Jump to content

Malwarebyte Browser Guard causing memory-related error.


Recommended Posts

Hello,

Thanks for taking the time to read this.

I've recently encountered an issue that I have not seen before. I've installed Malwarebytes Browser Guard on chrome a few days ago after upgrading several hardwares on my pc. Today while starting up Chrome, I received an error as show in the attached image below:

I have never seen this message before In the few years I had this extension on chrome. 

I appreciate any help you may provide as this issue is getting rather annoying every time I start up chrome. I have since remove the extension and have not seen any error. It is just strange to me that this error popped up a few days after installation.

Thank you and regards.

IMG_5892.jpeg

Link to post
Share on other sites

  • Root Admin

Hello @coolingwater

Let's do some clean up. The system has some policies set that should not be set. Then we'll do some other possible clean up of Malwarebytes

Please copy the Farbar program to your DESKTOP to make it easier to find in Safe Mode

Farbar (FRST) location:  C:\Users\User\Downloads\FRSTEnglish.exe 

 

Then run the following

Start in Safe mode:

  • Press the Windows icon on the keyboard together with the letter I, to get into the Settings.
  • Choose Update and Security.
  • From the menu at the left, choose Recovery.
  • Under the title Advanced startup at the right, choose Restart now.
  • From the window that will appear choose Troubleshoot and then Advanced options.
  • Choose Startup Settings and then Restart.
  • Press number 5, for choosing Safe mode with networking.
  • You will know that you are in Safe mode, if the background is black and Safe mode is written at the four corners of the screen.


After that:

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

  • Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

 

Start::
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction
HKLM\Software\Policies\...\system: [ShellSmartScreenLevel] Warn
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [EnableCdp] 0
HKLM\Software\Policies\...\system: [EnableMmx] 0
HKLM\Software\Policies\...\system: [RSoPLogging] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
IFEO\CompatTelRunner.exe: [Debugger] %windir%\System32\taskkill.exe
IFEO\DeviceCensus.exe: [Debugger] %windir%\System32\taskkill.exe
IFEO\software_reporter_tool.exe: [Debugger] %windir%\System32\taskkill.exe
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction
HKLM\SOFTWARE\Policies\Google: Restriction
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction
End::

 

  • Right-click on FRSTEnglish.exe on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
  • Press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt on your Desktop.
  • Post the log in your next reply.
 
 
 
Link to post
Share on other sites

Hello @AdvancedSetup,

Thank you for your reply, i really appreciate your help.

So, for some reason I cant connect to the internet when booting into safe mode with networking albeit with my ethernet cable hooked into my pc. However, I did manage to run the program as you have outlined above, I hope that doesn't affect the program.

Attached is the fixlog.txt.

Again, thank you very much!

Fixlog.txt

Link to post
Share on other sites

  • Root Admin

No, you can do the following but since you have the program you don't need to download again

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

Link to post
Share on other sites

  • Root Admin

Recommendation only

 

Your current DNS Servers:  192.168.1.254

Please consider changing your default DNS server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

Pick just one of these 4 providers. And be aware that you need to modify 1 time for IPv4 & a 2nd pass for IPv6

  • Google Public DNSIPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
  • CloudflareIPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
  • OpenDNSIPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
  • DNSWATCHIPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b


The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

 

 

 

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

  • NOTICE: This script was written specifically for this user, for use on this particular machine.
  • Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRST64.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\User\Desktop\

NOTE. It's important that both files, FRST64.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

  1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
  2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
                Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
  3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Discord cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites

  • Root Admin

Having your system use 192.168.1.254 will normally point DNS back to your local ISP which in most cases do not run the best DNS servers.

Using one of the ones provided will normally provide a better experience for locating sites as well as offering stronger protection than most ISP offer.

 

The fixes are for items in shown on your computer that do not belong running on the system as well as cleaning up general temp files and validating that all the core Microsoft files are valid and intact.

If you do not wish to run it that's your choice, but I would highly recommend you do run it. There have been hundreds and hundreds of users that have run this type of clean without issue.

 

Link to post
Share on other sites

Thank you for the response, I will definitely run the steps you have provided above. I just wanted to understand (out of interest) why my system ended up getting wonky so that I can prevent this from happening in the future.

I will upload the logs from FRST after scanning when I get home from the office.

Cheers.

Link to post
Share on other sites

  • Root Admin

Good day and thank you for the logs

 

Great, those logs looks good. Cleaned up well.

Please run the following so we can check on some other security and program version information @coolingwater

 

 

SecurityCheck by glax24              

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

  • Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
  • If Microsoft SmartScreen blocks the download, click through to save the file
  • This tool is safe.   Smartscreen is overly sensitive.
  • If SmartScreen blocks the file from running click on More info and Run anyway
  • Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
  • You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

image.png

image.png

image.png

 

Thank you

 

 

Link to post
Share on other sites

  • Root Admin

Please update the following if you're still using it.

Google Drive v.1.0 Warning! Download Update

 

Then perform the following for Malwarebytes Browser Guard

Malwarebytes Browser Guard Reset
https://forums.malwarebytes.com/topic/300058-malwarebytes-browser-guard-reset/

Link to post
Share on other sites

I will report back in the next 24 hours if there are any new error that pops up. Although I did encounter an error described below after uninstalling FRST64.exe and restarting my pc.

What I did was move the FRST64.exe to the FRST folder in my C: drive. Renamed the FRST64.exe to uninstall.exe and clicked it to uninstall which prompted the pc to restart. When I clicked on File Explorer after the restart, the error below popped up. 
 

[explorer.exe- Application Error

The instruction at 0xXXXXXX referenced memory at 0xXXXXX. The required data was not placed into memory because of an I/O error status of 0xXXXXX.

Click OK to terminate the program]

I don't remember exactly what the error codes were, I didn't take a screen shot of it.  I restarted the pc again to try and recreate the error but couldn't. So everything seems fine at the moment, but again, I will report back in 24 hours.

Many thanks for your help.

  • Like 1
Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.