Cannot run system scan

[Bugman1]

I am running Windows XP Home Edition with SP3. I installed Malwarebytes 1.46. When I try to open the scan window, it doesn't work. I can scan individual files by right clicking on them and selecting scan. But I cannot run a full system scan. Also, I seem to get fairly regular notifications pop up stating that Malwarbytes has blocked a potential hazardous website. It then lists a site ID. The IDs vary but always begin with a 2 digit number.

I don't know what is happening. I have the same version of Malwarebytes loaded on my laptop and my wife's PC. Both seem to work perfectly. My internet and email have slowed a lot as well. I do work on the internet a lot. I could have picked up something. When it comes to computer knowledge, I guess I fall somewhere between beginner and average. I feel like I know just enough to make me dangerous to myself. Anyway, have there been others with this type of problem? If so, can I get some guidance please? Thanks, Bugman1

[Haider]

Hello Bugman1:

Kindly provide following details to receive targeted help:

1. Installed Security Product(s) including Firewall

2. Definition version (current 4693)

You haven't mentioned whether you have already scanned your system with AV, please keep in mind MBAM is not a substitute of an AV

Should you have any other question(s) please post back using button

[Bugman1]

Hello Bugman1:

Kindly provide following details to receive targeted help:

1. Installed Security Product(s) including Firewall

2. Definition version (current 4693)

You haven't mentioned whether you have already scanned your system with AV, please keep in mind MBAM is not a substitute of an AV

Should you have any other question(s) please post back using button

[Haider]

Hello Bugman1:

That was just an echo of my own post. Please use Add Reply button

[Bugman1]

Thanks for the quick response. I ran a virus scan earlier today. It came up with 4 errors that were moved to the chest. They were all considered "high threat" by Avast. I am running Avast anti-virus 5.0.677 with the virus definition version of 100925-0. My system auto-updated this today. Also, since my initial post, I ran RegCure. It shows 558 errors. I have not told it to fix these errors because I'm not sure if that action will help or hurt.

[Bugman1]

Sorry I forgot to tell you. The only firewall in my system is the one in Windows XP, and it is turned on. Thanks Again.

[Haider]

Hello Bugman1:

You have to add following exclusions in AVAST for MBAM, to avoid any kind of conflicts

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

Since AVAST has found infections, please update MBAM and run a Quick Scan and post back the result

Note: Please don't use Registry Cleaners as they do more harm than any good

[Bugman1]

Ok, I cancelled the RegCure scan results. I also checked my system and found that all of the files that you listed are already in place. I cannot run any scans with Malwarebytes because as stated on my original post, I cannot get to the scan window. Just to be sure, though, I rebooted my system, and again I could not access the scan window. I tried the program shortcut and also attempted to run the "ebam.exe" file directly from the folder. It appears as though the exe file is not functioning. Could there be a problem with the file? Also, when I rebooted, I immediately received a notice at the bottom of my desktop stating that "Malwarebytes successfully blocked access to a potential malicious website. The website listed was 218.7.131.167". I don't know if that is significant or not. While posting this I received another alert that "Malwarebytes block a website 94.96.54.178". Just had two more quick pop up notices. Strange????

[Bugman1]

When I finished with my previous post, I went to my desktop and found that a new file had appeared. It new file came from nowhere and is named "~$loxi High School 3.docx". Malwarebytes would not scan it. Avast showed no threat. I tried to open it with Word but could not. Word said that if I trusted the file, that I could attempt to recover the contents. I selected no. Next I copied the file to a memory stick thinking that I would use Malwarebytes on one of my other computers to scan it. When I plugged the stick into the other computer, the file did not show up on the stick. When I plugged it back into this computer, the file showed to be on the stick. In addition, a folder named "System" also appeared on the stick. I have deleted both from the stick. Something really strange is going on. Any suggestions???

[YoKenny1]

RegCure is a bogus application from Paretologic.com by exile360

I wouldn't touch a Paretologic product with a 10 foot pole .

http://forums.malwarebytes.org/index.php?s...st&p=172206

Bugman1 you have to be a member of Honorary Members to read this post.

[Bugman1]

Thanks for the info, Yokenny1. I guess that is another problem that I need to get rid of.

If anyone is interested, I cannot get to the malwarebytes website on my problem computer. I keep getting re-routed. I can still go to other sites (most of the time) but cannot get to this one. I am posting this from my laptop. I wonder what will come up next. I've been thinking about using a different browser than IE7 as well as a stand alone firewall. Does anyone have an opinion on the Firefox browser and OnLine Armor. Is so, I would appreciate your thoughts. Either way, I still need to get rid of my current problems before possibly changing over. Thanks, Bugman1

[YoKenny1]

Bugman1, IE8 is more secure and faster than IE7.

It is best to update to IE8 as IE is used in all of Windows.

Please read

Windows Explorer is a file manager application that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user interface for accessing the file systems. It is also the component of the operating system that presents many user interface items on the monitor such as the taskbar and desktop. Controlling the computer is possible without Windows Explorer running (for example, the File | Run command in Task Manager on NT-derived versions of Windows will function without it, as will commands typed in a command prompt window). It is sometimes referred to as the Windows Shell, explorer.exe, or simply

[Haider]

Hello Bugman1:

Sorry for missing your Posts #8, 9, and 11, due to time difference and some other work. Since you are unable to run MBAM altogether, I'd suggest to start from scratch. Please follow these steps in the same sequence:

If you have registered version then have the ID/KEY from the system handy, You should also have an email from Cleverbridge with your ID/KEY purchase information

1. Uninstall Malwarebytes' Anti-Malware using Add/Remove programs from the Control Panel
   
2. Restart your computer (very important)
   
3. Download and run mbam-clean.exe
   
4. Restart your computer (very important)
   
5. Download a fresh copy from here
   
6. Disable AVAST temporarily. Then install MBAM from the newly downloaded copy after completion it will automatically open update window, please allow (current 4696)
   
7. Register it with the ID/KEY (in case of registered version)
   
8. Enable AVAST ensuring all previously mentioned exclusions are still in place
   

Run a Quick Scan and Copy/Paste resulting text file please

[Bugman1]

Hi Haider. Glad to hear from you. I performed the actions that you recommended with no results. I followed the instructions step by step. After reloading the clean copy of Malwarebytes, I did not get an update window. I clicked on the icon to start the program with no results. Next, I went to the folder and tried to run the "ebam.exe" from there. It still would not run. Then I got and idea. What if the malware is preventing .exe files from running. To test this, I changed the file extension on "ebam.exe" to "ebam.bat". I then clicked on the filename and the program started, giving me the scan window. I am now running a quick scan as you recommended. It has been running for 8 minutes with no infections showing up yet. I will let you know what happens. Maybe we are getting somewhere.

[Bugman1]

Hi Haider. The scan finished with 5 infected files. Here is the log file. I had to restart the scan. I forgot to enable the Avast program before starting it the first time. I am now running a complete scan. It appears that something is preventing files with an exe extension from running. Do you have any thoughts on that? Thanks again, Bugman1

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

9/26/2010 10:25:48 AM

mbam-log-2010-09-26 (10-25-48).txt

Scan type: Quick scan

Objects scanned: 149432

Time elapsed: 4 minute(s), 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 1

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\winsts (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvc (TrojanProxy.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.75,93.188.166.225 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c4e4cf4a-a21d-4326-97c0-4275bc3649fe}\NameServer (Trojan.DNSChanger) -> Data: 93.188.164.75,93.188.166.225 -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Bugman1]

I just completed the deep scan of my system. Here is the log.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

9/26/2010 11:37:16 AM

mbam-log-2010-09-26 (11-37-16).txt

Scan type: Full scan (C:\|K:\|)

Objects scanned: 309907

Time elapsed: 1 hour(s), 7 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Haider]

Hello Bugman1:

Nice to hear from you again, your first scan logs clearly indicate your DNS settings were hijacked a probable cause that MBAM wasn't updating/running, however, your definition version is way too old, as I am writing current version is 4701, please do a definition update, run a Quick Scan from the Desktop icon then a Deep Scan. If you you still have any issue(s) please post back