MB 3.3 Anti-Rootkit DDA Driver

[Wicked]

I'm having the exact same issue.

MBAM is constantly asking if I want to reboot the computer due to issues with that DDA driver and, for some reason, sometimes after messing with settings and rebooting the protections start to fail. Usually the Web and Malware protections.

Sometimes messing with self protection module/early start/delay will fix for a short period of time but the problem usually returns :')

I use BitDefender Free, I don't know if it is any relevant but this antivirus is professional messing other softwares up. (Past Personal Experience)

EDIT: This started in late 2017, probably  (but not sure) around/after September, I always keep it up-to-date (no Beta)

Edited January 8, 2018 by Wicked

[Porthos]

49 minutes ago, Wicked said:

I'm having the exact same issue.

I am having your post moved to its own topic. Not similar problems are exactly the same.

If while we wait please do the following.

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues....

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop. Tell any program that blocks it to ignore or allow. It IS SAFE. It contains no info that can identify or harm you.
3. NOTE: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
4. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
5. Press the "Scan" button
6. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   NOTE: These two files will be collected by the MB-Check Tool and added to the zip file for you
7. NEXT: Create and obtain an mb-check log
8. Download MB-Check and save to your desktop
9. Double-click to run MB-Check and within a few second the command window will open, then click "OK"
10. This will produce one log file on your desktop: mb-check-results.zip
11. Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

 

[Wicked]

I hope this helps

Have a nice day!

mb-check-results.zip

[vbarytskyy]

Hello @Wicked

Could you add exclusions to BitDefender for me and do a reboot, if the DDA error still comes up, try to perform a scan in safe mode. Make sure to run a scan with rootkit scanning enabled while in safe mode.

Exclusions to set

Starting in safe mode

 

Also, could you check if there are logs available in the following location and upload them for us:

C:\Users\All Users\Microsoft\Windows\WER\ReportQueue

 

Thank you

Edited January 9, 2018 by vbarytskyy

[Wicked]

This "Bidefender Free" Software doesn't allow users to manually add processes/files to the exclusions, only URLs, only the ones that are actually detected.

4 hours ago, vbarytskyy said:

C:\Users\All Users\Microsoft\Windows\WER\ReportQueue

No logs here.

I will do the scans in Safe-Mode and uninstall BitDefender completely to see if the problem remains, sounds good?

In no way it lets me to add files or processes to the exclusions and I find that quite ridiculous, even for a Free product - but it's what I've been using for ages and it's light and quiet.

[vbarytskyy]

Try checking these locations for me:

• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive

Thank you

[Wicked]

Found some in ReportArchive!

ReportArchive.zip

[Wicked]

Absolutely no malware in my computer, did custom scan + rootkit scan on malwarebytes and did a full scan with Emsisoft (EEK - also no malware found; Emsisoft uses bitdefender's engine and their own; so I'm positive this machine is clean).

 

No problems so far after uninstalling BitDefender Free (I restarded several times and I have changed MBAM's settings back to default),  If something happens even without Bitdefender Free I'll let you know.

 

Thanks for your time!

[vbarytskyy]

@Wicked

Thank you for reporting back. I have submitted the logs you provided for our developers to review as well.

[Wicked]

Ever since I did a full uninstall on BitDefender I haven't had any issues with MBAM3.. :') 

I never had to reinstall MBAM3 so it's pretty much all the same, only BD has been removed.

 

I'l probably look for Kaspersky Free but I'm unsure if I should go for it.

For now I'll just wait a bit - I wish BitDefender add a way to exclude Malwarebytes though..

[Wicked]

The Anti-Rootkit crash just happened with Kaspersky antivirus free.

I have it for a few days and haven't had any trouble until now, it happened during a hyper scan (it's not the first time I run a hyper scan while using kaspersky, so I really don't know what happened here).

I added all specified files specified below to Kasperksy's Exclusions & Trusted App settings.

On 1/9/2018 at 3:39 PM, vbarytskyy said:

Exclusions to set

I'll report any other problems to you guys.

[Wicked]

Happened again with Kaspersky, it's way less common than what it used to with BitDefender but I had all .exe files added to trusted applications and exe & sys files to exclusions of all types in the antivirus software.

This doesn't bother me once or twice, just wanted to let you know, it's weird though.

[Porthos]

1 hour ago, Wicked said:

Happened again with Kaspersky

Could you try the following: If possible with the free version.

• Open the Kaspersky Software turn off Kaspersky Advanced Disinfection
• Click on Settings.Additional -> Threats & Exclusions, disable the Advanced Disinfection Technology.
•  Also, In settings Click on Performance.
• Uncheck Perform regular rootkit scan
  • It may also be labeled "Search for software that is intended to conceal traces of a malicious program in the system"
• Reboot

[Wicked]

Sure thing, but it's so uncommon to happen with kasperksy compare to BD, I'll let you know if it happens.