Windows Defender blocking Malwarebytes and Support tool download / install

[drewdoesit]

Hey folks,

I went to install Malwarebytes today and my windows defender keeps blocking it. I use norton360 (part of a promotion with lifelock) and Windows Defender isn't even enabled. If I am able to run the installer it's automatically closed out....

I have tried different browsers and rebooting my machine with no luck. 

[drewdoesit]

29 minutes ago, drewdoesit said:

Hey folks,

I went to install Malwarebytes today and my windows defender keeps blocking it. I use norton360 (part of a promotion with lifelock) and Windows Defender isn't even enabled. If I am able to run the installer it's automatically closed out....

I have tried different browsers and rebooting my machine with no luck. 

For some additional context this is a personal machine and I am the only admin. Again Windows Defender is disabled....

[Maurice Naggar]

Hello @drewdoesit   

It seems to me that Norton360 is preventing the use of either the Malwarebytes Support tool or the Malwarebytes stub installer file.  The act of installing the Norton360 would turn off Microsoft Defender from being the resident antivirus.  The resident A-V is in fact Norton360.   You may wind up having to turn off Norton ( temporarily) before attempting install of Malwarebytes.

1. Download the offline Malwarebytes for Windows installer from here
2. Now, go to where the file was saved.     Right-click on the mb4-consumer-4.4.3.225.....exe and select Run as Administrator and allow it to go forward.
3. After the Malwarebytes for Windows is done with the setup.
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center 
Click the Security Tab. Scroll down to 
"Windows Security Center"
Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".

all the way to the Left for Off setting.
Close Malwarebytes when done.   This setting adjustment does not affect the Trial-mode protections of Malwarebytes.

[drewdoesit]

Nope same thing, it runs through the installer and then force closes the application and deletes the download with the same message. 

 

 

[Maurice Naggar]

Regret to hear that.  Let us just get a report.  This does not make any changes.

Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.

You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to the disclaimer.
• Be sure to TICK the box marked "Addition.txt   like shown below.
• Press the Scan button.

 

 

• Press the Scan button.

 

(Note: you may receive a warning that running this program may be detrimental to your system. FRST is a specialized tool so it does not contain the signatures of a commercially available product, hence the warning. You should have the option to run anyway, it's perfectly safe to use > click the 'More info' link, then select 'Run anyway')

 

 

• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've run it before it may not and you may need to select it manually
• Please attach both logs to your reply 
• To save attachments please click the link as shown below. Then browse to where your file is located and select it and click the Open button.

Edited July 23, 2021 by Maurice Naggar

[drewdoesit]

See attached.

FRST.txt Addition.txt

[Maurice Naggar]

Thank you, Drew.   Let us start out with these steps.

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[   2    ]

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

 

Let me know the result of this.    This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

C:\Windows\debug\msert.log

Please attach that log with your reply.

[drewdoesit]

See attached. 

msert.log

[Maurice Naggar]

Hello.  Good morning.

The custom script on this post is ONLY for this machine and NO other.   

This script is intended to do a few things.

1. Run Windows System File Checker & DISM tool to check the integrity of this Windows.
2. Adjust Microsoft Defender to see to it it does not "automatically start".  This system has Norton & so MS Defender should be inactive.
3. Remove around a dozen drivers that do not belong here.
4. Rebuild the Windows Winsock.

Please Close / Exit any open work files   ( if you have any ongoing at this point).   Save any work.  Exit out of other open apps that you yourself started at this session.

This procedure will involve a Restart at the end of the run.

Save this scrpt file named FIXLIST.txt  to  Downloads folder.

Fixlist.txt

 

Using File Explorer, go to   Downloads folder

• RIGHT click on  FRST64.exe   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run the tool. 
• If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.

 

• IF you get a block message from Windows about this tool......

click line More info information on that screen

and click button Run anyway on next screen.

 

Click on FIX button.

 

 You will see a green progress bar start. 

If you receive a message that a reboot is required, please make sure you allow it to restart normally.

 

The tool will complete its run after restart.

When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

 

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

There will be more to do after this, so please, stick with me  and as much as possible, stay current with this thread.  Hopefully on next round, I can guide you to a new Malwarebytes install. I did see where on afternoon of the 23rd that MS Defender stopped a Malwarebytes driver.

I will get back with you as I have the opportunity.  Kindly remember I am a volunteer here.

[drewdoesit]

Hey Maurice,

First off I wanted to say thank you for being so responsive. I really appreicate all the help. Please see the attached requested logs. 

Thanks! 

Fixlog.txt

[Maurice Naggar]

OK.  Good run.  The custom script has done as intended.  And the Windows System File Checker made corrections.

Now, let us just get a new fresh report from FRST64   ( on Downloads folder).

• Double-click on FRST64  to start it. When the tool opens click Yes to the disclaimer.
• Be sure to TICK the box marked "Addition.txt   like shown below.
• Press the Scan button.

 

 

• Press the Scan button.

 

(Note: you may receive a warning that running this program may be detrimental to your system. FRST is a specialized tool so it does not contain the signatures of a commercially available product, hence the warning. You should have the option to run anyway, it's perfectly safe to use > click the 'More info' link, then select 'Run anyway')

 

 

• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've run it before it may not and you may need to select it manually
• Please attach both logs to your reply 
• To save attachments please click the link as shown below. Then browse to where your file is located and select it and click the Open button.

[drewdoesit]

See attached :) 

Addition.txt FRST.txt

[Maurice Naggar]

Thank you for those new FRST reports.  Now we will do a new custom-script-fix.  The aim here is to pre-empt MS Defender from tagging Malwarebytes as "unwanted application".  That is, to help prevent what it had done to mess-up the run to install Malwarebytes.  It is really quite a big surprise to see it do that.

I am cusrious as to whether ( perhaps ) this machine is part of a business or organization setup.

The custom script on this post is ONLY for this machine and NO other.   

Delete the old Fixlist.txt  on Downloads  that is there from before.

 

Then, Please Close / Exit any open work files   ( if you have any ongoing at this point).   Save any work.  Exit out of other open apps that you yourself started at this session.

This procedure will involve a Restart at the end of the run.

Save this scrpt file named FIXLIST.txt  to  Downloads folder.

 

Fixlist.txt

Using File Explorer, go to   Downloads folder

• RIGHT click on  FRST64.exe   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run the tool. 
• If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.

 

• IF you get a block message from Windows about this tool......

click line More info information on that screen

and click button Run anyway on next screen.

 

Click on FIX button.

 

 You will see a green progress bar start. 

If you receive a message that a reboot is required, please make sure you allow it to restart normally.

 

The tool will complete its run after restart.

When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

 

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

There will be more to do after this, so please, stick with me

[drewdoesit]

See attached. 

Fixlog.txt

[Maurice Naggar]

Thanks for the report.  It seems that Microsoft Defender antivirus is all ON.  Is Norton 360 Antiirus also ON ?   Can you check on that ?  Is Norton a paid-for subscription ?

You need to deicde which of the two antivirus you prefer to have on & active   .....before we go forward.   If you prefer to keep Norton then I can guide you to turning off the MS Defender. 

On the other hand, if Norton is a trial  ( not paid for) then perhaps you may want to uninstall Norton.

As part of your research, go into Windows' Settings >> Virus & Threat Protection.

[drewdoesit]

Yeah this is what I was saying at the start. I get Norton through LifeLock so it's what I would like to continue using (unless you have other recommendations). From what I can see defender is turned off which is why I'm confused how this issue is happening at all.....

[Maurice Naggar]

Hello.  I am sending a new script to turn off the real-time protection aspects of Microsoft Defender.   Remember, this machine has Norton antivirus.

The custom script on this post is ONLY for this machine and NO other.   

Delete the old Fixlist.txt  on Downloads  that is there from before.

 

Then, Please Close / Exit any open work files   ( if you have any ongoing at this point).   Save any work.  Exit out of other open apps that you yourself started at this session.

This procedure will involve a Restart at the end of the run.

Save this scrpt file named FIXLIST.txt  to  Downloads folder.

Fixlist.txt

 

 

Using File Explorer, go to   Downloads folder

• RIGHT click on  FRST64.exe   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run the tool. 
• If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.

 

• IF you get a block message from Windows about this tool......

click line More info information on that screen

and click button Run anyway on next screen.

 

Click on FIX button.

 

 You will see a green progress bar start. 

If you receive a message that a reboot is required, please make sure you allow it to restart normally.

 

The tool will complete its run after restart.

When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

 

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

.

Ar this point here, when this last script is done & system is Restarted, you should now do a new installation of Malwarebytes for Windows.

That was outlined on my reply at this link.

 

[drewdoesit]

Ran the fix and restarted. Attempted to download and install MWB and I was greeted with the same message.

Fixlog.txt

[Maurice Naggar]

Is this a normal person / home system ?  or is this like a business / organization related machine ?   How did this machine get the Advanced Threat Protection enabled in Defender ?

Also, just which browser did you use when doing the download ?

and what folder did you save the EXE installer ?

I will most likely need for you to put this machine into Safe mode with Networking just to do a new download & install.

[drewdoesit]

This is a personal machine that WAS used for contracting with Microsoft. I have since left all workgroups and removed all accounts / authentication. 

Downloaded using Edge and the file went into my downloads folder. 

[Maurice Naggar]

I will want you to try to use a different web browser.   Plus see if at all possible, to save the download to a flash-thumb-USB drive   ( in the hope of getting around the blockage )  and ideally do the download on a different machine   ( other than this one with the issue).

Before I have you attempt another install, I am going to be looking for some additional ways to fully turn off MS Defender.

Tell me, if you get iinto the Virus and Threat protection GUI section, are you able to see all "prior" threats blocked by Defender ?  I mean on-screen.

[drewdoesit]

This is what I see. 

[Maurice Naggar]

On the Virus & Threat Protection screen.   Do you see a section "Virus & Threat protection settings"   with a blue line "Manage settings"

[drewdoesit]

Nope this is what I see. 

[Maurice Naggar]

Look again at your earlier screen grab of Protection history.

and the one line all recent items   and "filter"  on the right side.

 

1. Open Windows Security.
2. Select Virus & threat protection and then click Protection history.
3. In the list of all recent items,  click the FILTERS  down chevron.
4. filter on Quarantined Items.
5. Select an item you want to keep, and take an action, such as restore.   I would like to see if you can RESTORE back the Malwarebytes installer file.