error 1084 this service cannot be started in safe mode

[cdavid108]

I believe I have Malware on my PC.  I have booted into safe mode with networking, but Malwarebytes won't open.  When I try to start the services from the services menu, I get the error code 1084.  How can I get Malwarebytes open since something is clearly preventing it from doing it's magic.

[JSntgRvr]

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove pesky malware.

Please respond to all future instructions from your helper in a timely manner.

Please do the following so that we may take a closer look at your system for any possible infections.

Do these 2 steps FIRST so that files and folders are set to SHOW, plus also, Turn OFF Windows Fast Start.
Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool. The tool also downloads and runs a file called FRSTEnglish. Please allow it to run.
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• 
• 
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply

[cdavid108]

thank you so much for the quick response.  Can these tasks be completed while in safe mode?  I rebooted with a regular boot and I can't get the mb-support file to open.  I've been waiting for approx 20 min.

[JSntgRvr]

Lets try another option:

Please download 
Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click FRST(64) and select Run as administrator.
• Make sure that under Optional Scans, there is a checkmark on Addition.txt.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The tool will also produce another log (Addition.txt ). Please attach this to your reply.

[cdavid108]

ok, the Malwarebytes tool eventually came up in the normal boot mode.  I let it run and it ended with an error.  I downloaded the other tool and windows defender blocked it.  I added an exclusion for that file and it still wouldn't let me run it.  For the sake of hopefully saving time, I did reboot in safe mode with networking and ran the Malwarebytes support tool and it did produce a log file this time.  I will attach it here.  Please let me know if this is ok, or if I need to try something else.  BTW, I also tried to run the Fabar recovery tool in safe mode and windows defender blocked that as well.

mbst-grab-results.zip

[JSntgRvr]

The Support Tool failed to run FRST64.exe.

Please download  Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click FRST(64) and select Run as administrator.
• Make sure that under Optional Scans, there is a checkmark on Addition.txt.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The tool will also produce another log (Addition.txt ). Please attach this to your reply.

[cdavid108]

ah, I figured out all I needed to hit was show more on the warning and it let me select run anyway.  Here are the logs from the Fabar recovery scan tool.

Addition.txt FRST.txt

[JSntgRvr]

Welcome 
 
I'll be helping you with your computer.
 
Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
 
Please take note of the guidelines for this fix:

• Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
• First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
• Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
• Please read ALL instructions carefully and perform the steps fully and in the order they are written.
• If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
• Continue to read and follow my instructions until I tell you that your machine is clean.
• If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
• Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. 

Let's begin... 

• Download the enclosed file  Fixlist.txt
• Save it in the same location  FRST64.exe is saved
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Lets try Malwarebytes Antimalware and Adwcleaner to scan your computer.

https://forums.malwarebytes.com/topic/304827-scan-with-malwarebytes/\

https://forums.malwarebytes.com/topic/304822-scan-with-adwcleaner/

Please attach their reports.

[cdavid108]

Thank you so much for your assistance with my troubles.  I have run the fix file.  I also ran the adwcleaner.  Unfortunately, Malwarebytes had the same error as before and wouldn't open.  I have attached the two logs for adwcleaner and Farbar.

AdwCleaner[S01].txt Fixlog.txt

[JSntgRvr]

AdwCleaner - Clean

• Double click AdwCleaner.exe to run it.

When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window
by clicking their button to the far-right for ON status

• Delete IFEO keys
• Delete tracing keys
• Delete Prefetch files
• Reset Proxy
• Reset IE Policies
• Reset Chrome policies
• Reset Winsock
• Reset HOSTS file
• Click Scan Now
• When the scan has finished a Scan Results window will open.
• Please check all boxes and then click Quarantine
  • Click Next
  • If any pre-installed software was found on your machine, a prompt window will open ...
    • Click OK to close it
  • Check any pre-installed software items you want to remove (if they're not causing you a problem I recommend you don't select any)
  • Click Quarantine
• A prompt to save your work will appear ...
  • Click Continue when you're ready to proceed.
• A prompt to restart your computer will appear ...
  • Click Restart Now
• Once your computer has restarted ...
  • If it doesn't open automatically, please start AdwCleaner ...
  • Click the Log Files tab ...
  • Double click on the latest Clean log (Clean logs have a [C0*] suffix, where * is replaced by a number, the latest scan will have the largest number)
  • A Notepad file will open containing the results of the removal.
  • Please attach the contents of the file in your next reply.

Malwarebytes Support Tool (MBST) Clean option-run & new setup

• Download the tool from here. Open your Downloads folder and Right-click   mb-support-1.8.7.918  and select Run as administrator to start the tool. Reply YES to allow to go forward.

• When prompted by Windows, reply YES to allow the tool to go forward.
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Too!".
• Click the Advanced Options link. This is important. Please ensure Advanced Options is clicked.
• Click the Clean button followed by Yes to proceed.
• Upon completion, click OK to reboot your computer.
• After the reboot, please wait for the program to reopen. Have lots & lots of patience for the GUI screen to show
• You will be presented with the option to install Malwarebytes for Windows. Click YES.
• Have lots of patience. Follow all the prompts to do a new Setup of Malwarebytes for Windows.

[cdavid108]

44 minutes ago, JSntgRvr said:

• A prompt to save your work will appear ...
  • Click Continue when you're ready to proceed.
• A prompt to restart your computer will appear ...
  • Click Restart Now

When I ran adwcleaner, I followed the steps above this section, but I did not get the prompt to save work or a prompt to restart.  I will attach the most recent log file.  How should I proceed?

AdwCleaner[C02]2.14 7am.txt

[JSntgRvr]

Reinstall Malwarebytes if still unable to open.

[cdavid108]

Was able to reinstall MB.  At first, there was an error after hitting the clean button.  It said it was not able to uninstall and to contact MB support.  After I hit 'ok', it proceeded to work for a while and said MB was successfully installed.  I was able to open it and it is currently scanning.  It has gone through all processes and is currently working on files.  It is at 1.3M and has been running for 2 hours.  So far it has 0 detections.  I am headed into work for a while.  Will probably be back in 6 hours +/-, will send an update when I return.  Thanks again.

[JSntgRvr]

Export and attached the log in your next reply.

[cdavid108]

Wanted to check in.  As I stated in my earlier post, after 2 hours the scan was through 1.3M files, and after 10 hours it is only at 1.65M files.  Is this normal?

[JSntgRvr]

Still running?

[cdavid108]

yes, still with zero detections.

[cdavid108]

is running at approx 10 items/second.

[JSntgRvr]

That is too much. Stop it.

Re-scan with FRST64 and post new logs.

[cdavid108]

here are the logs from that scan

FRST 2.14.24.txt Addition 2.14.24.txt

[JSntgRvr]

See if you can boot to the Recovery Environment Command prompt:

Click Start > Settings > Update & Security > Recovery > Advanced startup and then Restart now to boot into recovery environment. Then, click Troubleshoot > Advanced options > Command Prompt

At the command prompt type the following and press Enter.
 
BCDEDIT | Find "osdevice"
 
Take note of the drive letter shown as the "osdevice", then type the following and press Enter:
 
CHKDSK X: /R
 
Replace the X with the osdevice letter and press Enter. Once completed take a photograph of that window and upload it for us to see. 

[cdavid108]

[JSntgRvr]

Windows made corrections to the File System.

Before going back to Malwarebytes, lets perform an online scan:

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

[cdavid108]

cureit2.14.24.log

[JSntgRvr]

All clear.

• Download the enclosed file  Fixlist.txt
• Save it in the same location  FRST64.exe is saved 
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Please make the following change in Malwarebytes if you're using the Premium or Trial version

• Please open Malwarebytes. Click on the small gear icon to open the Settings and go to the Security tab.
• Then turn off "Always register Malwarebytes in the Windows Security Center"
• Restart the computer
  

 
It is highly unlikely that you need to setup exclusions for Windows Defender, however if you experience any issues, please see the following article and setup exclusions between Malwarebytes and other antivirus

https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list
 
 
That should allow both Your Antivirus and Malwarebytes to run alongside each other without issue.

Retry Malwarebytes Antimalware

Let me know if that corrects the issue for you or not.