Advanced Exploit Protection

[Ven0m]

Hi. In my Advanced Exploit Protection settings some things in there keeps unchecking itself after some time AFTER ive done a "Restore Defaults" Restore defaults makes a check mark in them but those checkmarks gets unchecked after some time, what is going on? 

[Porthos]

34 minutes ago, Ven0m said:

Hi. In my Advanced Exploit Protection settings some things in there keeps unchecking itself after some time AFTER ive done a "Restore Defaults" Restore defaults makes a check mark in them but those checkmarks gets unchecked after some time, what is going on? 

You should not be making ANY changes in that setting on your own period. It needs to stay at default settings.

[Ven0m]

Thanks for the reply. Sorry but as i said in my post. Its on default! When default is clicked on, some of the things in there gets a checkmark, then after some time the checkmarks unchecks itself, so its not going by your softwares default setting and it changes itself to something other than default. So how come? 

[Porthos]

3 minutes ago, Ven0m said:

checkmarks unchecks itself, so its not going by your softwares default setting and it changes itself to something other than default. So how come? 

Changes can be pushed thru updates when needed.

4 minutes ago, Ven0m said:

When default is clicked on, some of the things in there gets a checkmark, then after some time the checkmarks unchecks itself

Which settings. A screenshot of those settings would be helpful.

[Ven0m]

Before and after i click Restore Default settings. You can see what checkmarks gets unchecked after a while, when i press default i checks some of them. those in the picture that has it unchecked is when i restart the pc or after some time when im using my pc without any updates to malwarebytes its just unchecks those i dont know why

[Porthos]

these are the current default settings.

8 minutes ago, Ven0m said:

without any updates to malwarebytes

Malwarebytes does auto updates in the background about every 4 hours.

 

[Ven0m]

Thanks. But how come when i click default it makes check marks into those if the default is as in that picture you replied to? 

[Porthos]

5 minutes ago, Ven0m said:

Thanks. But how come when i click default it makes check marks into those if the default is as in that picture you replied to? 

Lets use the support tool and do a clean uninstall and reinstall.

Download the Malwarebytes Support Tool.

 

Please close all browsers and programs before running the tool. Right click and quit MB from the system tray also.

Once done it will attempt to reinstall both Malwarebytes and Privacy VPN.

Please say no and close the X button on the top right for Privacy if you do not use it..

Edited April 20, 2022 by Porthos

[bjm]

btw ~
I see the same before and after boxes as OP posted here. 
I see "after" check'd boxes - uncheck'd after machine restart. 

[Ven0m]

I really don't want to reinstall because i have to do all the setting again with allow list and so on, really tedious, so are you able to answer my question why it does what it does, does it seem like something is wrong?

[Porthos]

1 minute ago, Ven0m said:

does it seem like something is wrong?

That is why I recommended the clean install.

3 minutes ago, Ven0m said:

i have to do all the setting again with allow list and so on

What all is in the allow list. Most never have to allow anything.

[Ven0m]

Ok did a clean install as you said, did not change the fact that when i press restore to default it checks those boxes as before. 

[Firefox]

When you do a clean install, it will already have all defaults, no need to go click on "restore to defaults"....

I am not sure you have provided the requested logs, it may help to see what is going on.
 

o begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

[Ven0m]

Sure. But still if you click on default then it should not change and do check marks into those boxes. It should just do nothing. 

mbst-grab-results.zip

[AdvancedSetup]

2022-04-20 23:33:03.661   --------LOGGING STARTED----------
2022-04-20 23:33:03.661   NetWkstaGetInfo OS Version Check passed
2022-04-20 23:33:06.541   Failed to get status code: 2022-04-20 23:33:06.541   Network connection failed, status code: 417.
2022-04-20 23:33:06.837   --------END OF LOG FILE----------

 

If Malwarebytes has trouble connecting to our licensing server it will make some changes and at some point if it goes on too long without a connection it will put it into Free mode.

 

 

 

Please do the following so that we can get started and see what's going on.

The Farbar Recovery Scan Tool is a free Windows utility designed to create troubleshooting logs for your computer. These logs help our Support team to identify and resolve issues with your computer.

There are two versions of the Farbar Recovery Scan Tool available for download: 32-bit and 64-bit.
To find which operating system is installed on your computer, refer to Microsoft's article: 32-bit and 64-bit Windows: Frequently asked questions

Download and launch Farbar Recovery Scan Tool

1. Download the Farbar Recovery Scan Tool
   Do not click on any Ads.
    
2. Locate the file you downloaded on your computer.
   Downloaded files are often saved to the Downloads folder.
    
3. Double-click the downloaded file to run the Farbar Recovery Scan Tool.
   
   
    
4. A Windows protected your PC notification may appear. This notification is from the Windows Defender SmartScreen Filter which prevents unfamiliar apps from running on your PC.
   Disable smart screen ONLY if it interferes with software we may have to use:  What is SmartScreen and how can it help protect me?
   
        a.  Click More info.
   
   
        b.  Click Run anyway.
   
   
5. When the User Account Control window appears, click Yes.
   
   
   
    
6. To accept the Disclaimer of warranty, click Yes.
   
   
   
    
7. Ensure only the boxes listed below are checked
   
   

   Registry  Services  Drivers
   Processes  Internet  One month
   Addition.txt
   
   
   
    

8. Disable any Antivirus software you have installed ONLY if it stops software we may use from working.
   Please remember to re-enable any Antivirus software when we are finished running scans
   
   Click Scan. The scan may take a few minutes to complete.
   
   
    

9. When the scan completes, Farbar Recovery Scan Tool shows two messages:

• Scan completed. FRST.txt is saved in the same directory FRST is located.
  
  

• Addition.txt is saved in the same directory FRST is located.
  
  
   

• Click OK to close each message window

 

Please attach both of those logs on your next reply, DO NOT copy/paste the contents of the logs directly

 

 

Thanks

 

 

[Ven0m]

Ok thanks. I disabled some services that i dont need ive did google what i could disable, and its ok to disable them, im saying this if you see some of them disabled, so you know. 

Addition.txt FRST.txt

[Ven0m]

Something I discovered was that license server did not work because of my VPN being active, when i disabled vpn the update and license worked. But now when i check license tab i see how many days before renewal but my license key is missing there, before i reinstalled i could at least see the license key, don't know what happened. 

[Ven0m]

Oh now i can see the license key even with vpn and it doesn't tell me that it could not contact the license server even with vpn on, strange. 

[Ven0m]

Oh no! Now its even worse! Now tamper protection and password and some more settings all revert to not activated after i activate them! Wth is going on? Does someone have access to my pc? 

[Ven0m]

Why cant i edit my posts, i have to post new ones all the time. Anyway Tamper and my password and brute force, enable early start module, all of those gets disabled now all the sudden while before it did not happen, with me doing nothing other than enabling those and they should stay enabled not revert! Its exactly as if someone is doing it remotely. Its even worse now than before.  

[AdvancedSetup]

Between the following programs, its very possible that one of them or all of them are helping to cause you more issues then there needs to be.

1. Disabling services (okay, but at that point one should know computers better than most, otherwise a total waste of time)

2. Norton 360 (fully capable of stopping, preventing, or interfering with normal operations of the computer. Make sure any exclusions between other security programs are in place)

3. Zemana AntiLogger (another program capable of stopping, preventing, or interfering with normal operations of the computer. Make sure any exclusions between other security programs are in place)

4. Modified hosts file (more trouble than its worth in most cases especially for users that add, remove entries on their own if they don't understand exactly how and why it works)

 

I would setup exclusions for all programs involved.

 

I'm sorry but I'm not going to spend dozens of hours playing guessing games as to why or what is causing issues. If you want to run Windows in a nonstandard method then you need to invest the time in making things work how you want them to work.

Malwarebytes for Windows antivirus exclusions list
https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list

 

https://www.lifewire.com/exclude-files-from-norton-antivirus-scans-153348

 

 

 

Your DNS Servers: 83.255.255.1 - 83.255.255.2

Please consider changing your default DNS Server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

• Google Public DNS: IPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
• Cloudflare: IPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
• OpenDNS: IPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
• DNSWATCH: IPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b

The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

 

 

 

[Ven0m]

Hi thanks for the help. I already done that, i mean setting up exclusions on all antivirus software so they don't fight each other. So its not that. So my FRST logs were ok? There were no issues at all before reinstall about those protections that i set that revert, i only had what my topic was about only. But now its even worse, it keeps reverting important security settings. If you click default in exploit protection, does the software check those parts as mine do? It would be great if you could do what i did just to see if it does the same. 

[AdvancedSetup]

Again, you have altered how Windows works. You have added other security products along with Malwarebytes. You have random and periodic network issues, which I have already said above will cause our program to make some changes up to and including returning the product back to the Free state if it spends too much time not being able to connect with our license server.

You can try doing a Clean Removal and Reinstall and see if that makes any difference. You could also try adding the following entry to the Registry to set the IPV4 as the default instead of IPV6

 

Please try the following. Open an Elevated Admin command prompt and copy / paste the following and press the Enter key. You should get a success message.

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d 32 /f

Then restart the computer and try activating the program again.

This will set the IP preference to use IPV4 instead of IPV6 as recommended by Microsoft without actually disabling IPV6

 

If still having an issue, then download the following installer.

MB4 Offline Installer
https://downloads.malwarebytes.com/file/mb4_offline

Then do a CLEAN removal but instead of having the MBST tool do the reinstall, decline that and use the Offline Installer instead.

 

Do the following?

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click the CLEAN button and follow the onscreen instructions but decline the install and use the offline installer.
• NOTE: Please have patience as it can take a while to remove and restart the computer

 

 

 

Edited April 21, 2022 by AdvancedSetup
Updated information

[Ven0m]

Thank you ill do that! 

[Ven0m]

I have a new issue, now it says that i hit my device limit. its the same pc and windows, why does it say that all the sudden, it has worked all this time before reinstall as you told me above.