JoshuaWillman Posted August 19, 2021 ID:1475727 Share Posted August 19, 2021 Just for the heck of it, I decided to test if my web protection was working. I went to the test site http://iptest.malwarebytes.com/ and much to my surprise it didn't block the site as it should. Web Protection is turned on as well as all the protection layers. I enabled the Malwarebytes Browser Guard extension and it blocks the site 100% of the time. Obviously, Malwarebytes Premium should be blocking this. Since I first noticed this, I've tested it and will get different results. Sometimes Malwarebytes WILL block the site and I'll get the message and pop up notification that the site has been blocked, sometimes the pop up notification will appear, but I'll still be allowed to reach the site with the words "IF YOU ARE ABLE TO REACH THIS PAGE IT MEANS THAT IP PROTECTION IS DISABLED ON YOUR MACHINE and sometimes it won't do a thing and I'll get that same message This is a fairly new computer. I got it in May and installed Malwarebytes immediately. I have no way of knowing how long this problem has existed as it was just a fluke that I decided to test it a couple of days ago. Could there have been a problem with the initial installation? I have Windows Defender on my computer also. Malwarebytes is not registered in the Windows Security Center so that I can run both. I also took the measure of adding the exclusions that Malwarebytes suggests to Windows Defender to make sure there would be no conflicts. Link to post Share on other sites More sharing options...
Staff Malwarebytes Posted August 19, 2021 Staff ID:1475728 Share Posted August 19, 2021 ***This is an automated reply*** Hi, Thanks for posting in the Malwarebytes for Windows Help forum. If you are having technical issues with our Windows product, please do the following: Malwarebytes Support Tool - Advanced Options This feature is designed for the following reasons: For use when you are on the forums and need to provide logs for assistance For use when you don't need or want to create a ticket with Malwarebytes For use when you want to perform local troubleshooting on your own How to use the Advanced Options: Spoiler Download Malwarebytes Support Tool Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next Navigate to the Advanced tab The Advanced menu page contains four categories: Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand. Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot. Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent. Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program. To provide logs for review click the Gather Logs button Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop Please attach the file in your next reply. To uninstall all Malwarebytes Products, click the Clean button. Click the Yes button to proceed. Save all your work and click OK when you are ready to reboot. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows. Select Yes to install Malwarebytes. Malwarebytes for Windows will open once the installation completes successfully. Screenshots: Spoiler Spoiler If you are having licensing issues, please do the following: Spoiler For any of these issues: Renewals Refunds (including double billing) Cancellations Update Billing Info Multiple Transactions Consumer Purchases Transaction Receipt Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help If you need help looking up your license details, please head here: Find my premium license key Thanks in advance for your patience. -The Malwarebytes Forum Team Link to post Share on other sites More sharing options...
Porthos Posted August 19, 2021 ID:1475729 Share Posted August 19, 2021 4 minutes ago, JoshuaWillman said: This is a fairly new computer. Please do the following so that we may take a closer look at your installation for troubleshooting: NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply Thanks Link to post Share on other sites More sharing options...
JoshuaWillman Posted August 19, 2021 Author ID:1475730 Share Posted August 19, 2021 mbst-grab-results.zipThanks! Link to post Share on other sites More sharing options...
Porthos Posted August 19, 2021 ID:1475732 Share Posted August 19, 2021 Please do the following Uninstall and reinstall using the Malwarebytes Support Tool Please close all browsers and programs before running the tool. Right click and quit MB from the system tray as well. Link to post Share on other sites More sharing options...
JoshuaWillman Posted August 19, 2021 Author ID:1475737 Share Posted August 19, 2021 Thanks for your help. Everything went smoothly as far as the uninstall and reinstall. One thing I did notice is that I was never prompted to reboot. I don't know if that is important. Unfortunately, it did not seem to resolve the problem. When I try to access the test page, the pop up notification that the site was blocked due to a trojan did show up, but I was still allowed to reach the page. On a 2nd attempt even the pop did not appear. :( Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 20, 2021 Root Admin ID:1475888 Share Posted August 20, 2021 You should see the following Without Malwarebytes Browser Guard installed and using the Premium version of Malwarebytes you should see this from the program on that link. If you do have Malwarebytes Browser Guard installed it should look something like this Link to post Share on other sites More sharing options...
JoshuaWillman Posted August 20, 2021 Author ID:1475927 Share Posted August 20, 2021 6 hours ago, AdvancedSetup said: You should see the following Without Malwarebytes Browser Guard installed and using the Premium version of Malwarebytes you should see this from the program on that link. If you do have Malwarebytes Browser Guard installed it should look something like this Thanks for the help! With the Browser Guard extension enabled it blocks that link 100% of the time. With it not enabled, the results are not consistent using Malwarebytes Premium. Sometimes it will block the site as it should. I will get the notification popup that the website was blocked due to a trojan AND the screen which also says the link has been blocked with the "strongly recommended that you not continue" message. Other times, I will get the popup that the site has been blocked due to a trojan, but it will still allow me to get to the site where I see the "IF YOU ARE ABLE TO REACH THIS PAGE IT MEANS THAT IP PROTECTION IS DISABLED ON YOUR MACHINE" message. Finally, sometimes I will just be allowed to reach that page and get no notification at all. I just see the "IF YOU ARE ABLE TO REACH THIS PAGE" message Malwarebytes is doing it's scheduled scan as it should and updating. I did a full customized scan yesterday which took over an hour. I did a full Windows Defender scan and a pre-boot scan and I've used many reputable online scanners which were suggested to me by my techie brother in law and set them to scan EVERYTHING. No "nasty" is showing up and my computer shows absolutely no signs of any malware or virus This morning, I again tested that link and both times Malwarebytes Premium has performed as it should and blocked it. However, this has happened before and then it resorts to not blocking it again. I will continue to periodically test it today, but if you have any other advice of course would be appreciated. Thanks again!! Link to post Share on other sites More sharing options...
JoshuaWillman Posted August 20, 2021 Author ID:1475928 Share Posted August 20, 2021 I would also like to add that the Malwarebytes Browser Guard is something that I only recently began to use intermittently. I've just been testing it to see if it's something that I like and would be to my benefit. Is there ANY chance that by using it, it has somehow "overwritten" Malwarebytes Premium website protection, or caused some kind of conflict? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 20, 2021 Root Admin ID:1475961 Share Posted August 20, 2021 No, Browser Guard is fairly linked to the main product now. There are many factors that come into play when using the test site as there is network caching and firewall functionality that is in play here. Now that you've done a reinstall please run the MBST support tool and gather new logs and I will review them and see if anything obvious stands out that might be causing you an issue. Thank you @JoshuaWillman Link to post Share on other sites More sharing options...
JoshuaWillman Posted August 20, 2021 Author ID:1475975 Share Posted August 20, 2021 Here you go and thanks! mbst-grab-results.zip Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 20, 2021 Root Admin ID:1475983 Share Posted August 20, 2021 I see you've been playing with some test files and possibly one that isn't a test file. I'd like to do some general clean up to see if that helps based on some of the events shown in your logs. Windows Defender:================ Date: 2021-08-18 10:58:31 Description: C:\Users\SteveTrolman\AppData\Local\Temp\HouseCall\housecall.bin has been blocked from modifying %program_files%\Google\Drive\ by Controlled Folder Access. Detection time: 2021-08-18T14:58:31.203Z Path: %program_files%\Google\Drive\ Process Name: C:\Users\SteveTrolman\AppData\Local\Temp\HouseCall\housecall.bin Security intelligence Version: 1.345.741.0 Engine Version: 1.1.18400.4 Product Version: 4.18.2107.4 Date: 2021-08-18 04:47:03 Description: Microsoft Defender Antivirus has detected malware or other potentially unwanted software. For more information please see the following:https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Clengtst.A!plock&threatid=2147711455&enterprise=0 Name: Trojan:Win32/Clengtst.A!plock Severity: Severe Category: Trojan Path: file:_C:\Users\SteveTrolman\Downloads\validatecloud.exe; webfile:_C:\Users\SteveTrolman\Downloads\validatecloud.exe|https://wdtestgroundstorage.blob.core.windows.net/public/validate/validatecloud.exe|pid:2160,ProcessStart:132737500225999710 Detection Origin: Internet Detection Type: FastPath Detection Source: Downloads and attachments Process Name: Unknown Security intelligence Version: AV: 1.345.741.0, AS: 1.345.741.0, NIS: 1.345.741.0 Engine Version: AM: 1.1.18400.4, NIS: 1.1.18400.4 Date: 2021-08-18 04:46:03 Description: Microsoft Defender Antivirus has detected malware or other potentially unwanted software. For more information please see the following:https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0 Name: Virus:DOS/EICAR_Test_File Severity: Severe Category: Virus Path: file:_C:\Users\SteveTrolman\Downloads\eicar.com; webfile:_C:\Users\SteveTrolman\Downloads\eicar.com|https://amtso.eicar.org/eicar.com|pid:6664,ProcessStart:132737499626554667 Detection Origin: Internet Detection Type: Concrete Detection Source: Downloads and attachments Process Name: Unknown Security intelligence Version: AV: 1.345.741.0, AS: 1.345.741.0, NIS: 1.345.741.0 Engine Version: AM: 1.1.18400.4, NIS: 1.1.18400.4 Date: 2021-08-17 04:43:11 Description: Microsoft Defender Antivirus scan has been stopped before completion. Scan Type: Antimalware Scan Parameters: Quick Scan It's also possible that due to how SUPERAntiSpyware also accesses the underlying API for the Firewall that maybe it too is trying to look at this at the same time and might cause a conflict. (no proof at this point that is an issue though) Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work. Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more. NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords. NOTE-3: As part of this it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix. The following directories are emptied: Windows Temp Users Temp folders Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Flash Player cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. fixlist.txt Thanks Link to post Share on other sites More sharing options...
JoshuaWillman Posted August 20, 2021 Author ID:1475993 Share Posted August 20, 2021 Thank you for all your help. Since early this morning, I have tested that site numerous times and Malwarebytes has behaved as it should. Why it should start working correctly all of a sudden I have no idea, but since I first noticed the problem it has never gone this long and continued to perform correctly. Eventually, it has always begun to misbehave again I value your advice and recommendations and will continue to test it today and over the next few days. If the problem should occur again I will follow your instructions above. I'm just reluctant to get into something rather "deep" while it is working correctly, even if I can't explain why it might possibly have been "fixed" without me doing anything I do appreciate your time and effort and I will update here at weekends end on whether the problem seems to be solved or whether I have gone ahead with your recommendations Thanks!! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 20, 2021 Root Admin ID:1475996 Share Posted August 20, 2021 Absolutely, you're welcome and glad it is working as intending Take care and have a great weekend Stay safe out there Cheers Link to post Share on other sites More sharing options...
JoshuaWillman Posted August 23, 2021 Author ID:1476322 Share Posted August 23, 2021 After repeated testing all weekend, Malwarebytes is performing as it should and hasn't missed a needed block of the test site and appears to be working fine in every other area too. Why it was failing for a few days is anybody's guess. I've learned that sometimes there are easy answers to computer issues, sometimes hard and sometimes things just go wrong and solve themselves in the mysterious nature of computers. I consider the issue closed. Thanks to everyone who offered help!! 1 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 23, 2021 Root Admin ID:1476382 Share Posted August 23, 2021 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts