Malwarebytes uninstalled itself?

[hypermugen]

So, this year I was hacked and got extremely paranoid. I formated and reinstalled my windows, reset all of my passwords from every account I have.

 

I purchased Malwarebytes premium. I used to do one full scan every 3 days after that...

 

The paranoia settled down and eventually I did one full scan about every week and then just stopped and let malwarebytes run in the background. I was confident. Wasn't downloading any shady files or shady websites anyway.

 

So weirdly enough, I was using my pc yesterday and got a desktop notification that Windows Defender and Malwarebytes were turned off. I hadn't even noticed it. I have no idea how this could've happened. So I searched for Malwarebytes on the search bar and yep, it was uninstalled.

Maybe I accidentally deleted a Malwarebytes system file? I had only recently uninstalled my Wacom Tablet driver so maybe it uninstalled the antivirus as well? It doesn't make any sense, none of it does. This is supposed to be impossible to happen, yet here I am.

 

I reinstalled it again and nothing seems to be wrong, haven't detected any malware so far... But how in the heck did this Malwarebytes get uninstalled? Anyone have a clue? Maybe it deleted itself? Perhaps it tried to update and something went wrong?

Or is it possible I have such a terrible undetectable virus that did that? I just don't understand.

[Maurice Naggar]

Hello  

I will guide you along on looking for potential malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review.   This is a report only.

Please download MALWAREBYRES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

• Please attach  mbst-grab-results.zip    to your reply
• The IP block actions by Malwarebytes are keeping the machine safe from potential threats.
• We do need the support zip reports to see more detail  ( the screen grabs just do not have full details + those screens give no clue as to what processes are running.

[hypermugen]

1 hour ago, Maurice Naggar said:

Hello  

I will guide you along on looking for potential malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review.   This is a report only.

Please download MALWAREBYRES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

• Please attach  mbst-grab-results.zip    to your reply
• The IP block actions by Malwarebytes are keeping the machine safe from potential threats.
• We do need the support zip reports to see more detail  ( the screen grabs just do not have full details + those screens give no clue as to what processes are running.

Here it is. All the steps have been followed. No cracked programs. No online games, no web surfing. Logged out of Discord as well.

 

I did notice something very strange though. I just went to the dowloads folder and found an installer for something named "farbar recovery scan tool". I don't remember downloading this, in fact, it's not even in my downloads history from any of the browsers I use. I'm guessing it came from something I installed as bundleware and went unnoticed. Might've been downloaded and ran on the background, possibly uninstalling Malwarebytes without permission.

mbst-grab-results.zip

[Maurice Naggar]

Kindly be at ease. There is not a issue here. The support tool also includes the farbar tool so that we have a good report, which will help me to help you.
I will send you the next steps after I complete a review.

[Maurice Naggar]

Quick note, that needs your action. There are a number of File Rename Pending operations. Please exit all your open apps and do one Windows RESTART now.

[hypermugen]

I accidentally restarted twice. I got worried that discord got booted up with it on the first restart and there was a malware bytes admin request pop up window... Is this a problem?

[hypermugen]

I apologize. Having a lot of trouble today. Do we need to start over?

[Maurice Naggar]

As long as Windows was restarted one time, then, no, no need to re-do.  Stay with me.  I am reviewing your reports.

[hypermugen]

30 minutes ago, Maurice Naggar said:

As long as Windows was restarted one time, then, no, no need to re-do.  Stay with me.  I am reviewing your reports.

Alright... Is it okay if I work in the meantime? I'm using Toon Boom Harmony Premium

[Maurice Naggar]

There are a couple of settings that disable antivirus & antispyware protection. We need those removed. I would also like to run the Windows System File Checker tool to check this system, plus attempt scans with Microsoft Defender. 

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use thuis guide https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

Next, a custom script to do  checks & selected  cleanups. 

We will use FRSRENGLISH.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Hypermugen  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.
• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt             <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.  

[Maurice Naggar]

Exit "Toon Boom Harmony Premium"  & do my custom script run.

[hypermugen]

Houston we have a problem... So unfortunately I deleted the Far Bar Recovery Scan Tool thinking it was a virus. Didn't know it was you... Sorry

[hypermugen]

Alright, closed everything and clicked the "Fix" button on the FRST window with the Fixlist.txt in the downloads folder as well. No other software running. Show all folders enabled.

 

Only thing i couldnt find an option for was a windows defender scan. But I did everything else correctly.

 

now waiting.

[hypermugen]

27 minutes ago, Maurice Naggar said:

There are a couple of settings that disable antivirus & antispyware protection. We need those removed. I would also like to run the Windows System File Checker tool to check this system, plus attempt scans with Microsoft Defender. 

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use thuis guide https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

Next, a custom script to do  checks & selected  cleanups. 

We will use FRSRENGLISH.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Hypermugen  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.
• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt 10.65 kB · 2 downloads              <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.  

Also opened as administrator.

[hypermugen]

Fixlog.txtHere you go my good sir.

 

It asked for a restart, there was a boot screen to choose the OS, tapped enter and here you go.

[hypermugen]

38 minutes ago, Maurice Naggar said:

Exit "Toon Boom Harmony Premium"  & do my custom script run.

Can I resume my work

[hypermugen]

1 hour ago, Maurice Naggar said:

There are a couple of settings that disable antivirus & antispyware protection. We need those removed. I would also like to run the Windows System File Checker tool to check this system, plus attempt scans with Microsoft Defender. 

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use thuis guide https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

Next, a custom script to do  checks & selected  cleanups. 

We will use FRSRENGLISH.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Hypermugen  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.
• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt 10.65 kB · 2 downloads              <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.  

Please notify me what to do next as soon as possible.

[Maurice Naggar]

Windows Resource Protection found corrupt files and successfully repaired them.

I would rather you held off on using this pc till after, at least, you finish this next scan. 

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  FULL scan  

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
• Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
• We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply. We will do more later.

[hypermugen]

msert.log

here.

[Maurice Naggar]

The Safety Scanner found & removed 4 malware; 3 of which are trojans.

Let's check your system with another ( different ) antivirus scan tool.

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

• How to run a scan with Kaspersky Virus Removal Tool 2020

          https://support.kaspersky.com/15674

• How to run Kaspersky Virus Removal Tool 2020 in the advanced mode

          https://support.kaspersky.com/15680

• How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan

          https://support.kaspersky.com/15681

 

Select the    Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt   Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.   That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed... Thank you

[hypermugen]

 

done

report_2022.08.02_00.30.05..txt

[hypermugen]

7 hours ago, Maurice Naggar said:

The Safety Scanner found & removed 4 malware; 3 of which are trojans.

Let's check your system with another ( different ) antivirus scan tool.

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

• How to run a scan with Kaspersky Virus Removal Tool 2020

          https://support.kaspersky.com/15674

• How to run Kaspersky Virus Removal Tool 2020 in the advanced mode

          https://support.kaspersky.com/15680

• How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan

          https://support.kaspersky.com/15681

 

Select the    Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt   Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.   That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed... Thank you

answer replied above

[Maurice Naggar]

The Kaspersky found a number of adwares. A number of them were in games sub-folders.
Be aware that Malwarebytes program -is- on the system. And would have been on & active after the Restart I had asked you to do yesterday.
So, for Malwarebytes, I would like you to start it and to do a Update check & then do a Scan.

[ 1 ]

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions. Once the update check is completed, Close ( Exit) Malwarebytes.

[ 2 ]

Understant that this run will take several hours. That is normal and expected.
What follows is intended to be a scan of the whole drive C by Malwarebytes.
First, you want to de-clutter the desktop views by closing as many screens as you can beforehand.
Launch Windows File Explorer. Look on the left-side frame to where "This pc" is listed.
Expand that by clicking on it once.
Now look for the drive C:
Using mouse, do a RIGHT-click on C: and select Scan with Malwarebytes. This should start Malwarebytes. It may take a bit for the on-screen GUI display. Have patience.
Let me know the result. Locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

[hypermugen]

1 hour ago, Maurice Naggar said:

The Kaspersky found a number of adwares. A number of them were in games sub-folders.
Be aware that Malwarebytes program -is- on the system. And would have been on & active after the Restart I had asked you to do yesterday.
So, for Malwarebytes, I would like you to start it and to do a Update check & then do a Scan.

[ 1 ]

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions. Once the update check is completed, Close ( Exit) Malwarebytes.

[ 2 ]

Understant that this run will take several hours. That is normal and expected.
What follows is intended to be a scan of the whole drive C by Malwarebytes.
First, you want to de-clutter the desktop views by closing as many screens as you can beforehand.
Launch Windows File Explorer. Look on the left-side frame to where "This pc" is listed.
Expand that by clicking on it once.
Now look for the drive C:
Using mouse, do a RIGHT-click on C: and select Scan with Malwarebytes. This should start Malwarebytes. It may take a bit for the on-screen GUI display. Have patience.
Let me know the result. Locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

here you go

MalwareBytes_Report.txt

[Maurice Naggar]

Bravo. That is excellent. 👍😀

I would recommend getting a report on the update status of some key apps.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt