Jump to content
MAXBAR1

Scan time problems on a particular file

Recommended Posts

I would like to know, from who is more experienced than me of Microsoft Windows, what is the files (syncres.dll.mui) that you see in the attached screenshot of custom scan with all option selected, because the scan before that file takes 25 minutes and then stops for 10 minutes on the displayed file (syncres.dll.mui) and then finish in a few seconds, therefore lasting 35/36 minutes in total when it could probably last only 25/26 minutes.
Attachments screenshots scan and the outputs of Malwarebytes Support Tools Advanced option.scan.thumb.jpg.f0c3dd251be9e2e51c2bc1feb75c14b4.jpg

mbst-grab-results.zip

Share this post


Link to post
Share on other sites

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Farbar Recovery Scan Tool (FRST)
    1. Download FRST and save it to your desktop
      Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
    2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
    3. Press the "Scan" button
    4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
      • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
  • MB-Check
    1. Download MB-Check and save to your desktop
    2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
    3. This will produce one log file on your desktop: mb-check-results.zip
      • This file will include the FRST logs generated from the previous set of instructions
      • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Share this post


Link to post
Share on other sites

Greetings,

To start, please try running chkdsk to see if it's an issue with the disk or file being corrupt; the scan engine in Malwarebytes is quite sensitive to such things and tends to have issues scanning when there is any filesystem corruption.

If that doesn't help, please try running a special build of Malwarebytes Anti-Rootkit as indicated in this topic to see if that resolves the problem.  If it is able to complete its scan and detects anything, have it remove whatever it finds then restart if prompted to complete the removal process.  Once that's done, try running a Threat scan with Malwarebytes again to see if the problem persists.

Please let us know how it goes.

Thanks

Share this post


Link to post
Share on other sites

Meanwhile, good Sunday
this post to update you on the operations done:
I executed in order chkdsk, chkdsk / f (with relative system reboot), scandisk, Malwarebytes antirootkit beta. All the utilities performed did not produce negative results.
I then rerun the scan (equal conditions) with Malwarebytes for Windows.
Attachments to the post: scan report, Antirootkit beta log, screenshot of start and end of scan period related to the file in question; I also attach the file (I had to zip it in order to attach it) that gives problems (there are a hundred with the same name in different folders, this is the one shown in the screenshot) to see if you can understand what happened to him and maybe come to the head of problem. I also attach the updated Malwarebytes support tools log.
For the moment, thank you
Greetings
Massimiliano

start period scan files scanres.dll.mui.jpg

end period scan files scanres.dll.mui.jpg

Malwarebytes Scan report.txt

system-log.txt

mbar-log-2018-04-22 (06-55-58).txt

SyncRes.dll.zip

mbst-grab-results.zip

Share this post


Link to post
Share on other sites

Thank you, hopefully this info will help to reveal what's going on.  In the meantime I've got another task for you to perform in order to help diagnose this if you are willing.  You see, it is frequently the case that, because of the way the scan engine works under the hood vs what is being reported in the UI, that it's actually getting stuck elsewhere, not necessarily on this specific file and it is also possible that the problem is not with the file itself, but with another process which uses/accesses that file or even the specific sectors on the disk that the file is written to.  In order to help narrow down the true cause of the issue, special logs are required which should provide more details on what's going on during the scan when it gets hung up.

Please do the following if you are willing, as it should provide more useful information for the Developers to see what's going on with scans on your system:

Create a Process Monitor Log:

  • Create a new folder on your desktop called Logs
  • Please download Process Monitor from here and save it to your desktop
  • Double-click on Procmon.exe to run it
  • In Process Monitor, click on File at the top and select Backing Files...
  • Click the circle to the left of Use file named: and click the ... button
  • Browse to the Logs folder you just created and type MB3 Log in the File name: box and click Save
  • Exit Process Monitor and open it again so that it starts creating the logs
  • Open Malwarebytes and perform a scan.  Once it freezes or locks up, let it run for a bit longer (like say 30 seconds or so) then terminate the scan
  • Close Process Monitor
  • Right-click on the Logs folder on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
  • Please attach the Logs.zip file you just created to your next reply, or if it is too large, please upload it to WeTransfer and provide us with the link to the file

Thanks

Share this post


Link to post
Share on other sites

I wanted to warn that I turned the request to Malwarebytes technical support.
Thanks for everything
regards
Massimiliano

Share this post


Link to post
Share on other sites

Excellent, thanks for letting me know.  If you haven't already, please provide them with a link to this thread as well so that they may have access to the logs and info you provided here.

Thanks :) 

Share this post


Link to post
Share on other sites

Waiting for a response from the technical support I point out that the problem is not the SSD disk as it occurs on another PC and the same PC with new disk (the previous one could have problems already reported by the Dell tests but has been replaced )

Share this post


Link to post
Share on other sites

Yes, the file is always syncres.dll.mui on both systems that are:

1) Dell 3558 (i3, 8 Gb Ram, SSD (first Kingston 120 Gb, now Samsung 840 evo 240 Gb) - my own

2) Asus (i7 HQ, 8 Gb Ram, SSD Kingston 240 Gb) - of my Father (it was buyed in October 2017)

I can also add that I'm testing the new beta version 3.5 of Malwarebytes and the Dell continues (at this precise moment 25/04/2018 - 10.10 - local time Italy) to hang on that file.

I add that on the new SSD (on Dell) I performed a clean (and not a backup) installation of Windows 10 Fall Creators Update version 16299.402)

thanks

regard

 

 

Edited by MAXBAR1

Share this post


Link to post
Share on other sites

For reference, the file you see in the UI is not necessarily the file that's getting stuck. Because of how many files we scan and how fast they scan, they don't always show in the UI. If you turn off rootkit scanning under Settings -> Protection, does the issue go away?

Share this post


Link to post
Share on other sites

I enclose these two screenshots to explain myself better

Application-Setup.JPG

Scan-Setup.JPG.f46ecd140ec958975decc23352c71f18.JPG

I have done four different types of scanning:
1) Rootkit activated in both screens (it stops at 24 minutes until about 34 minutes and then ends in a matter of seconds)
2) Rootkit not activated on both screens (does not crash and lasts a total of 2 minutes and 41 seconds)
3) Rootkit activated in the first screen and deactivated in the second (does not stop and lasts a total of 2 minutes and 12 seconds)
4) Rootkit deactivated in the first screen and activated in the second (it stops at minute 21 up to about 31 minutes and then ends in a matter of seconds)
 

It can be said that it depends on the setting in the second screen even if setting them both on active makes the situation even worse

At this point I ask three things:
1) What is the Rootkit search for? Is not it dangerous to deactivate it?
2) Is it a problem that will be solved in future beta of versione 3.5?
3) If I have to deactivate the Rootkit search between scan 2 and scan 3 which is the safest to make there being only a few seconds difference? Are there any differences between the two ways of scanning?


Thank you in advance
regards
Massimiliano

Edited by MAXBAR1

Share this post


Link to post
Share on other sites

Rootkit scanning does a deeper scanning of the files on your drive. It's not needed all the time since rootkits usually come in by the way of another infection, meaning you would ideally only run it after you have found an active infection on your machine. That being said, if the scan does eventually finish, this is not really much of an issue, it's just doing some scanning in the background. However I'll pass the information along to our devs.

Share this post


Link to post
Share on other sites
6 hours ago, dcollins said:

For reference, the file you see in the UI is not necessarily the file that's getting stuck. Because of how many files we scan and how fast they scan, they don't always show in the UI. If you turn off rootkit scanning under Settings -> Protection, does the issue go away?

The user provided a Procmon log here which should show what's going on/where it's actually getting stuck.  Might be useful for the Devs to see what it's doing when it sticks there.

Share this post


Link to post
Share on other sites

if necessary, I create and provide a new Procmon log with the new SSD

Share this post


Link to post
Share on other sites

attachments (created on 26/04/2018):
link to ProcMon Log MB3 on Dell 3558 i3-5005, 8 GB RAM, Samsung EVO 840 240Gb SSD, Intel Integrated Video Card https://we.tl/OIO5svRYzY (
the link is valid for 7 days)
MBCHECK log

Thanks for the moment

Regards

Massimiliano

 

 

mb-check-results.zip

Edited by MAXBAR1

Share this post


Link to post
Share on other sites
3 hours ago, MAXBAR1 said:


link to ProcMon Log MB3 on Dell 3558 i3-5005, 8 GB RAM, Samsung EVO 840 240Gb SSD, Intel Integrated Video Card https://we.tl/OIO5svRYzY (the link is valid for 7 days)

I correct myself: the SSD is a Samsung 840 of 240 GB and not a 840EVO

Share this post


Link to post
Share on other sites

following the instructions posted above I left Act about 2 minutes after the block

Share this post


Link to post
Share on other sites

Yeah, I figured they just needed to see what's going on during the lockup/lag when scanning that file (or whatever file it actually is, as the GUI may be showing inaccurate info as you mentioned previously) and I didn't want to make him upload some super massive file from the entire scan, which would have been a lot larger.

Share this post


Link to post
Share on other sites

However if you need a log of the whole scan, I create it and place the link

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.