MBAM 3.3.1 under Windows XP

[Fred83]

I am having trouble with and without MBAM 3.3.1 even with all available updates.  I tried turning off the self-protection feature, and turning off protection for certain applications.  I also tried completely uninstalling MBAM 3.3.1.  Even after what appeared to be a successful uninstall, CPU usage remains near 100%.  The computer involved runs Windows XP. 

I attach the MB-check results with MBAM 3.3.1, and the FRST output text files  after uninstalling MBAM 3.3.1.  The MB script program crashed each time, so I put them into a zip file. 

I would like to make a clean and thorough uninstall.  Maybe these uploaded files will help with development.

Thanks,

mb-check-results_with_MBAM_3.3.1.zip

FRST_results_without_MBAM_3.3.1.zip

[Porthos]

15 minutes ago, Fred83 said:

I would like to make a clean and thorough uninstall.

Do you want to keep it uninstalled permanently?

[Fred83]

Yes.  The computer is not useful now, but it boots.  I'm curious what my options are. 

Thanks,

 

[Porthos]

Run MB clean and say no when it offers to reinstall MB.

 https://downloads.malwarebytes.com/file/mb_clean

[Fred83]

Thanks for the quick response.  I ran that program, but the cleaning was not complete.  That computer still has about 100% CPU usage at idle.  I attach the output file from the procedure.

mb-clean-results.txt

[dcollins]

@Fred83 can you provide a new set of FRST/mbcheck logs so we can see what was leftover?

[Fred83]

Here is the latest pair of log files.  The MB...  hangs with 0% CPU, so I put the two files in a zipped folder.

Thanks for any suggestions.

 

FRST_logs_Nov_27_2017.zip

[lmacri]

13 hours ago, Fred83 said:

...I ran that program, but the cleaning was not complete.  That computer still has about 100% CPU usage at idle...

Hi Fred83:

Just a thought, but there are several 32-bit Win XP and Vista users in this forum who have reported apparent conflicts with MB v3.3.1 Exploit Protection and Firefox ESR (extended support release), Microsoft Office applications, and the anti-exploit module in Norton Security (Settings | Firewall | Intrusion and Browser Protection | Exploit Prevention) - see some of the upcoming fixes for MBAE v1.11 <here>, which is currently in beta.  If you reinstall the latest MB v3.3.1 then temporarily disabling MB's Exploit Protection (Settings | Protection | Real-Time Protection | Exploit Protection) might help.  I currently have MB's Exploit Protection and Web Protection both disabled on my 32-bit Vista SP2 machine.

I don't see Norton on your machine, but you do have an older Symantec antivirus product for business (Symantec Endpoint Protection v12.1.7166, released 31-Jan-2017) that could be causing similar conflicts. It appears you also use I:\ as your system drive and have entries for other software normally found on business computers (e.g., IBM SPSS Statistics 23, SAS, PostgreSQL).  Was this XP machine provided by a current or previous employer, and if so do they still provide IT support? You have an older machine with a Celeron processor and only 1 GB of RAM and you have quite a few programs installed that could be loading drivers / processes at boot-up and consuming resources even if you don't use them on a regular basis.

Your default Firefox ESR v45.9.0 browser is out-of- date (the current version is v52.5.0) and you have several other outdated programs like Google Chrome v49 (which has not been fully support on Win XP and Vista since April 2016 and should be uninstalled), Adobe Flash Player v26, etc.  You also have various MS Office products including MS Access 3.0, MS Office Professional 2003, MS Access 2010, and the Compatibility Pack for the 2007 Office System.  I don't know if this is relevant to your high CPU consumption, but if you still use Windows Updates to keep MS Access 2010 or any other Microsoft product updated please note that MS Excel/Word 2007, MS Excel/Word 2010 and the MS Office Compatibility Pack SP3 are all known to cause Windows Update to hang on the initial "Checking for updates..." phase for several hours (or even days) and consume an entire CPU core (i.e., 100% CPU consumption with a single core CPU;  50% CPU with a dual core CPU) on Vista SP2 machines.  I can't say for certain if these "Checking for updates...." hangs also occurs on your Win XP machine but if you have any problems getting Windows Updates to run to completion see the workaround posted by Volume Z on page 1 of peggybeggs' thread why has vista stopped automatic updates?  If either of the latest Windows Update "speed up" patches for the MS Office Compatibility Pack SP3 (i.e., KB4011205 and KB4011265 as of Nov 2017) are currently missing from your system then manually installing those security updates might fix your slow Windows Updates and high CPU consumption.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.0 * NS Premium v22.11.2.7 * MB Premium v3.3.1.2183-1.0.236 * MS Office Professional 2003
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Edited November 28, 2017 by lmacri

[Fred83]

Hello,

Thanks for reading through the log files and for the suggestions.

 

[Fred83]

While I ran the mb_clean  program, an alert box (command line box) popped up once briefly with a message something like

location "I:\program " does not exist.

I assume it was looking for the folder "I:\program files".  Sometimes, even in Windows XP, script programs have trouble with long file names (longer than 8 characters) or file names that contain spaces.  Maybe there is some indication in FRST_logs_Nov_27_2017.zip  or in mb-clean-results.txt .  Maybe this alert is related to the incomplete cleaning.