MBT says no detection found but log file generated says threats detected

[thepinkpanther]

So I am on free premium trial of mbt's latest version. Today when I scanned my laptop with MBT the scan came clean and the threat scan summary shows no Detections found. But when I checked the log file generated for this scan, it says that 1 threat is detected. The threat is related to HackTool.KMS . Now I remember last year when I scanned a lot of files related to KMS activator were quarantined by malwarebytes but why now it is showing this detection in log file but not in threat summary ? I am confused whether I have malware or not ?

Now considering this I checked my old scan log files too. Around 6 months ago in Jan, I initiated a full system scan with MBT. It ran for almost 2 days but was taking a lot of time to complete, so I canceled it after 2 days. My detection history says that during that scan 2 files were detected and quarantined. One was related to RiskWare.GameHack and another was related to Malware.AI. Again the log file for this scan tells a different story. It says that I have 4 detections. Some are related to the previous 2 that I mentioned and rest are related to Malware.Heuristic and HackTool.KMS. It is also labelling some preinstalled window game as threat. Now if I have malware(as per the log files), why MBT is not showing that in threat scan summary and quarantining it.

I am attaching both the old and new log files. Can you please look into the matter and clarify if I have some sort of malware. I am really panicking due to this. Also can you please tell how to delete these logs from here later as it might have some personal data of mine. Thanks in advance.

New_Log.txt Old_Log.txt

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

I suspect that the game detections are likely false positives, however to make certain your system is clean, please follow the instructions in this topic, skipping any steps you are unable to complete, then create a new topic in our malware removal area by clicking here and a malware removal specialist will guide you in checking and cleaning your system of any threats.

Once your system is verified to be clear of threats by a malware removal specialist, we can advise you on getting the false positives reported (again, assuming the game detections are false positives as I suspect).

Thanks

[exile360]

By the way, the logs shouldn't contain any personal info and only authorized members/groups are allowed to download attachments in this part of the forums, so your data is not at risk of being stolen by scammers etc., however we can ask one of the forum administrators to delete them for you if you wish, just let us know.

Thanks

[thepinkpanther]

Hey thanks for replying. I think you have misunderstood my issue. Actually my issue is that when I am scanning with malwarebytes, it says I have 0 threats/detections. I am adding a screenshot of same. But when I explicitly check the log file, the log file says that I have detection. If according to log file I have some sort of virus why malwarebytes is not telling it after scan completes and quarantines the threat. This way I will never know if I have some malware if I don't open the log file after every scan. The HackTool.KMS detection is present in log files of last year's scans as well. It is also present in today's scan log file. Does that mean I have some malware from years and MBT is not just detecting and quarantining it. If it is the case than I am really afraid what other malware could have been missed due to this. Now it is also not feasible to check for every log file from past 1 year.

[Porthos]

52 minutes ago, Hirdyansh said:

But when I explicitly check the log file, the log file says that I have detection.

Could you attach that log please.

[thepinkpanther]

Hey I again read the log file closely and saw that every detection has 2 fields - cleanAction and cleanResult. How exactly malwarebytes is deciding what to quarantine and what to whitelist/Ignore ? I was never asked for this explictly. So mbt must have auto decided it on some basis. For some detections cleanResult is saying successfull and for others it is saying ignored/dorQueued/whitelisted. I am really confused.

[thepinkpanther]

1 minute ago, Porthos said:

Could you attach that log please.

Hey, I have already attached 2 log files when I asked the question. Is there anything else apart from that ??

[Porthos]

16 minutes ago, Hirdyansh said:

Hey, I have already attached 2 log files when I asked the question. Is there anything else apart from that ??

The following are the logs to look at and post.

To get the log from Malwarebytes do the following:
 

• Single click on the target sight above scanner window.
• In the new window select Report
• Double click on the Scan log which shows the Date and time of the scan just performed.
• Click Export > From export you have two options:
  Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
  Export toTxt - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
   
• Please use " Copy to Clipboard " then paste the contents here in your next reply

Please double-click on one of the block entries shown in the image you posted to view the report, then click the Export link on the bottom left of the report and select Copy to clipboard, then paste the contents here in your next reply so that we may take a look and advise you based on what it shows.

Thanks

[tetonbob]

If you attach the MBAMService.log it could provide more insight. Or, better yet, run the tool as suggested by exile360 a few posts ago, and attach the archive MBST creates.

[exile360]

Here is the tool tetonbob is referring to along with instructions on how to run it if needed:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
   

Thanks

[thepinkpanther]

Hey guys please don't close this thread, I have got some emergency work. I will upload all the logs asap.

[thepinkpanther]

Hey guys, so sorry for late reply. Here I am providing all the logs that you asked for. Can you kindly look into it and tell if any issue is there and how to resolve it. Also I hope there is no sensitive data in these logs and only authorized people can view the logs. Let me know if any other information is needed. Thanks for your support.

log_file.txt mbst-grab-results.zip

[Porthos]

On 6/27/2021 at 12:29 PM, Hirdyansh said:

I am really panicking due to this.

I see many things were quarantined and you have been seeing some web sites blocked as well.

If you want to be certain that the system is clean, We do offer free assistance by trained and vetted malware removal specialists.  If you wish they can analyze your system for you and guide you in removing any threats that might be present

To work with them, simply read and follow the instructions in this topic, skipping any steps you are unable to complete, then creating a new topic in our malware removal area by clicking here and one of our malware removal specialists will assist you as soon as one is available.

[thepinkpanther]

Sorry but I don't remember seeing any website getting blocked recently. Ya but some outbound connections from uTorrent web were blocked in January this year. Are you talking about them ?

Also I am unable to understand whether I should be concerned or not. Is there anything very serious in logs ? Are there any active threats in my System ? Also the logs that I attached when I asked the question says something about HackTool.Kms. Why malwarebytes is not detecting this threat ? The logs says that mbt is automatically whitelisting it 🙄.

 

[Porthos]

6 minutes ago, Hirdyansh said:

Also I am unable to understand whether I should be concerned or not.

If you are concerned about the computer, The I would follow the instructions.

6 minutes ago, Hirdyansh said:

Is there anything very serious in logs ? Are there any active threats in my System ?

There might be but I not authorized to offer any other advice than to seek out help in the other section.

Edited July 1, 2021 by Porthos

[thepinkpanther]

And what about the blocked websites you mentioned ? Are you talking about the outbound connections from uTorrent web ?

 

[Porthos]

5 minutes ago, Hirdyansh said:

Are you talking about the outbound connections from uTorrent web ?

Very possibly so.

File sharing involves using technology that allows internet users to share files that are housed on their individual computers. Peer-to-peer (P2P) applications, such as those used to share music files, are some of the most common forms of file-sharing technology. However, P2P applications introduce security risks that may put your information or your computer in jeopardy.  Risks of File-Sharing Technology

Not going to matter much as the blocking will stop once your trial is over.

[thepinkpanther]

Okay thanks a lot for your time. I want to ask for one last favor from you. Can you please help to change my current username. Can it be changed to "thepinkpanther" or something like that. I would be really thankful to you for this favor.

[Porthos]

Just now, Hirdyansh said:

Can you please help to change my current username. Can it be changed to "thepinkpanther" or something like that.

@AdvancedSetup can do that for you.

[AdvancedSetup]

26 minutes ago, Hirdyansh said:

Okay thanks a lot for your time. I want to ask for one last favor from you. Can you please help to change my current username. Can it be changed to "thepinkpanther" or something like that. I would be really thankful to you for this favor.

The username change has been completed per request

 

[thepinkpanther]

Hey guys, sorry for a bit late reply but just a bad thought got stuck in my mind regarding the uploaded log files. I am not sure if everyone can see or download these logs? I don't really want anyone except experts and staff to see what's there in the log files. It just makes me paranoid. Will it be possible if you could remove all 4 uploaded log files in this thread ? It will flush out unnecessary burden from my head. Thanks in advanced.

[Porthos]

11 minutes ago, thepinkpanther said:

I don't really want anyone except experts and staff to see what's there in the log files.

Only you and authorized people can see the logs.

[thepinkpanther]

Ohhh, I checked for 'Windows malware removal help & support' section. All logs were public there. So I thought same goes here also. One more thing, if i upload these logs to other sections of forum where they are visible to public, could it be a problem for me ? I mean does these 4 logs carry any private info that later can prove problematic for me if gone in wrong hands ?

[Porthos]

Just now, thepinkpanther said:

I mean does these 4 logs carry any private info that later can prove problematic for me if gone in wrong hands ?

Nothing in the logs can harm you.