Durango_Dave Posted January 1 ID:1608456 Share Posted January 1 After installing Malwarebytes my backups are failing almost all the time. I can't find a pattern when the run good. I have Windows 11 Home and I'm using Windows 7 Backup and Restore and Microsoft Defender. Backups fail with event ID 4104 - The backup was not successful. The error is: Operation did not complete successfully because the file contains a virus or potentially unwanted software. (0x800700E1). But I can't find any indication what file contains a virus. I just know it happens after installing Malwarebytes. I think there is some conflict between Malwarebytes and Windows Backup. Link to post Share on other sites More sharing options...
Porthos Posted January 1 ID:1608459 Share Posted January 1 6 minutes ago, Durango_Dave said: I think there is some conflict between Malwarebytes and Windows Backup. Exit Malwarebytes by rightclicking the system tray icon and try the backup again and let us know if the backup works. That will determin if Malwarebytes is the issue. Link to post Share on other sites More sharing options...
Durango_Dave Posted January 1 Author ID:1608461 Share Posted January 1 After disabling Malwarebytes my backup still failed. That was surprising. My backups started failing the day I installed Malwarebytes. The error says "Operation did not complete successfully because the file contains a virus or potentially unwanted software." but i don't know what file the message is talking about. Link to post Share on other sites More sharing options...
Porthos Posted January 1 ID:1608462 Share Posted January 1 @Durango_Dave Please do the following so that we may take a closer look at your system. Disable-Fast-Startup https://forums.malwarebytes.com/topic/299350-disable-fast-startup/ Then please restart the computer and do the following. WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool The tool will also download and run a file named FRSTEnglish. Please allow it to do so. In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply Thank you Link to post Share on other sites More sharing options...
Durango_Dave Posted January 1 Author ID:1608465 Share Posted January 1 Here's the log file. mbst-grab-results.zip Link to post Share on other sites More sharing options...
Porthos Posted January 1 ID:1608468 Share Posted January 1 I am going to move your post so the malware removal experts can look over your system. There seems to be something in your shadow copies with the Firefox cache. Quote Date: 2024-01-01 06:43:30 Description: Microsoft Defender Antivirus has detected malware or other potentially unwanted software. For more information please see the following: https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:HTML/Phish!pz&threatid=2147888341&enterprise=0 Name: Trojan:HTML/Phish!pz Severity: Severe Category: Trojan Path: file:_\Device\HarddiskVolumeShadowCopy15\Users\BusaD\AppData\Local\Mozilla\Firefox\Profiles\2h93ij8r.default-release\cache2\entries\04A4C2087DB77484883385A01213400CAEB45C2D Detection Origin: Unknown Detection Type: Concrete Detection Source: Real-Time Protection Process Name: C:\Windows\System32\svchost.exe Security intelligence Version: AV: 1.403.1452.0, AS: 1.403.1452.0, NIS: 1.403.1452.0 Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2 Event[0] Link to post Share on other sites More sharing options...
Solution Durango_Dave Posted January 1 Author Solution ID:1608478 Share Posted January 1 Thanks! I tried a couple methods to delete Shadow Copies. Nothing worked. Next I changed my configuration so I would no longer backup AppData. Now my backups run successfully. 😀 Maybe I still have malware 😬 but my backups run. Link to post Share on other sites More sharing options...
JSntgRvr Posted January 1 ID:1608480 Share Posted January 1 (edited) Welcome I'll be helping you with your computer. Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding. Please take note of the guidelines for this fix: Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated. First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer. Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me. Please read ALL instructions carefully and perform the steps fully and in the order they are written. If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean. Continue to read and follow my instructions until I tell you that your machine is clean. If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed. Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. Let's begin... The tool saved FRST64.exe on this location: C:\Users\BusaD\Downloads\FRSTEnglish.exe Download the enclosed file Fixlist.txt Save it in the same location FRST64.exe is saved. Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Download AdwCleaner and save it to your desktop. Double click AdwCleaner.exe to run it. When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window by clicking their button to the far-right for ON status Delete IFEO keys Delete tracing keys Delete Prefetch files Reset Proxy Reset IE Policies Reset Chrome policies Reset Winsock Reset HOSTS file Click Scan Now ... When the scan has finished a Scan Results window will open. Click Cancel (at this point do not attempt to Quarantine anything that is found) Now click the Log Files tab ... Double click on the latest scan log (Scan logs have a [S0*] suffix, where * is replaced by a number, the latest scan will have the largest number) A Notepad file will open containing the results of the scan. Please attach the file in your next reply. Edited January 1 by JSntgRvr 1 Link to post Share on other sites More sharing options...
Durango_Dave Posted January 2 Author ID:1608563 Share Posted January 2 Did you see my previous reply? I got my backup to run by changing the configuration not to backup the AppData folder. Do you think I still have malware? Malwarebytes doesn't find anything. It only seems to be an issue if I try to backup the AppData folder. Link to post Share on other sites More sharing options...
JSntgRvr Posted January 2 ID:1608573 Share Posted January 2 If you feel that was enough, we can leave here. Your choice. I only see orphan entries. That should not bother you. 1 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 3 Root Admin ID:1608868 Share Posted January 3 Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site. https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/ Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/ Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2 Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security Malwarebytes Browser Guard Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/ uBlock Origin Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog https://blog.malwarebytes.com/ Hopefully, we've been able to assist you with correcting your system issues. Thank you for using Malwarebytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 3 Root Admin ID:1608869 Share Posted January 3 Since this issue is resolved the topic will now be closed to prevent others from posting here. If you need assistance please start your own new topic and someone will be happy to assist you. Thanks Link to post Share on other sites More sharing options...
Recommended Posts