Scan produces Schannel error

[ddeerrff]

Windows 7 Home Premium SP1, MalwareBytes Premium 3.5., Acer Aspire laptop

MalwareBytes scan appears to be generating two Schannel errors when it scans overnight.  In the Computer Management Administrative events log I see Schannel errors (eventID 36887) fatal alert 40 and fatal alert 70.  The errors seem to occur about 4 minutes after the scan is scheduled to start. 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
  
   
• Click the Gather Logs button
  
  
   
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
  
     
  
  
  Click "Reveal Hidden Contents" below for details on how to attach a file:
   
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  
   

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[ddeerrff]

The board will not allow me to attach the 'grab' file.  Thinks it is spam.

mbst-grab-results.zip

[exile360]

Greetings,

I did notice two items that stood out to me in the logs you posted, though I'm not positive that either is related, but it's worth testing to see.  First, you've got User Account Control disabled, meaning Malwarebytes and other software which has been designed to be fully compatible and compliant with UAC may not function normally:

UAC Settings
==================================
EnableLUA:            Off
Consent Prompt Behavior Admin:    Off

I would recommend resetting UAC back to default settings then restarting the system to see if it makes any difference with the errors or not.  Instructions on doing so may be found here and the default is for the slider to be in the second level from the top as shown in the image on that page.

Second, I noticed that, at least according to the Windows Action Center, both Microsoft Security Essentials and Windows Defender are active.  However, by default, Windows Defender should have been disabled by installing Microsoft Security Essentials as MSE includes all of the same databases and detection/engine capabilities in Windows Defender in addition to more comprehensive virus/malware protection so having both active shouldn't provide any benefit and I've no idea what impact having both active would have on a system as I've never seen both running before.  I would recommend turning off Windows Defender then rebooting your system to see if that helps at all.

If you test either or both of these options please let us know how it goes and if it resolves the errors you're seeing.

Thanks

[ddeerrff]

Reset UAC back to default. 

When I try to run Windows Defender (search for 'defender' on start button, click on Windows Defender), it tells me "This program is turned off".  In Task Manager /processes, nothing related to Defender appears to be running.  Under Task Manager /Services WinDefend is listed as Stopped.  Don't know why the mb-check log shows it as on. 

 

Let me add that these Schannel errors come and go.  I will get them every time MB scans for weeks, then they will go away for a while. 

[dcollins]

The schannel errors are usually related to communication between a client and server. Since there are no errors in the Malwarebytes log around the time you're seeing those errors in event viewer, this makes me think that perhaps something else is throwing the error. Perhaps it's monitoring what Malwarebytes is doing and that's why you see it during the scan. Based on the logs, I'd start by disabling NoVirusThanks and see if the issue persists. If so, try disabling any other security software you may have.

[ddeerrff]

I have tried disabling NoVirusThanks and it makes no difference. 

 

I've got MB doing a scan every hour now, and have gotten an error in the error log for the last two runs.  I'll try disabling NoVirusThanks and MSE real time protection for a while and see what happens.

 

[ddeerrff]

Does not seem to be related to NoVirusThanks, but the picture with MSE is less clear. 

If I am getting errors and disable MSE Real Time Protection, most of the time the errors stop.  But if I turn RTP back on, the errors do not return.  A clean boot will bring the errors back some times.  But I have been able to reboot with RTP turned off and still get the errors.  Confusing.  I currently have MB doing a scan every hour on the hour.  My notes:

 

7:50pm reboot, with MSE Real Time Protection on
Errors at 8:04, 9:05

9:30pm disabled RTP
NO errors at 10, 11 and 12

12:15am rebooted, RTP remains disabled
Errors at 1:04, 2:04, 3:04, 4:04
NO errors at 5, 6, 7, 8, 9.    <<-- Don't know what changed between 4 and 5, I was sound asleep. 

9:30am re-enabled RTP   
NO errors at 10, 11, 12

12:30pm rebooted, RTP remains enabled
NO errors at 1, 2, 3

3:30pm Reboot again, still leaving RTP enabled
Errors at 4:05, 5:05

5:30pm disable RTP
Errors at 6:04
NO error at 7

7:30 pm Re-enable RTP
NO errors at 8

 

So, is it related to MSE or not?

 

 

[dcollins]

Can you try the following:

1. Open Internet Explorer (even if it's not your default browser)
2. Click the Gear icon in the upper right corner and then click Internet Options
3. Click the Advanced tab on the top
4. Scroll to the very bottom of the list
5. The sixth option from the bottom should be Use TLS 1.0. If that box is checked, uncheck it. If it's unchecked, check it.
6. Click Ok and then reboot
7. Now try running a few more scans with MSE RTP enabled

[ddeerrff]

TLS 1.0 was checked, is now unchecked.  Will reboot and see what happens.  (Boy, I'm glad I replaced my HDD with an SSD :).)

[ddeerrff]

No change.  The error is being thrown about half way though the 'Scan File System' portion of the scan, if that helps any.

[ddeerrff]

Well, the SChannel error seems to have gone away for now.  Will not be surprised if it comes back like it has in the past.  It really is not causing me any problems, just bugs me seeing that error in the event viewer.

[dcollins]

Sorry, missed your reply. This is very strange, but as I mentioned, it doesn't seem likely that it's coming from Malwarebytes itself as we have no other errors in our own logs. This seems like some other application throwing an error, and it probably happens during a scan because it's monitoring something we do.