Malwarebytes Running but unresponsive to mouse clicks

[tetrol88]

Malwarebytes Premium 3.3.1 running on W7 64. MB Tray application had a pop up stating a threat had been identified on last scan - but the pop up was unresponsive to clicking either open results or close the popup. Ran MB and it popped up with the threat list, but once again the window doesn't respond to clicks - options highlight when the mouse is passed over them but clicking has no effect, including closing the program. Restart had no effect - ie same status. Everything else working normally.

While writing this, MB has performed an update successfully, so it is not totally hung up - it seems to be working but is just doing it's own thing!

Edit - just noted that clicking off the window then to the close window ("X") works, but once any other spot eg "scan now" is clicked, not even "X" works.

Any help?

 

mb-check-results.zip

Edited November 27, 2017 by tetrol88
additional info

[Porthos]

28 minutes ago, tetrol88 said:

Any help?

I would like you to add these files to your Anti-Virus exclusions list as mentioned in this FAQ HERE (my list below includes the exe files as well)
 

• C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
• C:\Windows\system32\Drivers\farflt.sys
• C:\Windows\System32\drivers\mbae64.sys
• C:\Windows\System32\drivers\mbam.sys
• C:\Windows\System32\drivers\MBAMChameleon.sys
• C:\Windows\System32\drivers\MBAMSwissArmy.sys
• C:\Windows\System32\drivers\mwac.sys

 

Also please exclude the following folders too: (The complete folder)

• C:\Program Files\Malwarebytes\Anti-Malware
• C:\ProgramData\Malwarebytes\MBAMService

After that...

Let us get a clean install of the current version. 3.3.1

 

We have another tool called MB-Clean which will automate the whole process for you.

 Tool can be found at https://downloads.malwarebytes.com/file/mb_clean

 

1. After downloading the tool run the tool.

2. The tool will automatically clean up the older possibly damaged installation and will ask you for a restart.

3. Restart your system and then the MB-Clean tool will prompt you to re-install the latest product.

4. Click on "Yes" to reinstall MB 3.×.

5. Now you will have the latest product installed. If it does not offer the new install after the reboot you can download and install from here. 

https://downloads.malwarebytes.org/file/mb3

 Please let me know if you are still seeing issues after the latest product install.

[tetrol88]

Thanks for the suggestions, but no difference made. Added all of the exceptions, ran clean, restart, reinstall, MB starts - now with a warning that a scan has never been performed - but I cannot interact with it. Both the main MB page and the pop up window warning me I need to update are the same - no response.

[Porthos]

1 minute ago, tetrol88 said:

but no difference made

We will let a staff member gather more info and assist you.  @nikhils@dcollins@vbarytskyy

[dcollins]

Can you try running a scan in safe mode, and turn on rootkit scanning just for kicks?

[tetrol88]

Problem persists. The other problem being that I do not have, nor do I wish to develop (doing 12 hours/day work atm) my PC skills/knowledge to track this down. MWB is running, does scans if I happen to leave my PC on overnight, but both it and thw tray notifications are unresponsive. Have to use task manage to get rid of the system tray notifications.

[dcollins]

If I understand correctly, you don't want to try and fix this issue since your scans seem to be running properly? If so, that's fine.

One thing I would recommend however is to completely remove your installed version of Malwarebytes and install our latest version we released this week from https://downloads.malwarebytes.com/file/mb3

[tetrol88]

No - to me an odd interpretation. Usually when you buy a product or service, you want it to work as expected - if my car runs strangely, I will try a few things  but I am not, nor have any interest in, trying to become a mechanic. Same deal here - I read things like turn on rootkit scanning like I would take a message to perform some odd mechanical task on my car.

[exile360]

Sure, that's understandable.  In order to turn on rootkit scanning you need to open the main Malwarebytes UI and click on the Settings tab on the left and navigate to the Protection sub-tab at the top.  Once there, you should see a switch beneath where it says Scan Options entitled Scan for rootkits.  Toggle the switch beneath that to the On position by clicking it, then perform a Threat scan as you normally would and allow it to finish.  Once completed, if anything is found have Malwarebytes remove it.  The idea here is that it is possible that the cause of the issues you're experiencing could be related to some hidden threat active on your system interfering with Malwarebytes' ability to function as it should.

If it does detect anything, please let us know and if you wouldn't mind, also post back a copy of the scan results.  To do that, once the scan is done you click on Export Summary and select Copy to clipboard then paste it into your next reply or alternatively you may choose Text file (.txt) and save the file and then attach the text file to your reply.

[tetrol88]

My hand is being forced. While using my PC this morning - system tray put up a Malwarebytes message "to complete the quarantine procedure we need to restart" and it did it instantly with no chance of stopping it, saving etc. So much for what I was doing.

On startup I loaded safe mode as suggested above, and Malwarebytes behaves the same - ie it runs but you cannot interact with it. Buttons highlight but do not click.

Btw have tried using a different mouse with different drivers, just in case.

Now going to install the new version, if it is the same, bye bye MWB as I can't have something closing down the computer without notice.

 

[tetrol88]

Install failure on reboot

mb-clean-results.txt

Used the free install to install and it installed updated and is non-responsive to clicking. Keyboard tabbing also shifts the "button" but enter or clicking does nothing btw

 

Edited December 10, 2017 by tetrol88
further info

[exile360]

OK, if you would, please try running Malwarebytes Anti-Rootkit.  It is a standalone rootkit detection and removal tool developed by Malwarebytes.  If the root cause of these issues is related to a rootkit as we suspect it may, this should hopefully detect and remove it for you.  You can find the download for Malwarebytes Anti-Rootkit here.  Please let us know how it goes and if there are any issues running it.  Also, prior to running it please exit Malwarebytes 3 by right-clicking the tray and choosing the Quit Malwarebytes option if possible as that should help to ensure they don't fight over drivers while the anti-rootkit scan is running.

[tetrol88]

Nothing detected - all clear. Interestingly, it didn't behave itself either - seemed unresponsive to clicking, except I could minimise it, then call it back up and it woul dpermit me one click then go unresponsive again. Minisies it, restore it and one more click allowed. Wierd. Thought that the main MWB might do the same so when it Rootkit scan was completed tried that but MWB remains a no click zone.

[exile360]

That's definitely strange, but it does give us another clue in the puzzle.  Are any other applications or dialogs behaving in this manner, or just MB3 and MBAR?  For example, if you have an antivirus installed, is it behaving normally to clicks?  What about Windows Update?  If you don't have an AV, what about Windows Defender?

[tetrol88]

Norton 360 - no issues - in fact nothing else behaving oddly

[dcollins]

With MBAR showing those strange issues, can you follow the instructions in the following please: 

This will have you run MBAR again, but a special version that has been built to get around some particular infections that prevent our normal tools from working

 

[tetrol88]

Just tried this - similar thing happens when I use the MBAR buttons - I can click the minimise window, close window and interestingly "Next" but not "update" or "Scan".

A further development is that MWB has decided to not load at start either now - previously it was, and was working in the background - now it is not loading at all.

 

[tetrol88]

Update - other than that MWB mysteriously just resumed loading at startup again - it is still running, updates when updates available, but remains "unclickable". Even the odd warning that pops up behaves the same - can close it but not access any other button - such as open MWB and add an exclusion.

Exclusions are particularly annoying - as I can't modify anything I have to close out of MWB, access the site then after doing so re-open MWB.

Edited March 26, 2018 by tetrol88

[tetrol88]

46 minutes ago, exile360 said:

Very interesting, could you please post a copy of the scan log from that scan where those items were detected?  That might give us a clue as to what may be causing this, especially if it's related to some particular infection or threat.  You can get the log by opening Malwarebytes and going to Reports then sorting the list by the date by clicking on the Date and Time column header at the top twice and it should be one of the most recent entries.  Once you find the right log, double-click on it to open it then click the Export button and select either Copy to Clipboard and paste it in your next reply here, or Text File (*.txt) and save the file somewhere then attach it to your next reply.

Lucky for some - given my issue is that anything in opened Malwarebytes is non-responsive.

[tetrol88]

Just dropping in to say that nothing has changed. Malwarebytes runs, scans, updates but other than opening and closing the window remains unresponsive. I have an issue with a registry cleaning program which I run occasionally - Malwarebytes blocks it and cleans it from my system without asking (not that it would help, as I can't click on anything in it anyway!) - as it is a paid subscription program it is a bit annoying. HAve to close MWB, install the program without MWB running, then start MWB again - at which point it tolerates it. Can't set exclusions as MWB won't let me! (do anything)

[AdvancedSetup]

Hello @tetrol88

Please try creating a new user account with Admin rights. Then log into that account and reinstall Malwarebytes in that new profile.

https://www.malwarebytes.com/mwb-download/thankyou/

Let me know if that helps correct the issue or not.

Please read the following concerning your Registry Cleaner.

Do I need a Windows Registry Cleaner?

Thank you

Ron

 

[tetrol88]

Two parts to respond to that post

1) I sought it out as I was having ever growing slow start-ups - and the first time it ran starting up dropped to less than half the time prior to running it. About 4000 + changes iirc.

2) " If you can show proof positive 100% that some value in the Registry is actually causing an issue then change or remove THAT entry. " - love it on forums such as this when advice given would suggest to implement the solution you actually have professional level knowledge in the first place. IMy level of knowledge means I will have to google how to create a new account with Admin rights as you have suggested. Quite a bit short of me identifying or changing a registry entry manually.

[exile360]

Yes, but those programs never actually "fix" anything.  They use basic search schemes that look at the value data in the registry where files and programs are mentioned, and if those files or programs are not found on the system by their cursory check of the Program Files folder and other locations, they state that the value is "obsolete" or "file missing" which, while that may be true, isn't the cause of any problem or issue because such orphaned registry values do no harm at all.

In fact, the real registry issues that cause problems pretty much 100% of the time require some specific change to an existing value, not just a wholesale deletion like these so called "cleaners" perform, meaning you end up having to either make the change manually to fix the issue, or you have to use some specialized fix tool to correct it (and by fix tool, I do not mean any registry cleaner; I mean specialized scripting tools like FRST, ComboFix or the Winsock Reset Fix etc.).  Registry cleaners do not contain the capabilities to actually fix or correct anything in the registry because they do not contain any comprehensive logic and are not programmed with any detailed specific knowledge of what individual values and keys in the registry actually do and what they control, they just blindly search for items that are supposedly "missing" or are "obsolete", which as I stated before, aren't actually issues at all and are not the root cause of any registry related problems a system might be having.

I've had to fix countless problems in the registry in my years as a PC repair tech, and not once was I able to do so via any registry cleaner, even back when I myself used them because I too was fooled into believing they served some legitimate purpose.  Every time the cause of a problem on a system was due to a registry value or data being missing or incorrect, I either had to use a specialized tool to fix it or to correct it manually either by editing the registry by hand, or by creating a specific .reg or .bat file/script to modify or create the correct values/data.

[tetrol88]

Anyway - as stated it sped up start-up significantly - whatever the cause. Only on the first run did it come up with that large count.

I created a new user account - without uninstalling MWB - and MWB appeared on the new Admin rights desktop and appears to be fully "operable" ie I can use it. Something on my standard account must be interfering.

 

[exile360]

If it's working in the new user account, then the most likely cause is a problem in the HKCU registry hive for your previous account (the local user registry hive/branch where local settings are stored for the current user).  If it's a piece of software causing the issue, you can check by running something like Sysinternals Autoruns or FRST on both user accounts and see if there are any differences between the applications that start up between the two accounts, but if there are no differences then it pretty much has to be something related to the registry for that user account causing the issue.  What caused it, there's likely no way to know for certain.  It could be random corruption, it could have been the registry cleaner as mentioned previously, or it could have been some threat that was removed from that user account at some point that did damage to the registry hive or even some piece of software you uninstalled that did something it shouldn't have and messed with a required registry value or key that caused this to occur.

Now that Malwarebytes is working, I'd suggest doing a Threat scan.  It will check not only the registry of the currently logged on user, but those of all the user accounts, including the offline account where it wasn't able to function before, so if the cause is an infection, Malwarebytes should now be able to detect and remove it.