Scan time problems on a particular file

[MAXBAR1]

I would like to know, from who is more experienced than me of Microsoft Windows, what is the files (syncres.dll.mui) that you see in the attached screenshot of custom scan with all option selected, because the scan before that file takes 25 minutes and then stops for 10 minutes on the displayed file (syncres.dll.mui) and then finish in a few seconds, therefore lasting 35/36 minutes in total when it could probably last only 25/26 minutes.
Attachments screenshots scan and the outputs of Malwarebytes Support Tools Advanced option.

mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

To start, please try running chkdsk to see if it's an issue with the disk or file being corrupt; the scan engine in Malwarebytes is quite sensitive to such things and tends to have issues scanning when there is any filesystem corruption.

If that doesn't help, please try running a special build of Malwarebytes Anti-Rootkit as indicated in this topic to see if that resolves the problem.  If it is able to complete its scan and detects anything, have it remove whatever it finds then restart if prompted to complete the removal process.  Once that's done, try running a Threat scan with Malwarebytes again to see if the problem persists.

Please let us know how it goes.

Thanks

[MAXBAR1]

Meanwhile, good Sunday
this post to update you on the operations done:
I executed in order chkdsk, chkdsk / f (with relative system reboot), scandisk, Malwarebytes antirootkit beta. All the utilities performed did not produce negative results.
I then rerun the scan (equal conditions) with Malwarebytes for Windows.
Attachments to the post: scan report, Antirootkit beta log, screenshot of start and end of scan period related to the file in question; I also attach the file (I had to zip it in order to attach it) that gives problems (there are a hundred with the same name in different folders, this is the one shown in the screenshot) to see if you can understand what happened to him and maybe come to the head of problem. I also attach the updated Malwarebytes support tools log.
For the moment, thank you
Greetings
Massimiliano

Malwarebytes Scan report.txt

system-log.txt

mbar-log-2018-04-22 (06-55-58).txt

SyncRes.dll.zip

mbst-grab-results.zip

[exile360]

Thank you, hopefully this info will help to reveal what's going on.  In the meantime I've got another task for you to perform in order to help diagnose this if you are willing.  You see, it is frequently the case that, because of the way the scan engine works under the hood vs what is being reported in the UI, that it's actually getting stuck elsewhere, not necessarily on this specific file and it is also possible that the problem is not with the file itself, but with another process which uses/accesses that file or even the specific sectors on the disk that the file is written to.  In order to help narrow down the true cause of the issue, special logs are required which should provide more details on what's going on during the scan when it gets hung up.

Please do the following if you are willing, as it should provide more useful information for the Developers to see what's going on with scans on your system:

Create a Process Monitor Log:

• Create a new folder on your desktop called Logs
• Please download Process Monitor from here and save it to your desktop
• Double-click on Procmon.exe to run it
• In Process Monitor, click on File at the top and select Backing Files...
• Click the circle to the left of Use file named: and click the ... button
• Browse to the Logs folder you just created and type MB3 Log in the File name: box and click Save
• Exit Process Monitor and open it again so that it starts creating the logs
• Open Malwarebytes and perform a scan.  Once it freezes or locks up, let it run for a bit longer (like say 30 seconds or so) then terminate the scan
• Close Process Monitor
• Right-click on the Logs folder on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
• Please attach the Logs.zip file you just created to your next reply, or if it is too large, please upload it to WeTransfer and provide us with the link to the file
  

Thanks

[MAXBAR1]

I attach the link from which to download the required logs

Thanks

Regards

Massimiliano

[MAXBAR1]

I wanted to warn that I turned the request to Malwarebytes technical support.
Thanks for everything
regards
Massimiliano

[exile360]

Excellent, thanks for letting me know.  If you haven't already, please provide them with a link to this thread as well so that they may have access to the logs and info you provided here.

Thanks  

[MAXBAR1]

Waiting for a response from the technical support I point out that the problem is not the SSD disk as it occurs on another PC and the same PC with new disk (the previous one could have problems already reported by the Dell tests but has been replaced )

[exile360]

Does it stop on the same file on both systems and all the different drives you've used?

[MAXBAR1]

Yes, the file is always syncres.dll.mui on both systems that are:

1) Dell 3558 (i3, 8 Gb Ram, SSD (first Kingston 120 Gb, now Samsung 840 evo 240 Gb) - my own

2) Asus (i7 HQ, 8 Gb Ram, SSD Kingston 240 Gb) - of my Father (it was buyed in October 2017)

I can also add that I'm testing the new beta version 3.5 of Malwarebytes and the Dell continues (at this precise moment 25/04/2018 - 10.10 - local time Italy) to hang on that file.

I add that on the new SSD (on Dell) I performed a clean (and not a backup) installation of Windows 10 Fall Creators Update version 16299.402)

thanks

regard

 

 

Edited April 25, 2018 by MAXBAR1

[exile360]

OK, thanks.  When you ran Malwarebytes Anti-Rootkit, it did not hang during its scan, is that correct?

[MAXBAR1]

I have downloaded and now run Malwarebytes Anti-Rootkit and Mb-Check and I am attaching the log products; no blockage occurred; he did not find any threats.

mb-check-results.zip

system-log.txt

[dcollins]

For reference, the file you see in the UI is not necessarily the file that's getting stuck. Because of how many files we scan and how fast they scan, they don't always show in the UI. If you turn off rootkit scanning under Settings -> Protection, does the issue go away?

[MAXBAR1]

I enclose these two screenshots to explain myself better

I have done four different types of scanning:
1) Rootkit activated in both screens (it stops at 24 minutes until about 34 minutes and then ends in a matter of seconds)
2) Rootkit not activated on both screens (does not crash and lasts a total of 2 minutes and 41 seconds)
3) Rootkit activated in the first screen and deactivated in the second (does not stop and lasts a total of 2 minutes and 12 seconds)
4) Rootkit deactivated in the first screen and activated in the second (it stops at minute 21 up to about 31 minutes and then ends in a matter of seconds)
 

It can be said that it depends on the setting in the second screen even if setting them both on active makes the situation even worse

At this point I ask three things:
1) What is the Rootkit search for? Is not it dangerous to deactivate it?
2) Is it a problem that will be solved in future beta of versione 3.5?
3) If I have to deactivate the Rootkit search between scan 2 and scan 3 which is the safest to make there being only a few seconds difference? Are there any differences between the two ways of scanning?


Thank you in advance
regards
Massimiliano

Edited April 25, 2018 by MAXBAR1

[dcollins]

Rootkit scanning does a deeper scanning of the files on your drive. It's not needed all the time since rootkits usually come in by the way of another infection, meaning you would ideally only run it after you have found an active infection on your machine. That being said, if the scan does eventually finish, this is not really much of an issue, it's just doing some scanning in the background. However I'll pass the information along to our devs.

[exile360]

6 hours ago, dcollins said:

For reference, the file you see in the UI is not necessarily the file that's getting stuck. Because of how many files we scan and how fast they scan, they don't always show in the UI. If you turn off rootkit scanning under Settings -> Protection, does the issue go away?

The user provided a Procmon log here which should show what's going on/where it's actually getting stuck.  Might be useful for the Devs to see what it's doing when it sticks there.

[MAXBAR1]

if necessary, I create and provide a new Procmon log with the new SSD

[exile360]

Yes, that could definitely prove useful, thanks.

[MAXBAR1]

_{attachments (created on 26/04/2018):
link to ProcMon Log MB3 on Dell 3558 i3-5005, 8 GB RAM, Samsung EVO 840 240Gb SSD, Intel Integrated Video Card https://we.tl/OIO5svRYzY (}the link is valid for 7 days)
_{MBCHECK log}

_{Thanks for the moment}

_Regards

_Massimiliano

 

 

mb-check-results.zip

Edited April 26, 2018 by MAXBAR1

[MAXBAR1]

3 hours ago, MAXBAR1 said:

_{link to ProcMon Log MB3 on Dell 3558 i3-5005, 8 GB RAM, Samsung EVO 840 240Gb SSD, Intel Integrated Video Card https://we.tl/OIO5svRYzY (}the link is valid for 7 days)

I correct myself: the SSD is a Samsung 840 of 240 GB and not a 840EVO

[dcollins]

Does this procmon log run the entire scan (even after it finishes)?

[MAXBAR1]

following the instructions posted above I left Act about 2 minutes after the block

[exile360]

Yeah, I figured they just needed to see what's going on during the lockup/lag when scanning that file (or whatever file it actually is, as the GUI may be showing inaccurate info as you mentioned previously) and I didn't want to make him upload some super massive file from the entire scan, which would have been a lot larger.

[MAXBAR1]

However if you need a log of the whole scan, I create it and place the link