Cannot enable ransom protection on machines upgraded win 7 to 10 - 1803

[tazmo8448]

Today I upgraded from 1709 to 1803 from a 'fresh start' OS (had Windows 7 upgraded to Windows 10 in August of 2015) install and the Ransomware Protection portion of Mbam Premium can and will not allow me to activate it or toggle it on. Could this be because Microsoft Defender has taken over this function?

[1PW]

Hello  @tazmo8448:

For the experts to commence an accurate analysis, please study the Having problems using Malwarebytes? Please follow these steps sticky.

Then, attach the resulting archive/zip file mbst-grab-results.zip to your next topic reply.

Thank you.

[tazmo8448]

Here is the log file requested.

mbst-grab-results.zip

[exile360]

Greetings,

I spotted the following entries in your logs that indicate that the Ransomware Protection component is having trouble installing its driver and I also noticed the driver wasn't listed where it should be on disk or in the registry:

01/24/19 " 13:26:13.782" 5108546 0d8c 12cc WARNING AntiRansomwareControllerImpl mb::arwcontrollerimpl::ArwControllerImpl::StartProtection "arwcontrollerimplhelper.cpp" 800 "Cannot proceed. State (1), Status (6)"
01/24/19 " 13:26:13.782" 5108546 0d8c 12cc ERROR ArwController CArwController::StartProtection "arwcontroller.cpp" 467 "Failed to start the Anti-Ransomware protection!"
01/24/19 " 13:26:14.190" 5108953 0d8c 12cc WARNING AntiRansomwareControllerImpl mb::arwcontrollerimpl::ArwControllerImpl::StartProtection "arwcontrollerimplhelper.cpp" 800 "Cannot proceed. State (1), Status (6)"
01/24/19 " 13:26:14.190" 5108953 0d8c 12cc ERROR ArwController CArwController::StartProtection "arwcontroller.cpp" 467 "Failed to start the Anti-Ransomware protection!"
01/24/19 " 13:26:14.465" 5109234 0d8c 12cc WARNING AntiRansomwareControllerImpl mb::arwcontrollerimpl::ArwControllerImpl::StartProtection "arwcontrollerimplhelper.cpp" 800 "Cannot proceed. State (1), Status (6)"
01/24/19 " 13:26:14.465" 5109234 0d8c 12cc ERROR ArwController CArwController::StartProtection "arwcontroller.cpp" 467 "Failed to start the Anti-Ransomware protection!"

Apparently something is preventing the driver from installing when Malwarebytes attempts to do so.  Please download and install the latest version of Malwarebytes over your existing installation from here and then reboot once that completes and test to see if Ransomware Protection is now functional or not.

If the problem still persists then please do the following:

1. Run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here
   

Please let us know how it goes and if the issue still remains or not.

Thanks

[tazmo8448]

i will try the over-lay install but have a feeling what it was was Windows new virus 'folder protection' option was toggled on and found it was not allowing me to save notepads or cfg files of any sort on anything.....toggled that off and was able to start 'saving things' in a normal manner....would bet dollars to donuts that was the issue but will report back.

[tazmo8448]

yep....that did it exile360 !!

thanks amigo

still think the new 'virus protection' folder thing was the culprit moving to build 1803 .... to tell you the truth am not looking forward to the 'new' 1809 that has moved into the next yr......grrr

[exile360]

Excellent, I'm glad that it's working now

Yeah, I hear you, it seems like lately a lot of these updates are more trouble than they're worth.  But hopefully Microsoft will do better with the next round of patches.

[lbrush]

Downloading the tool worked.  I'm in agreement on the updates.  I'm on the hardware side so I don't understand all the technical things about Windows OS, but do know that some of these updates are a total pain.  Thanks for the fix.  I have relayed the thread and the file to a couple of other customers who are having the same issues.

[LiquidTension]

Thank you for providing the data, @tazmo8448. We are currently looking further into this issue along with methods of improving the loading of Real-Time Protection components.