Windows installed another update on 5/17.

Addition.txt

FRST.txt

[dcollins]

Let's start by running mb-clean from the following URL. When you run it, it will remove your currently installed version and install the latest version of MB3 on your machine: https://downloads.malwarebytes.com/file/mb_clean

If malwarebytes still won't run, please run mb-check from the following URL and upload the zip file from your desktop once it's done

https://downloads.malwarebytes.com/file/mb3_check

 

[PaulL]

Downloaded and ran mb-clean-3.1.0.1002.exe. It showed no screen info for 5 minutes. I could see it running in task manager. It is still running in task manager.

I saw no indication that MBAM was removed or re-installed. After 10 minutes MBAM would still not run.

I downloaded and ran mb3-check-3.1.0.1002.exe. It produced the mb-check-results.zip file which I have attached.

mb-check-results.zip

[dcollins]

Ok, please try the following:

1. Restart your computer into Safe Mode
2. Delete C:\Program Files\Malwarebytes\Anti-malware\uninst000.exe
3. Run mb-clean again

Then please report back with what happens

[PaulL]

Hi Devin,

I got into safe mode through settings. It reported that mb-clean was still running. I rebooted, deleted uninst000.exe, ran mb-clean which installed MBAM. MBAM scanned and found no viruses. The old scan reports have been deleted. I think it might be fixed. Do you want me to do anything else?

Paul

[dcollins]

If everything is working well, then you should be good!

[PaulL]

Hi Devin,

MBAM seems to be running normally. It has blocked one ad related website in the last three days. It did automatic scans on 5/20, 5/21 and 5/22 and detected no garbage. I guess that between MBAM and the McAfee suite which my ISP provides for free I am reasonably secure.

I wonder why, on 5/8, Cybereason failed to run for a few days until I re-installed it. It has established a honeypot consisting of 2 directories on each of my disks, with names earlier in ASCII sort order than any other directories, full of junk files for malware to attack and then watches to see if any process messes with them. This is a new idea which seems diabolically effective to me. What do you think of Cybereason?

I also wonder why Macrium Reflect has been unable to make an image backup of drive C: since 5/11. It seems to have something to do with a microsoft change to VSS as of that date. I have heard that Macrium Reflect may work if I reboot to safe mode and then make a backup because VSS won't be running. Does this sound reasonable? Should I try it? What do you think of Macrium Reflect?

What program do you think I should be using to make image backups? I used Acronis for a few years but they have messed it up recently. Microsoft's image backup is a joke in my opinion.

I make multiple daily file backups of all changed files to USB disks using Robocopy which is very fast. I shut down the USB backup disks when the backup copies are complete. I also occasionally make manual restore points. Sometimes, since I turned 70, I even wear suspenders and a belt. I never had problems like these when I was running DEC's VAX or IBM's VS/VM 3.0 on big iron. I guess Apple did the right thing when they bought the DEC OS.

Thanks for your help!

Paul

 

[dcollins]

I haven't used most of those pieces of software, so it's hard for me to provide adequate information about them, sorry. I can say that when it comes to backup, I recommend to use whatever you're most comfortable with. In case something does go wrong, you want to have a piece of software you know how to use and can navigate so you can get back up and running as quickly as possible. 

[PaulL]

Hi Devin,

Thanks for your help. I really didn't expect you to say anything about stuff other than MBAM.

Paul