Not getting notifications when scan is done and update issue

[Xauma95]

with the 3.7 mbam version I'm not getting notifications when a scan is done and today it found a PUP but i didn't realize till i opened mbam. Here are the logs. Also i have to say that i've just updated mbam today and when i updated it my pc went blocked so i have to turn it off and then when i turn it on mbam was installed and updated so I don't know now if it works properly now

mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

There appears to be something odd with your Malwarebytes installation.  I'd suggest a clean install just to see if that doesn't clear up any issues:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here
   

As for the PUP detection, your logs show that Malwarebytes recently detected and quarantined a driver updater program's installer.  You can learn more about why in this blog article.

[Xauma95]

16 minutes ago, exile360 said:

There appears to be something odd with your Malwarebytes installation.  I'd suggest a clean install just to see if that doesn't clear up any issues:

 

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here

 

As for the PUP detection, your logs show that Malwarebytes recently detected and quarantined a driver updater program's installer.  You can learn more about why in this blog article.

the support tool didn't restart my pc it remove mbam and then it asked me to reinstal it but without restarting. Is it normal? here are the new logs

mbst-clean-results.txt mbst-grab-results.zip

[exile360]

Yes, that's normal if it didn't need to restart (which judging by the log, it didn't need to).

Is everything working OK now?

[Xauma95]

5 minutes ago, exile360 said:

Yes, that's normal if it didn't need to restart (which judging by the log, it didn't need to).

Is everything working OK now?

yes, but im wondering about MbamChameleon, cause i cant see any process called mbamchameleon and in the clean file said MBAMChameleon will be unloaded after reboot, also it says Failed to delete directory (145). Will retry later. Did you see any issue in the log?

[Xauma95]

well, i have enabled self protection module so i guess that's mbam chameleon right? although i dont have enabled self protection module on early start

[Xauma95]

35 minutes ago, Xauma95 said:

well, i have enabled self protection module so i guess that's mbam chameleon right? although i dont have enabled self protection module on early start

But with proces explorer i've tried to find SelfProtectionSdk.dll and didn't find anything but that dll is in the mbam folder and also chameleon is on system32 driver folder

[Xauma95]

okey i think is working well because i've tried to stop mbam services from the task manager and i was unable to. Thanks for your help

[exile360]

Yes, Chameleon is the self protection driver.  It loads and unloads the DLL dynamically as needed (to check for protected processes etc.), but the driver itself that runs in the background is just the .sys file so you won't see it in tools like Task Manager etc. but you can always test it as you did by trying to kill any of MB3's processes (or by trying to delete any of MB3's files from its program folder for example) and you should get an 'access denied' message even if you're using the highest possible permissions/privileges.

[Xauma95]

1 minute ago, exile360 said:

Yes, Chameleon is the self protection driver.  It loads and unloads the DLL dynamically as needed (to check for protected processes etc.), but the driver itself that runs in the background is just the .sys file so you won't see it in tools like Task Manager etc. but you can always test it as you did by trying to kill any of MB3's processes (or by trying to delete any of MB3's files from its program folder for example) and you should get an 'access denied' message even if you're using the highest possible permissions/privileges.

the only thing that i'm able to close from the task manager is the tray aplication, but the protection is still there blocking but no notifications if i stop mbamtray

[exile360]

Hmm, I think I just found a bug.  While Malwarebytes does restart itself as it should if terminated, I am able to kill any of its processes via Task Manager even with self-protection active.  I'll have to report this to the team for analysis because unless something has changed with their implementation, that should not be possible if it's working correctly.

[Xauma95]

4 minutes ago, exile360 said:

Hmm, I think I just found a bug.  While Malwarebytes does restart itself as it should if terminated, I am able to kill any of its processes via Task Manager even with self-protection active.  I'll have to report this to the team for analysis because unless something has changed with their implementation, that should not be possible if it's working correctly.

So self protection is not working as it should? That's important to inform, as self protection it's like a shield to MBAM right?

[exile360]

It isn't on my system at least, though I just turned it on (I normally keep it off).  I'll reboot my rig and see if this issue still persists, but yes, it's supposed to protect Malwarebytes from being tampered with or terminated.

[Xauma95]

3 minutes ago, exile360 said:

It isn't on my system at least, though I just turned it on (I normally keep it off).  I'll reboot my rig and see if this issue still persists, but yes, it's supposed to protect Malwarebytes from being tampered with or terminated.

for now at least i'm still getting acces denied if i try to stop the only Mbam proces that i have witch is Mbam Service, but i will try tomorrow when i turn on my pc