No internet access with web protecion turned on

[Halogen]

I upgraded to version 3.1.2 and have been having internet access issues ever since.  I am unable to ping or tracert any external sites with Web Protection turned on but everything works ok with it turned off!  When I run mbam scan I do not get any errors and it does not find any malware.

I can turn off web protection and it seems to access the internet fine.  Where do I go from here?  This is a licensed Premium version.

I saw similar issue in forums so I UPLOADED THE FILES THAT WERE SUGGESTED frts AND addition.txt.  I have been dealing with this for several months and  any help is welcomed.

FRST.txt

Addition.txt

[Firefox]

Hello and Welcome...

First lets get you on the latest version.... download it from here: https://downloads.malwarebytes.com/file/mb3 (v3.2.2.2018)

After that if it still does not work correctly lets get all required logs (including new FRST logs).

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues....

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop
   NOTE: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
3. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
4. Press the "Scan" button
5. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   NOTE: These two files will be collected by the MB-Check Tool and added to the zip file for you
6. NEXT: Create and obtain an mb-check log
7. Download MB-Check and save to your desktop
8. Double-click to run MB-Check and within a few second the command window will open, then click "OK"
9. This will produce one log file on your desktop: mb-check-results.zip
10. Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area
    

Thank You,

Firefox

[Halogen]

Sorry, forgot the mbcheck upload.  In the mean time I upgraded Mbam to 3.2.2.2018 and still have the same issues.  Here is the MB Check results

 

mb-check-results.zip

[Halogen]

Here are results with new mbam installed.

mb-check-results.zip

Addition.txt

FRST.txt

[nikhils]

Can you try adding exclusions for Malwarebytes and TrendMicro and see if that helps:

• Open the Trend Micro product installed
• Click Settings 
• Click Exception Lists 
• Click Add 
• Click Browse
• Enter C:\Program Files\Malwarebytes into the text field and click Open 
• Click OK 
• Repeat for C:\ProgramData\Malwarebytes
• Also Exclude the following driver files from TrendMicro
•  C:\Windows\System32\drivers\mbam.sys
  • C:\Windows\System32\drivers\mwac.sys
  • C:\Windows\System32\drivers\mbamswissarmy.sys
  • C:\Windows\System32\drivers\mbamchameleon.sys
  • C:\Windows\System32\drivers\farflt.sys
  • C:\Windows\System32\drivers\mbae64.sys (64-bit)
  • C:\Windows\System32\drivers\mbae.sys (32-bit)

 

• Click Websites 
• Click Add 
• Enter http*://*.mwbsys.com into the text field and click OK 
• Click Apply 
• Click OK to finish 

Can you try to see if that fixes the issue?

[Halogen]

Strange,  I tried to do exclusions of drivers folder in Trend and it only lists a few drivers and none of the ones mentioned.  If I look at the folder in explorer the files  show up but not under Trend.  To test the issue, I excluded the entire driver folder but the problem comes back when I turn MBAM web protection back on..   The dns resolution stops and the pings usinf site name stops but by using ip address it continues to ping. Seems like something is killing the DNS resolution.

 

[exile360]

I'm pretty sure the reason you see a different list of drivers when setting exclusions in Trend Micro is because it's using a 32 bit browse dialog window and you have a 64 bit operating system.  In such cases, unless they've specifically coded their software not to allow it, Windows will automatically redirect such windows to the 32 bit drivers location rather than the native 64 bit folder.  You can verify this yourself by using explorer and checking the contents of C:\Windows\SysWOW64\drivers to see if its contents match what you're seeing in Trend Micro, and if they do match, then that's precisely what's going on so you won't be able to exclude our drivers from Trend.

That said, I suspect this may have something to do with how Trend is inserting a process or driver into the network stack for the purpose of its own web filtering technologies.  You can likely test this by temporarily disabling its web based protection features one by one if it allows you to do so to see if doing so allows you to get online with Malwarebytes' web protection active.  Also, you should check your Malwarebytes Reports tab to see if any web blocks have been reported, and if so, if there are any common ones that seem to occur whenever you start your PC/try to get online as there may be some sort of DNS configuration setting that for some reason is redirecting your system to an address that Malwarebytes blocks.

[Halogen]

Your right about the 32 bit, Trend is only showing the SYSWOW64\drivers folder.  I just found an OTHER settings in Trend that has Extra Security, Balanced Protection (default) and Extra Performance.  I just changed to Extra Performance but have not checked it but it says security drivers will only load after PC is started.  The MBAM reports is only showing the scan reports and not finding anything as far as web blocks. 

I turned off the web proxy Trend is using and still see have the same problem.  I did not see anything else about web protection.  If that doesn't do it, what next??

[exile360]

Continue here to work with our team and hopefully we can find a viable workaround, but failing that, the only other option I can think of would be to contact Trend Micro's support to see if they've seen this issue before and have any workaround for it or a patch or other fix for the issue.

By the way, have you tried disabling/exiting Trend completely to see if you're then able to reach the web with Web Protection active in Malwarebytes?  I just want to make sure we're going down the right rabbit hole here so to speak because the root cause of the issue might be something else for all we know.

Edited September 10, 2017 by exile360