Computer crashes .sys proplem

[tchoucky86]

Hello when i start some program my computer crash. It said something with sys error.

I turn off the web protection from malware  and now its working fine but i want my web protection on.

Can someone help me please.

Thanks

[Maurice Naggar]

Hello  @tchoucky86      

My name is Maurice.  Let me know what name you prefer to go by.

I would appreciate  getting some key details from this machine.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

Do have patience while the report tool runs.  It may take several minutes.  Just let it run & take its time.  You may want to close your other open windows so that there is a clear field of view.
Download Malwarebytes Support Tool
    
  
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.7.0.827.exe  to run the report

Once it starts, you will see a first screen with 2 buttons.  Click the one on the left marked "I don't have an open support ticket".

        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
Now click the left-hand side pane "I do not have an open support ticket"

    You will be presented with a page stating, "Get Started!"
    Do NOT use the button “Start repair” !   But look instead at the far-left options list in black.

    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer.  Please do have patience.  It takes several minutes to gather.
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK.  Then Exit the tool.

    Please attach the ZIP file in your next reply.

[tchoucky86]

Hello, 

here are the files

thanks,

Antony

mbst-grab-results.zip

[Maurice Naggar]

Thanks, Antoby.

I notice a Malwarebytes web protection Block noti ce event on October 1  about                   "ip" : "104.18.47.76",       "url" : "ts.nebularp.com"   

Has that repeated ?

.

This pc also has installed Kaspersky Internet Security.    Have you done a recent scan with it ?   result ?

.

Please do a new Scan on this machine, using Malwarebytes for Windows.
To run a Threat Scan, open Malwarebytes for Windows and click the blue Scan button.
Have patience during the run.
When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.
Then click on Quarantine selected.

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

             

Edited October 2, 2020 by Maurice Naggar

[tchoucky86]

hello,

yes  "ip" : "104.18.47.76",       "url" : "ts.nebularp.com"  its the server that i play on fivm gta 5 rp

when i run teamspeak it crash my pc.

When i desactivate web protection then it worked.

regards ,

Antony

scan.txt

[Maurice Naggar]

Thank you for the scan report from Malwarebytes for Windows.   It found & removed a P U P   (potentially unwanted program )    PUP.Optional.CleanMyPC

I have to note that I am totally unfamiliar with this game server or site   "ts.nebularp.com"

So, if you trust this site, then see about clicking the button to Allow this IP   on the next message window that shows the "block"

and

if you have turned off the web protection,  you can add this IP address  into the " exception " list  so that it is allowed.

See this Malwarebytes Support article    https://support.malwarebytes.com/hc/en-us/articles/360038479234

"Add to the Allow List in Malwarebytes for Windows"

Read that and study.

 

 

Malwarebytes for Windows Allow List

1. Open Malwarebytes for Windows.
2. Click the Detection History card.
3. Click the Allow List tab.
4. To add an item to the Allow List, click Add.
5. Select  /  click on Add a website

 

Add a website or IP address to your Allow List. When you add a website address, type the website with the world wide web (www.) prefix.

1. Click Allow a website.
2. Click on the text field under Add an IP Address.
3. Enter the  IP Address     104.18.47.76        in the text field.
4. Click Done to confirm your changes.

 

Once an exclusion is added to Malwarebytes for Windows, the exclusion begins to take effect immediately.

 

[tchoucky86]

Hello,

i did how u told me but still the same problem when i put web protection on and launch teamspeak it chrash my pc

wen i turn off web protection i can launch teamspeak;

I tried to put teamspeak on the allow list but still have problems.

Regards,

Antony

[Maurice Naggar]

Good morning.

I regret to hear of the Windows crash.   ( it seems that is what you describe.)

Please download MiniToolBox save it to your desktop and run it. 

Reply YES when prompted by Windows to Allow the program to run.
Reply YES when prompted by the tool to proceed.

Checkmark the following check-boxes:
 

Flush DNS
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Minidump Files

Click Go and post the result ( MTB.txt ). A copy of Result.txt will be saved in the same directory the tool is run. 
Note: When using Reset FF Proxy Settings option Firefox should be closed. 

[tchoucky86]

Hello,

ok thanks,

 

MTB.txt

[Maurice Naggar]

Hello.   Thank you for the report.   There is in the report, a few issues to follow up on.  One of those concerns the Kaspersky program.

Quote

CodeIntegrity Errors:
===================================
  Date: 2020-10-06 13:16:53.345
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 19.0.0\x64\antimalware_provider.dll that did not meet the Windows signing level requirements.
 

There are 2 things there.  Windows is having a tough time with Kaspersky.   And it appears that the Kaspersky version is out of date.

There is also the possibility that this machine has 1 or 2  too many installations of Kaspersky.   These are listed as installed.

Kaspersky Internet Security    Version: 19.0.0.1088 - Kaspersky Lab) Hidden
Kaspersky Internet Security    Version: 19.0.0.1088 - Kaspersky Lab)
Kaspersky Secure Connection   Version: 20.0.14.1085 - Kaspersky) Hidden
Kaspersky Secure Connection    Version: 20.0.14.1085 - Kaspersky)

 

I would urge you to check with Kaspersky Support about all that  & to see  whether you should have those 2 different applications  or else just one.

Let me know what they advise.

.

Use the Kaspersky program and use the option to do a check / Update run   so that this machine has the very latest version of Kaspersky Internet Security  ( if that is one to keep )

If i recall properly, the latest version is at least version 20.0x

Start ( open ) the Kaspersky application.

Look down on the first screen, look for and click on the gear icon  ( Settings )

Look for the selection / option  to check for new version.

.

There is some added factor here on the last report & in general, only for the language on this machine, French.

and overall,  on the Windows crashes I may need to refer you elsewhere.

The main charter of this sub-forum is to help on malware infections, if they are present.

.

As far as Malwarebytes for Windows,  I would suggest the following, to insure to get the very latest Beta version, which I believe will do better.

and to also make another adjustment, since this machine has Kaspersky.

[    1     ]

There is one setting in Malwarebytes that needs to be off.     The Premium  protections of Malwarebytes will still be on.
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center 
Click the " Security Tab ". Scroll down to 
"Windows Security Center"
Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".

{  OFF position is all the way to the left }

.

Then click on the " GENERAL " tab.    Scroll down to " Beta Updates "      and click that to the Right side   (  ON  ) .

Then scroll back up to the top at "Application Updates"   and click on the button " Check for Updates ".     Have patience   & follow all the prompts.

When accomplished,  click the small X  control  on the small window, or else, click the Settings icon to return to main screen of Malwarebytes.

[     2     ]

To run a Threat Scan, in Malwarebytes for Windows .... click the blue Scan button.
Have patience during the run.
When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.
Then click on Quarantine selected.   That is, if anything is tagged.

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

[tchoucky86]

Here is the scan run report .

thanks

 

scan.txt

[Maurice Naggar]

Hello.   Thanks for the report.   However, indications are that nothing was removed because you did not put a tick mark on each line detected.

The report says  

Quote

Aucune action de l'utilisateur

I would like you to do a new scan with Malwarebytes for Windows.  One of the major goals here is to have it remove all that it detects.  If it finds anything that is.
Start Malwarebytes from the Windows  Start menu.
Click Settings ( gear icon)   at the top right of Malwarebytes window.   We want to see the SETTINGS window.
Then click the Security tab.   Look for the section "Automatic Quarantine".   Be sure it is clicked On   ( to the far right side)    {  that is only if you have Premium }

Then scroll down to the section Potentially Unwanted items.   We need the next 2 lines   ( for P U P  & for P U  M)  to be set to "Always ( Recommended) ".
You can make the change by clicking on the down-arrow selection list-control.   We want all P U P  &  P U M to be marked for removal.

Next, click the small x on the Settings line   to go to the main Malwarebytes Window.
Next click the blue button marked Scan.
When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.
You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

 

[tchoucky86]

Hello,

I think i did it good.

regards,

Antony

reports.txt

[Maurice Naggar]

Hello.  Bravo.   Yes, indeed, you did well.   The  PUP.Optional.CleanMyPC   is quarantined.

Tell me, How is the situation, Have you updated the Kaspersky to the latest release ?

[tchoucky86]

Hello,

yes everything is update but still have the problem when web protection on and i launch teamspeak it make my pc crash.

regards ,

Antony 

[Maurice Naggar]

Good morning, Antony.   I hope you are doing well.
Lets give something a try.  See about specifying the Teamspeak application in the Allow list of Malwarebytes.
There are several sections in this next article.  Follow the section titled "Allow an application to connect to the Internet"
https://support.malwarebytes.com/hc/en-us/articles/360038479234-Add-to-the-Allow-List-in-Malwarebytes-for-Windows

[AdvancedSetup]

Hello @tchoucky86

Are you still with us?

Do you need further assistance?

 

 

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you