MWB 1.46 w 4310 locks up Win7 x64

[frozen]

Using NOD32 4.2.58.3 along with OA+++ (w antivirus portion disabled) on Win7 x64 AMDx2 3Ghz w 4GB RAM and installed MBW and updated it and did a quick scan but it locks up every time it hits \windows\system32\nshwfp.dll so much so that I had to use the reset button on the computer. Scanned in safe mode and MWB did not find anything. Nor did NOD32.

I also tried uninstall MWB, rebooting running the MWB cleaner app, reboot and install MWB from a new download and no difference on the problem.

[Firefox]

Hello and

Please exclude the following files from your antivirus:

NOD32 4.2.58.3 along with OA+++ (w antivirus portion disabled)

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude them from it as well

For Windows Vista or Windows 7:

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

For 64 bit versions of Windows Vista or Windows 7:

• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\SysWoW64\drivers\mbamswissarmy.sys
  

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude MBAM.EXE from it as well

Note: Once that's done, please make sure that if either of those programs has any sort of web filter, that you add the following as a trusted site:

data-cdn.mbamupdates.com

The FAQ contains examples of setting file exclusions for some known AV products

Please post back and let us know how it went.

[frozen]

I have never had to exclude the OA Armor firewall when scanning with MWB and I have been using the 2 for 2 years.

[frozen]

Also the problem occurred after MWB was fully updated and ready to scan. MWB started to scan and locked up perhaps just over a minute always showing the same file.

[noknojon]

Hi -

Please look at this page for exclusions for your EST NOD 32 - HERE is what they say to do with exclusions for your A/V program -

This has helped others with the same problem -

Thank You -

[frozen]

Did not help as shown by the attached snapshot from the quick scan. I had added all the indicated files for mbaw to NOD32 exclusion list as well as adding the Website and making sure MBAM was allowed in OA.

[frozen]

Even after shutting down OnlineArmor and disabling Eset realtime scan the MBAM scan locked up the computer yet again. This time it showed windows\system32\noise.kor as the file being scanned.

[exile360]

Greetings

Please do the following:

Run a Disk Check on your C: drive in Windows Vista or Windws 7:

• Click the Start button and select Computer
  
• Right-click on C: and select Properties
  
• Click on the Tools tab
  
• Under Error-checking click the Check Now... button and click Continue at the User Account Control prompt
  
• Mark the box next to Automatically fix file system errors and Scan for and attempt recovery of bad sectors
  
• When the message box pops up, click the Schedule disk check button and restart your computer
  
• Once your computer restarts it will check the drive, don't press any keys so that it is allowed to do so
  

After that, please try another Quick Scan and let us know if it still freezes or not.

Thank you.

[frozen]

Well just did a chkdsk per your instructions and just like the one I did in safe mode prior to the last lock up neither showed any problems. I did not do a scan with MBAM.

[frozen]

Well did a quick scan and like all of the other ones today the system locked up on the same file as the first one.

[exile360]

Please try moving the file to a different location such as your desktop and performing a Quick Scan again, and if the scan completes this time, move the file back to where it was originally and try the scan one more time to see if it can now complete successfully.

[frozen]

I can not copy the file nor move it. Win7 x64 will not allow me (administrator acct) to do so.

[exile360]

Alright, I'll try to find out why it's locked. Please do the following so I can take a look:

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here and save it to your desktop.
  
  • Note: If using Windows Vista or Windows 7 then you also need to do the following:
    
    1. Right-click on Autoruns.exe and select Properties
       
    2. Click on the Compatibility tab
       
    3. Under Privilege Level check the box next to Run this program as an administrator
       
    4. Click on Apply then click OK
       

  [*]Double-click Autoruns.exe to run it.

  [*]Once it starts, please press the Esc key on your keyboard.

  [*]Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures so that it is now checked

  [*]Click on the Options button again and this time uncheck Hide Microsoft and Windows Entries

  [*]Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.

  [*]When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.

  [*]Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder

  [*]Attach the Autoruns.zip folder you just created to your next reply

I may be able to use Autoruns to unlock the file but I need to make sure it's safe to do so first.

[exile360]

Just to add, I'm also running 7 x64 and I just moved the file to my desktop, I did have to click "Continue" to a prompt when I tried to do so, but after clicking "Continue" the file did indeed get moved from System32 to my desktop.

[frozen]

I can copy the file but not delete it from the system32 directory.

[frozen]

I was able to delete it but only after taking ownership of the file.

[exile360]

Does a Quick Scan complete now? Also, does a Quick Scan complete after putting the file back?

[frozen]

No quick scan like all the other 10+ ones I have tried fails. It still showed the same file nshwfp.dll in Windows\system32, I rebooted and looked for the file no file (I have hide hidden files and hide system files for C: disabled). I did another scan and this time MBAM hung on noise.kor. I rebooted and looked for the file using the windows search as well as a search util called Everything and neither of them found it. I am at my wits end with MBAM.

[frozen]

MBAW had indicated the noise.kor file was still in the same directory c:\windows\system32. Yet as the prior screen shot shows that file is not in that directory. This is because after one of the prior lockups I moved noise.kor and nshwfp.dll to another folder which is on D:! Yet MBAM for some reason still locks up on these phantom nshwfp.dll or noise.kor files after a hard reset of this computer.

[frozen]

Found the culprit. Its Online Armor +++ uninstalling it fixed the problem. Have reported the problem to Emisoft.

[Firefox]

I am glad it worked for you, if you have any other issues or questions don't hesitate to ask.

[exile360]

I see, it must have been OA locking the files somehow. Thank you for letting us know, and thank you for reporting to the vendor, I know we as a company always appreciate it when users report issues to us so we can try to solve the problems and improve our products .