RCMTIT Posted February 5, 2018 ID:1212650 Share Posted February 5, 2018 PUM pum.optional.disabledsecuritycenter keeps popping up on most of the MalwareBytes scans. Is this a false reporting issue? It might be the because MS has set the registry key (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\ UpdatesDisableNotify=1) that way to prevent users from doing the updates manually in most cases. Even after removing it multiple time it keeps reappearing. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 6, 2018 Root Admin ID:1212824 Share Posted February 6, 2018 Hello @RCMTIT and Well, if you had Malwarebytes fix what it found and it comes back then there is something set that is putting it back and it's probably not Microsoft. Can you please post your most recent scan log so that we can take a look. Thank you Ron Link to post Share on other sites More sharing options...
RCMTIT Posted February 6, 2018 Author ID:1212967 Share Posted February 6, 2018 Multiple computers are having the same issue with this. Attached is the log mbam-log.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 6, 2018 Root Admin ID:1213003 Share Posted February 6, 2018 Is this a business on a network domain? Are you disabling it on purpose? Please see the following https://blog.malwarebytes.com/detections/pum-optional-disabledsecuritycenter/ Link to post Share on other sites More sharing options...
RCMTIT Posted February 7, 2018 Author ID:1213325 Share Posted February 7, 2018 Some network computers, some personal computers. I am not trying to disable it, I am resetting it from UpdatesDisableNotify=1 to UpdatesDisableNotify=0. I am trying to figure out why it keeps getting reset to UpdatesDisableNotify=1 and coming back up when I do a scan. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 8, 2018 Root Admin ID:1213587 Share Posted February 8, 2018 Pick one of the computers and let's do some scans and get some logs. Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan. When finished, please click Clean. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks Ron Link to post Share on other sites More sharing options...
RCMTIT Posted February 15, 2018 Author ID:1215953 Share Posted February 15, 2018 Sorry for the delay in getting back. Attached are the files requested. This repeated warning is happening with both the personal version and business version. The attached files are frAddition.txtFRST.txtMalwareBytes scan results.txtAdwCleaner[S0].txtom the personal version. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 15, 2018 Root Admin ID:1215968 Share Posted February 15, 2018 Difficult to say for sure. Our program along with some others are crashing.It's possible that McAfee is stepping on them but don't know that for sure. Perhaps do a clean removal and reinstall of both McAfee and Malwarebytes may be in order. Application errors: ================== Error: (02/15/2018 02:01:07 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: MsiExec.exe, version: 5.0.16299.15, time stamp: 0x3ab70a4f Faulting module name: RPCRT4.dll, version: 10.0.16299.192, time stamp: 0xd36f7e34 Exception code: 0xc0000005 Fault offset: 0x00036e35 Faulting process id: 0x1c20 Faulting application start time: 0x01d3a68f4e0ebcdd Faulting application path: C:\Windows\syswow64\MsiExec.exe Faulting module path: C:\WINDOWS\System32\RPCRT4.dll Report Id: 663d0d33-d96c-4eec-bfbb-cd6c93759ad1 Faulting package full name: Faulting package-relative application ID: Error: (02/15/2018 01:50:10 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: mbamservice.exe, version: 3.1.0.595, time stamp: 0x59f745cb Faulting module name: mbamservice.exe, version: 3.1.0.595, time stamp: 0x59f745cb Exception code: 0xc0000005 Fault offset: 0x00000000001c6e66 Faulting process id: 0x4e64 Faulting application start time: 0x01d3a68dcd5ae3ff Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe Report Id: 49213df4-914a-43f8-8924-ccb852c602b8 Faulting package full name: Faulting package-relative application ID: Error: (02/14/2018 03:01:09 AM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW. hr = 0x80070006, The handle is invalid. . Operation: Executing Asynchronous Operation Context: Current State: DoSnapshotSet Error: (02/13/2018 05:54:21 PM) (Source: TrueColorALS) (EventID: 4) (User: ) Description: Event-ID 4 Error: (02/13/2018 05:52:11 PM) (Source: SupportAssistAgent) (EventID: 0) (User: ) Description: An exception occurred in session change of service start: Object reference not set to an instance of an object. Error: (02/13/2018 05:50:10 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: svchost.exe_WpnUserService, version: 10.0.16299.15, time stamp: 0x9c786b9a Faulting module name: ntdll.dll, version: 10.0.16299.192, time stamp: 0x6dead514 Exception code: 0xc000000d Fault offset: 0x000000000010b2c0 Faulting process id: 0x22e0 Faulting application start time: 0x01d39b880972d2ef Faulting application path: c:\windows\system32\svchost.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: a6f2cf63-55a3-4779-b134-7425d115dfd3 Faulting package full name: Faulting package-relative application ID: Error: (02/13/2018 05:49:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: svchost.exe_WpnUserService, version: 10.0.16299.15, time stamp: 0x9c786b9a Faulting module name: ntdll.dll, version: 10.0.16299.192, time stamp: 0x6dead514 Exception code: 0xc000000d Fault offset: 0x000000000010b2c0 Faulting process id: 0x22e0 Faulting application start time: 0x01d39b880972d2ef Faulting application path: c:\windows\system32\svchost.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: 08e85a7d-5061-4992-ae38-7995f7ce069e Faulting package full name: Faulting package-relative application ID: Error: (02/13/2018 05:48:17 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: Taskmgr.exe, version: 10.0.16299.15, time stamp: 0x635d4324 Faulting module name: Taskmgr.exe, version: 10.0.16299.15, time stamp: 0x635d4324 Exception code: 0xc0000409 Fault offset: 0x00000000000147d9 Faulting process id: 0x30c0 Faulting application start time: 0x01d39b882c9439a9 Faulting application path: C:\Windows\System32\Taskmgr.exe Faulting module path: C:\Windows\System32\Taskmgr.exe Report Id: 41c54500-74d7-4214-86a2-0f6b78010d3a Faulting package full name: Faulting package-relative application ID: Link to post Share on other sites More sharing options...
RCMTIT Posted February 15, 2018 Author ID:1216015 Share Posted February 15, 2018 Personal computer has McAfee, Business computers have WebRoot for Anti-Virus. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 15, 2018 Root Admin ID:1216020 Share Posted February 15, 2018 Can't speak for the other computers as I don't have logs. But this one crashed our program so have no idea if it really set it or not. If you manually go modify the registry key yourself though and reboot. Does the value change? Link to post Share on other sites More sharing options...
RCMTIT Posted February 15, 2018 Author ID:1216053 Share Posted February 15, 2018 It was set, I manually changed it and it got set again. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 15, 2018 Root Admin ID:1216059 Share Posted February 15, 2018 Use Process Monitor to see what is changing it. https://docs.microsoft.com/en-us/sysinternals/downloads/procmon Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 7, 2018 Root Admin ID:1221936 Share Posted March 7, 2018 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts