Unexpected Scans

[PCJedi]

We have a computer with scheduled update and scans (screen capture attached).  The schedule is for one update and one scan daily.   

 

 

 

The logs for the latest day are 

2018/02/06 15:20:02 -0600          PC-140519           frontdesk            MESSAGE            Executing scheduled scan:  Quick Scan | Daily | -remove | -terminate

2018/02/06 15:20:02 -0600          PC-140519           frontdesk            MESSAGE            Scheduled scan executed successfully

2018/02/06 15:21:06 -0600          PC-140519           frontdesk            MESSAGE            Stopping IP protection

2018/02/06 15:21:06 -0600          PC-140519           frontdesk            MESSAGE            IP Protection stopped successfully

2018/02/06 16:39:30 -0600          PC-140519           frontdesk            MESSAGE            Starting protection

2018/02/06 16:39:30 -0600          PC-140519           frontdesk            MESSAGE            Protection started successfully

2018/02/06 16:39:30 -0600          PC-140519           frontdesk            MESSAGE            Starting IP protection

2018/02/06 16:39:31 -0600          PC-140519           frontdesk            MESSAGE            IP Protection started successfully

2018/02/06 20:59:59 -0600          PC-140519           frontdesk            MESSAGE            Executing scheduled update:  Daily

2018/02/06 21:00:03 -0600          PC-140519           frontdesk            MESSAGE            Scheduled update executed successfully:  database updated from version v2018.02.06.08 to version v2018.02.06.09

2018/02/06 21:00:03 -0600          PC-140519           frontdesk            MESSAGE            Starting database refresh

2018/02/06 21:00:03 -0600          PC-140519           frontdesk            MESSAGE            Stopping IP protection

2018/02/06 21:00:04 -0600          PC-140519           frontdesk            MESSAGE            IP Protection stopped successfully

2018/02/06 21:00:07 -0600          PC-140519           frontdesk            MESSAGE            Database refreshed successfully

2018/02/06 21:00:07 -0600          PC-140519           frontdesk            MESSAGE            Starting IP protection

2018/02/06 21:00:08 -0600          PC-140519           frontdesk            MESSAGE            IP Protection started successfully

2018/02/06 22:59:59 -0600          PC-140519           frontdesk            MESSAGE            Executing scheduled scan:  Quick Scan | Daily | -remove | -terminate

2018/02/06 23:00:00 -0600          PC-140519           frontdesk            MESSAGE            Scheduled scan executed successfully

 

 

At random times during the day, a scan starts, runs, and completes.   The scan is not in the schedule.   The occurrences appear to be random.  There are multiple unexpected scans per day.

• Remediation Steps
• Uninstalled the program.
• Installed the latest program
• Updated
• Removed the scheduled scan
• Created a new scheduled scan

 

Current Version is 1.80.20.102

 

What is the next step for resolution?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[PCJedi]

Please find mb-check-results.zip attached.

Thank you

Stephen Hopkins

mb-check-results.zip

[Firefox]

Hello and Welcome @PCJedi!

I have asked the team to move your topic to the business section as you will get better replies to your topic there.

 

[PCJedi]

Thank you. 

[KDawg]

PC Jedi

 

Can we get logs from the three days previous as well? The scan commands may retry if the machine is not able to execute the previous days command possibly causing these multiple scans once communicating again.

 

Many Thanks,

Edited February 7, 2018 by KDawg

[PCJedi]

I have attached several days of logs.   Thank you.

protection-log-2018-02-01.txt

protection-log-2018-02-02.txt

protection-log-2018-02-03.txt

protection-log-2018-02-04.txt

protection-log-2018-02-05.txt

protection-log-2018-02-06.txt

protection-log-2018-02-07.txt

protection-log-2018-01-25.txt

protection-log-2018-01-26.txt

protection-log-2018-01-27.txt

protection-log-2018-01-28.txt

protection-log-2018-01-29.txt

protection-log-2018-01-30.txt

protection-log-2018-01-31.txt

[djacobson]

Hi @PCJedi, it looks like KDawg was on the right track, most of your scans kick off at 22:59:59, with outliers happening at 15:20 outside of that. I would recommend changing your scan settings to allow the machine to wake from sleep, if that is not set, to not miss the scans. Your recover if missed by is already set to 0 or 1 hours. Another item to make sure you do not have enabled is to run a flash scan after successful update.

Scheduled Item: Update     Schedule Options:    | Daily    | Wake From Sleep    
Start Time: 2015-11-10 21:00     Repeating Every: 1     Recover if missed by: 23

Scheduled Item: Scan     Schedule Options:    Quick Scan    | Daily    | Scan Remove    | Scan Terminate    
Start Time: 2018-02-06 23:00     Repeating Every: 1     Recover if missed by: 0