Malwarebytes Privacy ruined my NAS

[Willer]

Hi,

Operating environment: Win10 Pro x64, server Fritz!Box 7490, USB-Stick 16GB attached as NAS to server fritz!box.

I installed Malwarebytes Privacy and gave it a try by connecting to some websites. Then I turned privacy off and deinstalled Malwarebytes Privacy using IOBit Uninstaller.

Results:

The server (fritz.box) and the NAS (USB-Stick attached to the server) did not show-up anymore in Windows Explorer as before.

I inserted the USB-Stick into the Windows machine

Windows said the USB-Stick is corrupt offered a repair what I did.

Afterwards the NAS was corrupt. Some files were lost and a dozend new files with cryptic names showed-up which could not be moved or deleted the usual way.

Kind regards

Willer

 

[exile360]

Greetings,

It is possible that something went wrong with the uninstall when iOBit Uninstaller was forcefully removing the software, though I'm not sure how it or Malwarebytes Privacy could possibly corrupt a USB drive since neither should be touching it.

[Willer]

Thanks exile360 for the fast response. That's why I mentioned the uninstall methode.

However, so far I never experienced a problem of this kind with IOBit Uninstaller.

Kind regards

Willer

 

[exile360]

Yes, it's a strange issue to be sure.  Would you mind working with one of our specialists to try and diagnose the system to hopefully determine exactly what happened, if possible?  I don't know if it was caused by Privacy directly, indirectly, or just happened by coincidence, but I am certain the Developers would want to know if there is some sort of underlying issue with the software that may have lead to this.

If you are willing to do so, please do the following to provide diagnostic logs:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
   

Alternatively, you may contact Malwarebytes Support directly via the web form on this page to work with them directly via email, but either way I will be sure to document your experience for the Product team so that they may try to replicate the issue and investigate further.

Thanks

[Willer]

Hi,

I followed your advice and I attach file mbst-grab-results.zip to this post.

Kind regards

Willer

 

mbst-grab-results.zip

[exile360]

Thanks, the logs show quite a few pending file rename operations, which are items waiting to be replaced or removed on the next system reboot, including some items for Malwarebytes Privacy, IOBit, Firefox, Paragon and some Windows entries as well.  Please restart the system to allow those items to be processed.

Additionally, it looks like FRST, which is used by the Malwarebytes Support Tool when gathering logs, didn't run for some reason.  This can happen if the Support Tool is unable to reach the web to download it or if it times out trying to do so.  Please run FRST as indicated below and attach the 2 logs it creates:

Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.

You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to the disclaimer.
• Press the Scan button.

• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've run it before it may not and you may need to select it manually
• Please attach both logs to your reply

Thanks

[Willer]

Thanks for the response.

I followed your advice and I attach files

- Addition.txt

- FRST.txt

to this post.

Kind regards

Willer

 

Addition.txt FRST.txt

[exile360]

Thanks.  Your logs show both Wise and CCleaner on the system; two more factors that could complicate things.  I don't know how you're using the two programs, but I strongly recommend against any kind of registry cleaning as it can definitely have unforeseen consequences.

I passed your thread on to the Product team, so if there is some kind of bug or issue, hopefully they will be able to fix it, but at this point I'm not sure what more to do as it may have simply been a one-off.

How are things running now?  Are you experiencing any further issues with your NAS?

[exile360]

By the way, one more thing worth noting.  Just based on my own personal experience over the years, I've never allowed Windows to repair a drive when it alerted me that a drive I plugged in was or might be corrupted because like you, I had a drive actually get corrupted by doing so, and I've found that in every instance, the contents of the drive were perfectly fine without performing any repair.  I suspect that Windows has a function that alerts the user any time a drive is removed without using the 'Safely remove hardware' function to remove a removable drive.

Because of this, I would suggest first trying to browse the contents of the drive before allowing Windows to perform any repairs to see if it is even needed, as it may not be.

Obviously there is no way to know at this point whether the drive's contents were actually corrupted prior to allowing Windows to try and repair the drive, but it is possible, again, just based on my own personal experience with every version of Windows I've used since XP.

[Willer]

Thanks for your advice and for your thoughts on Wise and CCleaner. I know about the warnings but I have used both software for years with no bad experiences.

I have checked the NAS and found no corrupt files. I have deleted those new files with cryptic names. No problems so far.

Recap: After using the VPN, the NAS was not accessible any more and Windows asked for a repair. After the repair by Windows the NAS could be accessed again. Afterwards the NAS contained the original files (I can't remember all) and a bunch of new files with cryptic names.

Thank you very much for your most helpful hints.

Kind regards

Willer

 

 

[Porthos]

11 minutes ago, Willer said:

Thanks for your advice and for your thoughts on Wise and CCleaner. I know about the warnings but I have used both software for years with no bad experiences.

Windows 10 is a different animal when it comes to "optimizing/cleaning" software. Win 10 does not need them and especially any software that cleans or optimizes the registry.

[exile360]

30 minutes ago, Willer said:

Recap: After using the VPN, the NAS was not accessible any more and Windows asked for a repair. After the repair by Windows the NAS could be accessed again. Afterwards the NAS contained the original files (I can't remember all) and a bunch of new files with cryptic names.

I suspect the new files were either previously hidden files on the drive, or just miscellaneous data that Windows recovered when trying to repair the drive (i.e., most likely the remnants of previously deleted files/data).  As I mentioned previously, I would definitely recommend not allowing Windows to repair any removable drive when it offers to like that as I've personally had nothing but bad experiences with it any time I've allowed it across various Windows versions.  In my experience, even when Windows displays that alert, the drive is perfectly fine and the drive and its files can be accessed once the warning is dismissed and the option to have Windows repair the drive is opted out of.

Again, that's just my personal experience though.

Either way, the root cause seems to be that at some point during the uninstall, the drive was removed from the system, likely while it was still locked/in use by one or more processes on the system (possibly the result of whatever method was used by IOBit's uninstaller, but at this point I don't think there's any way to know for certain), which resulted in Windows marking the drive as potentially damaged/corrupted since it knew the same drive had been previously detached from the system without using the 'safely remove hardware' method, which can potentially lead to corrupt data if the drive is actually in use with data being written to it at the time that it is forcibly removed from the system.

More often than not, if you aren't actually writing any data to the drive, and none of the software on your system is either, then removing a drive in such a manner shouldn't really cause any issues, though Windows will often still indicate that the drive might be damaged/corrupt and be in need of repair (I believe it is quite similar to how it marks a drive for running CHKDSK on startup automatically under certain conditions, even when the drive is actually perfectly fine).

[Willer]

@Porthos:

Thanks for your comment. Indeed, I have used cleaning/optimizing tools rarely on Windows 10 systems because there was no neeed to. I used these tools more often on earlier Windows systems.

@exile360:

The NAS was not removed/attached during the whole exercise. It was removed only after it was not recognized by the server anymore.

Kind regards

Willer

 

[exile360]

4 hours ago, Willer said:

The NAS was not removed/attached during the whole exercise. It was removed only after it was not recognized by the server anymore.

I know; I meant removed as in disconnected through the driver/software, not physically disconnected.  Basically, Windows thought that the device had been physically disconnected abruptly during the uninstall even though it was physically plugged in the entire time.  This likely occurred as a result of something done forcibly/manually by the uninstaller in an effort to perform a full/clean uninstall of Malwarebytes Privacy.

[Willer]

OK, well understood ...