Incompatibility with Firefox running on XP

[tommytiko]

It is a little irritating to be pestered constantly to upgrade to v3 of MWB when Firefox will not run when v3 is installed, so that I have to remain with v2 until I manage to update to windows 10.

[Porthos]

@tommytiko

Did you turn off self-protection before you gave up on version 3?

Edited September 18, 2017 by Porthos

[tommytiko]

Thanks for the thought.  I did not, but, although I could be wrong, I do not think it was turned on.  It would not have been turned on before I installed v3.  Is there reason to think that the problem with Firefox is due to self protection mode being activated?

[Porthos]

4 hours ago, tommytiko said:

Is there reason to think that the problem with Firefox is due to self protection mode being activated?

Known current issue.

 

4 hours ago, tommytiko said:

I did not, but, although I could be wrong, I do not think it was turned on. 

It is on by default in Ver 3.

[Larry9812]

I'm also still on Windows XP and never had a problem with Firefox starting until two days ago (9/18/17) when a program revision was installed.  I tried turning off various features, including Exploit Protection, but to no avail.  Only solution now is for me to exit Malwarebytes when my computer first boots up.  Then, everything, including Thunderbird, works fine.  I sure hope the next MWB release gets this fixed!  Any other suggestions?  Thanks!

[Porthos]

@Larry9812

Did you turn off self-protection

 

 

[tommytiko]

Thanks Porthos.

Acting on your further advice, I reinstalled v3, but found that I was unable to turn off the self protection module - the slider switch in the GUI would not respond.  I then found that I could not uninstall v3 via the uninstall link in the start menu or via add/remove programs in the control panel, and so I had to rip it out using Total Uninstall before I could reinstall v2.

I might add, though it would appear to be a separate matter, that whereas anti-ransomware protection was shown in the GUI of v3 as unavailable (because it was running on XP Pro SP3, of course), anti-exploit protection appeared to be available - the slider switch would move to the on position - but the slider switch would turn off spontaneously a second or so after I had switched it on.

Edited September 21, 2017 by tommytiko

[tommytiko]

So, I now have 3 queries:

1. should anti-exploit protection be available in v3 running on xp;

2.  is there anything I can do about the fact that I could not disable self protection mode; and

3. how can I turn off the nagger now working in v2 to tell me to update to v3, since I cannot update to v3 because v3 is not compatible with my internet browser, Firefox.

Can anybody advise, please?

[Firefox]

37 minutes ago, tommytiko said:

3. how can I turn off the nagger now working in v2 to tell me to update to v3, since I cannot update to v3 because v3 is not compatible with my internet browser, Firefox.

To stop your Malwarebytes v2 from upgrading to MB3 please see my post located -->> RIGHT HERE <<--

[tommytiko]

Thanks Firefox.  That is most helpful.

I have taken steps 1 and 2 in your post that you referred me to - deselecting check for program updates and checking that the self-protection module is not enabled.  I do not have C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware on my computer, which I dare say is because it is an XP system and your instructions apply to a more modern system.  However, I found the file you refer to in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Malware, and dealt with it by adding a ~to the file extension.  If it does not work, I will report back with a further post here.

[Firefox]

Your most welcomed... yes you are correct... in Windows XP it is located in the folder C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Malware and renaming the file is fine and should do the trick.

[dcollins]

This is fixed in the latest version of Malwarebytes 3. You can verify you have the latest under Settings -> About, and as long as you are on version 1.0.207 this should not be an issue. You can download the latest version from https://downloads.malwarebytes.com/file/mb3 

[tommytiko]

Thanks Devin.  That is most helpful.

I have now updated to v3 by installing the download you provided a link for, and I can indeed now run Firefox with it installed.  However, that leaves a couple of questions;

1. Should exploit protection be available in v3 running on xp?  Is there any configuration of the advanced settings for exploit protection that will enable it to run on XP?

2.  Is there anything I can do about the fact that I could not disable self protection mode?  Or should I ignore it?

3. Having installed v3, I now have a warning, both on the dashboard and on the system tray icon, that protection is disabled, presumably because I cannot turn on exploit protection.  If there is no way to turn exploit protection on, is there any way to turn off the constant warning on the dashboard and on the icon in the system tray?.

[dcollins]

Yes, exploit protection should be running on XP if you want to stay protected. The configuration of the advanced settings will largely depend on the software you have on your machine, but the default settings should work for sure. Self protection should also be able to turn on.

Can you please download mb-clean from https://downloads.malwarebytes.com/file/mb_clean and use that to fully remove Malwarebytes and let it re-install the latest version? That should hopefully resolve the issues you're seeing

 

[tommytiko]

Thanks again Devin.

I will take you advice and report back.

Perhaps I should mention that I had MB Anti-Exploit installed at one time.  I think I uninstalled it before installing MBAM 3, or it went with the installation of MBAM 3.  However, I monitor installations with Total Uninstall, and I have not removed traces of the program using Total Uninstall yet.  I think I should perhaps do so before using the MBAM cleanup tool, unless you have a separate cleanup tool for MB Anti-Exploit.  I can find no more instructions on removal of MBAE than are here: https://support.malwarebytes.com/docs/DOC-1203.

If you are aware of a clean up tool for MBAE, please let me know.

[tommytiko]

I have now uninstalled MBAM, cleaned up both MBAM and MBAE using Total Uninstall, then I ran the cleanup tool downloaded from the link you provided, ran the MBAM cleanup tool, and then I reinstalled MBAM.  Although anti-exploit protection appeared to be on at first, it then turned itself off after perhaps 20 seconds, and when I try to turn it on, it turns off again within about 5 seconds or less.

 

Can you suggest anything further, please?

Edited October 22, 2017 by tommytiko

[dcollins]

Can you please grab the logs mentioned in the following thread so we can take a look at what's going on?

 

[MAM]

Hello, why you riding a dead horse?

Windows Xp, is dead, NO UPDATES since 2013.

Have you a BIG reason why you use the now nuch, and probably with Internet connection?

In diffrent forums, iam reading Windows XP not to use.

MAM

 

Edited October 22, 2017 by MAM

[tommytiko]

Thanks Devin.  Herewith requested file.

 

 

mb-check-results.zip

[tommytiko]

12 hours ago, MAM said:

Hello, why you riding a dead horse?

Windows Xp, is dead, NO UPDATES since 2013.

Have you a BIG reason why you use the now nuch, and probably with Internet connection?

In diffrent forums, iam reading Windows XP not to use.

MAM

 

I am still building a W10 machine.  It is a big job and is taking time.

[dcollins]

It looks like mb-clean didn't run successfully. Can you try running it in Safe Mode and then re-installing?

[tommytiko]

Thanks for the suggestion Devin.  But I am afraid that after re-running the clean up tool in safe mode, and deleting any files or registry entries that still showed as not having been deleted in the resultant clean up log, I have got exactly the same result as before.  The anti-exploit protection appears to be running for a few seconds but then ceases to do so and cannot be restarted.  Can you suggest anything else, please?

Edited October 24, 2017 by tommytiko

[AdvancedSetup]

Hi @tommytiko

The logs you provided show that the clean up process was not done correctly. You also have a few issues going on with this computer. Some I can fix for you, others can be a bit dangerous to fix as it could cause a no boot issue.

Let me have you run the following please.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Once that is done and the computer has restarted let me get new FRST logs please.

Make sure you place a checkmark on the Additions.txt check box and post back both new logs as an attachment.

 

You also have a program installed called "SPAMfighter" - not sure if that has any effect or not as the Additions.txt log file was not included for me to check.

You have a lot of these type of entries which does not appear to be valid for your computer. However removal of driver entries can be potentially problematic.
These appear to be drivers that are in an unidentified state, meaning the scanner is not sure if they're used or not. That many and names alone would indicate they're not, but why are they there is the issue. I see you have SPTD.SYS which is often installed to help emulate or bypass certain game protections, etc. That may indicate the computer is/was used for various mounted virtual drives.

U3 abjv2sqq; C:\windows\system32\Drivers\abjv2sqq.sys [0 ] (JMicron Technology Corp.) <==== ATTENTION (zero byte File/Folder)
U3 a1o4t9xa; no ImagePath
U3 a2z71oxl; no ImagePath
U3 a4wwgudw; no ImagePath
U3 a5q5ekek; no ImagePath
U3 a6ddwpnp; no ImagePath
U3 a720pe0a; no ImagePath
U3 a74rdhxx; no ImagePath
U3 a8tgpq3t; no ImagePath
U3 a9huds57; no ImagePath
U3 aak3e63l; no ImagePath
U3 acl5qdz5; no ImagePath
U3 afzmmiuj; no ImagePath
U3 ag0130pz; no ImagePath
U3 agl5fbmp; no ImagePath
U3 agu3mm5y; no ImagePath
U3 ahbl494f; no ImagePath
U3 ai5yfqxv; no ImagePath
U3 aia5jycm; no ImagePath
U3 aid4o77o; no ImagePath
U3 ajum5lp1; no ImagePath
U3 anfiqouy; no ImagePath
                                                                                                 

Thanks

Ron

 

[tommytiko]

Ron,

Thank you for your post and for taking an interest in this problem.

I attach the first additions.txt, which I must have omitted to upload,  and have renamed additions1.txt to distinguish it from the additions.txt file generated by following your instructions above.

I believe I have followed your instructions and attach the 2 logs thus generated.

I am reasonably relaxed about undertaking actions that might render the system unbootable, since I have a comprehensive system for imaging the system, but of course would prefer to do so in a way that leads to identification of the problem if possible.

Thanks for your help, and I hope you will be able to shed light on what the problem is or may be.  Please let me know if there is any further information I might provide that would assist.

Addition1.txt

Addition.txt

FRST.txt

[tommytiko]

I have to add that while running FRST, Malwarebytes appeared to report the detection of some malware, for which it requested a reboot.  I am afraid I did not record the name of the alleged malware.  After rebooting, Malwarebytes no longer appears in the system tray, although mbam.exe and mbamservice.exe appear to be running in the windows task manager.  Double clicking on mbamtray.exe in the program files folder does not produce an icon in the system tray, although after doing so it appears to be running in the windows task manager.  I can terminate mbam.exe and restart it, but doing so does not produce a gui.  Attempting to terminate mbamservice.exe causes a hang, so I am unable to reinstall mbam and I suspect that the self protection mode may be enabled, although I would have turned it off unless I forgot to do so after reinstalling mbam recently.  I have yet to reboot in safe mode in order to turn off self protection mode in case it is activated.  I thought I should report back before taking any action in case this is related to the other problems that I have been having and you would advise a particular course of action.