Anti-Rootkit DDA Driver an Real-Time Protection

[sysopa]

Hello

Malwarebyte 3.4.51.2467
Win7 x64 SP1      

After starting the computer I often get the message:
Malwarebytes in unable to load the Anti-Rootkit DDA Driver (shows up after opening MB)
and
Real-Time Protection disabled, unable to switch it on

I set up two scans (see below), Normal scan ist set to 21:45:00 (24 hours) that is PM time

But some times after system start MB is trying to run two scans at the same time (see below). I dont know where it comes from. Possibly MB gets mixed up with AM and PM time. The second Normal is at AM time.

after deleting the second Normal scan, MB is working properly for a while.
This behaviour did not occur with MB 3.4.4
I already cleaned and reinstalled MB.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[dcollins]

The reboot scan is usually due to a scan that found something but needed a reboot to continue. Malwarebytes just registers a scan for next reboot to remediate those issues.

As for the DDA/Real Time Protection issues, can you please provide the logs requested above so we can take a look?

[sysopa]

I send the logs next time the fault occures

[sysopa]

Here are the logs, taken after DDA error

normal scan at systems start turnd up again

mb-check-results.zip

FRST.txt

Addition.txt

Edited April 9, 2018 by sysopa

[sysopa]

Here are the logs, taken after DDA and Real Time Protection error

normal scan at system start turnd up again

FRST.txt

Addition.txt

mb-check-results.zip

[sysopa]

Hello

Malwarebyte 3.4.51.2467
Win7 x64 SP1      

The fault occurs always after the computer is started after a complete shut down.
The "normal at system start" scan entry is always shown again, and I think that is is the cause of the  DDA Driver and Real-Time Protection failure.
When I delete the "normal at system start" scan and restart the computer, MB starts and runs without problems.
After a shut down and new start the problem is back again.

This problem does not occur at my Win10 system

[exile360]

It sounds like, based on your description of how it is replicated, that it could be a timing issue and perhaps when Malwarebytes is attempting to launch its scan on system start from a cold boot/full shutdown, that the DDA driver (which stands for Direct Disk Access, and is used for several aspects of scanning, including some components of rootkit scanning among other things) is failing to load for some reason.  It is most likely being caused by a race condition where it is either conflicting with one or more other drivers and/or services that run on boot, or it is simply attempting to load too quickly before one or more dependencies that it requires to run are loaded and times out, thus resulting in the error/issue.

Please keep in mind that these are just my theories based on the information you provided describing the scenario and that I could be wrong.  I'm just thinking it sounds an awful lot like it has something to do with timing and the condition of the system when the driver is trying to load.

I also wonder if this might be at all related to Fast Startup.  Do you currently have Fast Startup enabled on your system?  I ask because I believe I've heard of a few issues with Fast Startup for some users with Malwarebytes.  I found instructions on how to check and disable it here, however those instructions are specifically for Windows 8/8.1, not necessarily 10 so if the placement has changed in Windows 10 you may have to dig to find it as I was unable to locate instructions on MS' support site for controlling this feature in Windows 10.

[vbarytskyy]

@sysopa

Can you do the following for me--

1. Open the Run dialog (Press "Windows" + R keys)
2. Type in "services.msc"
3. Find "Malwarebytes Service" > Right-click and go to "Properties"
4. Change "Startup type:" to "Automatic (Delayed Start)"
5. Hit Apply and close the window
6. Reboot machine

Thank you, let me know if you still get the DDA error on start up. 

[sysopa]

Hello vbarytskyy

Tried it three times with delay and it worked
But the point is, it worked fine with MB 3.4.4

thank you

[plb4333]

3 hours ago, sysopa said:

Hello vbarytskyy

Tried it three times with delay and it worked
But the point is, it worked fine with MB 3.4.4

thank you

I used to have this problem as well, but got a startup delayer program (free) that made Malwarebytes load later in the process. I had to make it not start up until there was at least 40% free processing power available and then 40% disk activity or less, to work ok, and then worked out great.

[plb4333]

6 hours ago, plb4333 said:

I used to have this problem as well, but got a startup delayer program (free) that made Malwarebytes load later in the process. I had to make it not start up until there was at least 40% free processing power available and then 40% disk activity or less, to work ok, and then worked out great.

Please disregard my posting. I was thinking it was for MBAM, but the startup delayer was for another program that had errors like the one mentioned here at boot time. Sorry

[TempLost]

11 hours ago, vbarytskyy said:

@sysopa

Can you do the following for me--

1. Open the Run dialog (Press "Windows" + R keys)
2. Type in "services.msc"
3. Find "Malwarebytes Service" > Right-click and go to "Properties"
4. Change "Startup type:" to "Automatic (Delayed Start)"
5. Hit Apply and close the window
6. Reboot machine

Thank you, let me know if you still get the DDA error on start up. 

I had also suffered also occasional DDA driver warnings and started a thread - was similarly advised to change the Malwarebytes Service startup type and so far that seems to have solved my problem. 

[sysopa]

Hello to all who gave me some advice

I set the properties to  "Automatic (Delayed Start)"
After several error-free system starts I thing that is a solution
no more unexpected "normal at system start" scan and no DDA Driver and Real-Time Protection failure again.

thanks