MBAM 3.3.1.2183 - Real-time Protection won't turn on.

[ausgumbie]

Hi all

I have a 1 lifetime Anti-Malware license for PC which I got back in the day. It's dutifully upgraded over the years, most recently 7 November, when I got version 3.3.1.2183.

I'm runing Windows 10 Home (Build 16299) and Norton Premium.

Today (Sat. 18 Nov) was a big day for updates. I got a Windows update, Adobe Reader 11 (and changed it for Acrobat DC), 100 MB of Norton - I think that's it. At one point my Outlook 2013 client (I was online at the time) got fed up with working and disappeared. (I mean its open windows did - its icon stayed on the taskbar and kept launching textboxes at me when I asked it to reopen saying no, it wouldn't).

It was about then I noticed the orange popups in the lower right corner screaming there was no realtime protection. I had recently clicked accidentally on a link in an email I distrusted and, although nothing happened except the Microsoft "something's-happening" wheel rotated for a bit, I've paranoically worried since I've thereby downloaded spyware which will call back to mother next time I go online.

I've done a compatability check, repeated scans in and out of Safe Mode. Found nothing - changed nothing. I'm only unable to turn real-time protection on. All other settings except Delay real time protection ... I've turned or left on.

I'm writing this from another laptop. So, long story short, help???

ausgumbie

[Porthos]

6 minutes ago, ausgumbie said:

So, long story short, help???

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues....

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop
   NOTE: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
3. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
4. Press the "Scan" button
5. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   NOTE: These two files will be collected by the MB-Check Tool and added to the zip file for you
6. NEXT: Create and obtain an mb-check log
7. Download MB-Check and save to your desktop
8. Double-click to run MB-Check and within a few second the command window will open, then click "OK"
9. This will produce one log file on your desktop: mb-check-results.zip
10. Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

[ausgumbie]

Thanks Porthos

Herewith the mb-check-results zip.

A note. I downloaded the FRST and check exes to a usb on my second laptop (running Ubuntu 16.04), transferred them to the affected laptop and did the scans there. (Then, by usb back to the Ubuntu laptop to connect with you).

FRST naturally reported it "could not update" as the affected laptop wasn't connected to the internet (see orig post for why I'm reluctant to conect as yet). So the FRST scan is done without the latest updates. If that causes issues, obviously let me know.

cheers

ausgumbie

mb-check-results.zip

[Porthos]

3 minutes ago, ausgumbie said:

ausgumbie

First, we need to remove the compatibility settings you set. Also, we need to add exclusions to Norton. And for good measure, we need to get a clean install of MB all in that order.

First compatibility,

Go to the folder C:\Program Files\Malwarebytes\Anti-Malware\
Find the file mbam.exe and right click on it and choose Properties
In the window that pops up click on Compatibility Tab
Remove any changes there that don't match my picture below and click OK

Next, Exclusions

I would like you to add these files to your Anti-Virus exclusions list as mentioned in this FAQ HERE (my list below includes the exe files as well)
 

• C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
• C:\Windows\system32\Drivers\farflt.sys
• C:\Windows\System32\drivers\mbae64.sys
• C:\Windows\System32\drivers\mbam.sys
• C:\Windows\System32\drivers\MBAMChameleon.sys
• C:\Windows\System32\drivers\MBAMSwissArmy.sys
• C:\Windows\System32\drivers\mwac.sys

 

Also please exclude the following folders too: (The complete folder)

• C:\Program Files\Malwarebytes\Anti-Malware
• C:\ProgramData\Malwarebytes\MBAMService

Now Clean install.

We have another tool called MB-Clean which will automate the whole process for you.

 Tool can be found at https://downloads.malwarebytes.com/file/mb_clean

1. After downloading the tool run the tool.

2. The tool will automatically clean up the older possibly damaged installation and will ask you for a restart.

3. Restart your system and then the MB-Clean tool will prompt you to re-install the latest product .

4. Click on "Yes" to reinstall MB 3.×.

5. Now you will have the latest product installed. If it does not offer the new install after the reboot you can download and install from here. 

https://downloads.malwarebytes.org/file/mb3

 Please let me know if you are still seeing issues after the latest product install.

[ausgumbie]

Hi Porthos,

Need to break off here (family demands). I'll return later tonight or tomorrow.

Just two questions.

After the Clean install, I assume MBAM will still recognize a lifetime licence as being in my name?

And, anywhere I can get help on adding exclusions to Norton Premium? Can't find, on brief explore of NP, how to do this.

Till later, then.

Many thanks

ausgumbie

[Porthos]

24 minutes ago, ausgumbie said:

I assume MBAM will still recognize a lifetime licence as being in my name?

Yes

 

24 minutes ago, ausgumbie said:

anywhere I can get help on adding exclusions to Norton Premium?

I personally would never use any Norton product or for that case anything except Windows Defender. (My personal opinion with over 100 clients)

But start here,

https://support.norton.com/sp/en/us/home/current/solutions/v54298598_ns_retail_en_us

[ausgumbie]

Hi Porthos,

I haven't abandoned you or my request. I've been traveling and have a few things to keep me busy before I can settle back to wrestling with Norton.

Meanwhile I was intrigued by your comment:

On 11/18/2017 at 7:03 PM, Porthos said:

I personally would never use any Norton product or for that case anything except Windows Defender. (My personal opinion with over 100 clients)

I'd chosen Norton based on reading a number of online reviews (usually the same sources each year) which placed Norton 360, later Premium, in (if not always at the top of) the top 5 AVs. I've been a Norton customer for years on this basis, breaking off at one period when their reviews were bad.

So, I'm not loyal to Norton - I'll be loyal to whatever gives me optimal protection. But I'd never thought of WD as a strong AV. I'd be curious to know what you see as "unattractive" about Norton and what you feel makes WD attractive. Norton costs, WD is free and you've always got to watch that you don't tell Norton to 'automatically renew' a subscription as happened to my wife several years ago. Also, I'd go WD + MBAM if it gave comparable protection and avoided the sort of conflict that seems to be plaguing me now. I also like MBAM's popups that tell you why a certain page wasn't loaded - can't get  that without Realtime protection. And that often occurs on pages Norton throws up no objection to.

I've also been increasingly unhappy (along with a number of others I gather) about the way Norton Account doesn't clearly show the number of seats you are using your product with (e.g. https://community.norton.com/en/forums/accounts-devices-missing-device#comment-7482141. and https://community.norton.com/en/forums/where-has-my-services-link-my-norton-account-gone.) Granted, that has noting to do with protection. The other thing I felt unhappy about was that now you have to be online to "comprehensively" scan with Norton. I'd like to scan my detachable hard-drives, but won't do so online.

So, I'd certainly value opinions and arguments here. Please pm me if you feel uncomfortable about commenting on the thread.

Cheers

ausgumbie

[ausgumbie]

Hi again Porthos

OK, compatibilities cleared, files and folders added to Norton's "Items to Exclude from Scans" and Clean and Reinstall done (and updated).

I restarted the laptop and can report success. All real-time protections are enabled. I chose "Scan for rootkits" also in settings but have left "Enable self-protection module early start" as I'm not entirely sure what it does. If I remember rightly something I read, choosing this causes a one-time delay in self-protection but I'm not sure. If there's an advantage to enabling it, I'll do that.

I've kept the Clean log. Would you like me to post it?

I'll express my sincere gratitude at this point, because it's wonderful to be back in action again. The Windows 10 Fall Creator's Update has been giving me enough to moan about with the changing login picture and other silliness I note other users are also suffering.

Cheers

ausgumbie

[Porthos]

2 hours ago, ausgumbie said:

I restarted the laptop and can report success. All real-time protections are enabled.

Your fine the way you have it. Just move on now and stay safe.

[ausgumbie]

Will do,

Many thanks again!

Cheers

ausgumbie

[Felix49]

Coming in late to this topic but experienced the same problem yesterday after my laptop crashed (unknown cause). I ran MB Clean and successfully reinstalled. Real Time Protection is now showing on the dashboard as ON....but the taskbar icon still has a warning triangle. How do I correct that?

[Porthos]

5 hours ago, Felix49 said:

Real Time Protection is now showing on the dashboard as ON....but the taskbar icon still has a warning triangle. How do I correct that?

Have you run a threat scan since you reinstalled with MB clean?

[Felix49]

ah no I hadn't - done now & all's well, thanks

Edited December 5, 2017 by Felix49

[Porthos]

11 minutes ago, Felix49 said:

ah no I hadn't - done now & all's well, thanks

Figured as much. Glad that was it.

[bigdave8504]

So I am stuck here on this one as well.  Wishing things just worked as intended instead of fighting with everything.  

I noticed last night that for some reason malware bytes was uninstalled from my computer.  Weird but ok (I blame windows 10) so I downloaded the installed activated my key, checked for updates, and ran a treat scan.  This morning it pops up with Real-Time Protection layers turned off.  I found the options on Malwarebytes and try to turn it on.  It gives me the Starting... but never changes and the dumb pop thing for Malware keep notifying me its off.  

I have uninstalled it already this morning, used the mbam cleaner tool (mbam-clean-2.3.0.1001.exe) and reinstalled it to no success.  I don't know if this is the most up to date cleaner or not.  I have checked the compatibility Porthos mentioned earlier in this thread

I have windows 10 64bit, windows defender and soon to be a different malware software if they cant get their crap together.  I don't get to spend a lot of time on the computer and when I do I when I am trying to fix someone else mistakes specially when I have paid for the service.  It like paying someone to wash your car and they expect you to run the hose, fill their buckets, and grab their rags for them when they ask for it.  Sorry for the rant and I did read you Quote, Porthos, so I do thank you for your time although Malware should be putting a check in the mail for you.

[bigdave8504]

Never mind problem solved. Had to update to the newest version of malware.  Thanks anyhow

[Porthos]

31 minutes ago, bigdave8504 said:

Never mind problem solved. Had to update to the newest version of malware.  Thanks anyhow

Thanks for the update.