Full Scan won't complete.

[CoffeeQueen]

Malwarebytes won't complete a full scan: It runs then stops at the same file and a little box comes up saying something like "malwarebytes has encountered an error and needs to close" then it says windows is checking for a solution to this problem. I also remember at one point it was not getting further along than what it does now and it used to pop up some error code (can't remember the number, this was quite a while back)

I'm running Vista (SP2) 3.00gb 32bit

I have not been able to EVER run a full system scan on this computer since I installed malwarebytes. The computer is about a year & a half old. Other computer is XP and never had issues running full scans on it.

I've read about the files to exclude in anti-virus scans (Norton Internet Security 2010) and added them all. Still won't scan.

I've uninstalled and reinstalled more times to count. Still won't scan.

It always seems to stop at this file. This is where it stopped last time: file# 141274 (at 53 minutes, 53 seconds) C:\windows\policydefinitions\en-US\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ (yes all those \'s are after it.)

I tried going right to that file to scan just it and it won't finish the scan there. Forgive my ignorance but what does the C:\windows\policydefinitions\en-US file do?

This is what these files show and I don't know what they do and wouldn't know if any of it looks suspicious or not.

double clicking the 'policy definitions' folder it shows:

en-US <--clickable subfolder (date modified) 2/23/2010 7:55pm file folder

CaptureWizard.admx (date modified) 11/2/2006 6:36am ADMX File 2kb

inetres.admx (date modified) 2/19/2009 1:47am ADMX File 2.996kb

MovieMaker.admx (date modified) 11/2/2006 6:36am ADMX File 4kb

Search.admx (date modified) 11/13/2008 4:19am ADMX File 43kb

WindowsMediaDRM.admx (date modified) 11/2/2006 6:35am) ADMX File 2kb

WindowsMediaPlayer.admx (date modified) 1/20/2008 8:25pm) ADMX File 23kb

When I double click and open the en-US folder it shows all the same stuff as above.

I keep windows updated (automatic) I also have the live updates/definitions for Norton. I installed and have been running Windows Defender (I keep it updated)as well and it always runs a full scan, never stops. Norton has never found anything on this computer though it did stop an attack back in October I think it was. Some redirector site but it shows it as caught and stopped. Windows Defendor has never found anything, and malwarebytes quick scan (it works) also says it hasn't found anything. I don't believe I am infected with anything to be honest, not betting on it but nothing seems suspicious to me. Computer seems to run fast, with the exception of IE at times.

Any help would be appreciated, hopefully I outlined this enough, if I missed any important details just let me know. THANKS!!

PS: it was within the last 2 weeks or so it updated to an entirely new version and installed. I know under the new version outline it said it fixed crash errors or scan errors, well obviously it didn't, lol!

[Haider]

Hello athena wood:

Sorry to hear that you are having problem with MBAM. Please check and follow:

1. MBAM version (current 1.50.1.1100)
   
2. Definition version (current 5431)
   

Please do one more attempt of scanning with (Heuristics Shuriken Disabled) after definition update

1. Click on Settings
   
2. Click on Scanner Settings
   
3. Uncheck Enable advanced heuristics engine (Heuristics Shuriken)
   

Please post back using button

[CoffeeQueen]

Just for the heck of it, tried another scan of just that folder. Made it to file 41594 25minutes, 25seconds. Then once again, won't finish.

2 pop ups:

1.Malwarebytes Anti-Malware has stopped working. Windows is collecting more information about the problem. This might take several minutes.

2. Do you want to send more information about the problem? Additional details about what went wrong can help Microsoft create a solution.

Also the 'Enable advanced heuristics (Heuristics Shuriken) was already unchecked (did this a while ago.) Sorry I missed that detail in my first post!

Malwarebytes' Anti-Malware 1.50.1.1100

Datebase version 5431

Did not bother with the full scan again because that's taking almost an hour, realized first post I made a mistake, stopped at 56 minutes 53 seconds, not 53 minutes. But if it's stopping at the same place with just the custom scan something must be wrong with whatever file that is, right?

Also wanted to mention, when I got this computer, (1 1/2yrs ago roughly) The first things I did was make the recovery disks, install Norton and install Malwarebytes, so it's not like I'm just now using this program. In all this time it's been installed and in all this time a full scan has not run. Makes me paranoid at this point ...

Any other suggestions?

Thanks!

[Haider]

Hello CoffeeQueen:

Could you please confirm, if you still have all recommended exclusions intact in Norton for MBAM?

[CoffeeQueen]

Sorry I did not get back sooner. These are the files I added to the Norton exclude list (after reading some here in the past and some other trouble shooting guides.)

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll

C:\ProgramFiles\Malwarebytes' Anti-Malware\mbamext.dll

C:\WINDOWS\system32'drivers\mbam.sys

C:\ProgramFiles\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32'drivers\mbamswissarmy.sys

Do I have everything needed in the exclude list? Thanks for your help Haider.

[Haider]

Hello CoffeeQueen:

Your exclusion list is for the older version of MBAM as there are some new .dll files that aren't included. Please navigate to C:\Program Files\Malwarebytes' Anti-Malware\ and add all .dll and .exe files

[CoffeeQueen]

Hello again Haider.

I added more files yet the scan still stops in the C:\windows\policydefinitions\en-US files\\\\\\\\\. Ran a little longer but stopped at file#44415 27minutes 45seconds

Here is what I added by going into MWB's 'program files' section: It was 6 or so more files I added. Should have written down what I just added. (duh!)

C:\program files\malwarebytes' Anti-Malware\ssubtmr6.dll

C:\program files\malwarebytes' Anti-Malware\mbamnet.dll

C:\program files\malwarebytes' Anti-Malware\mbam.dll

C:\program files\malwarebytes' Anti-Malware\mbamcore.dll

C:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

Basically here what was shown for .dll and .exe files in the C:\Program Files\Malwarebytes' Anti-Malware\ folder and these are what I added:

mbam.exe (already was on list I think, didn't re-add)

mbamcore.dll

mbamext.dll

mbamgui.exe

mbamnet.dll

mbamservice.exe (already on list, didn't re-add)

ssubtmr6.dll

What's left in there are files such as dat file, text, rich text, html help file, msg file, application.

I re-booted after adding the files (usually do) don't know if that helps the process or not, but still no go. Added files, ran custom scan no dice. re-boot ran custom scan, again won't finish. It stoped at the same place as mentioned above. I didn't bother with a full scan again as it runs for almost an hour and then quits.

Sorry to vent and whine but this is so frustrating, I just can't seem to figure this out ever!!! Thanks again for all your help!

Maybe it would help if I listed everything that's NOW in there so far then maybe you can tell me if I'm missing something or if something doesn't need to be on the list, because I know there were 2 maybe that didn't re-add.

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll

C:\ProgramFiles\Malwarebytes' Anti-Malware\mbamext.dll

C:\WINDOWS\system32'drivers\mbam.sys

C:\ProgramFiles\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\programfiles\malwarebytes' Anti-Malware\mbam.dll

C:\WINDOWS\system32'drivers\mbamswissarmy.sys

C:\WINDOWS\system32'drivers\mbam.sys

C:\Program Files\Malwarebytes' Anti-Malware\mbamnet.dll

C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll

\System Volume Information\ (this was already in here before I ever added any MWB's files)

[Haider]

Hello CoffeeQueen:

Third line item: C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll do you still have this?

Last line item: \System Volume Information\ absolutely no idea what this is doing in exclusion list

[CoffeeQueen]

Hi again Haider!

Yes, C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll is still on the list. Also added the one you posted (C:\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx)

I too have no idea what the \system volume information\ thing is either. When I first tried to troubleshoot this (read some here) and other tech guides online after finding files to add, it was already in there. Haven't removed it, don't know if I should or not.

Thanks

Going to try some more scans, will check back.

[Haider]

Hello CoffeeQueen:

This is odd that you still have zlib.dll with version 1.50.1.1100 as I don't see in any of my installs on Windows XP professional SP3

[Firefox]

Hello CoffeeQueen:

This is odd that you still have zlib.dll with version 1.50.1.1100 as I don't see in any of my installs on Windows XP professional SP3

If I had to guess the file zlib.dll is a left over file from previous versions that were running on that computer, if he did a clean install of MBAM, the file would get removed when the mbam-clean tool was used.

[CoffeeQueen]

Hello again Haider,

The problem with this scan is on my computer with Vista SP2.

I don't know why some of the files were left behind. I also googled the \System Volume Information\ thing and that confused me even more. Norton/Symantic says it normal to be there that it's included by 'default', other sites or help forums had things saying that it's a virus and that it gets into the recovery portion of the computer. So confused ... *bangs head on desk*

Should I just remove every file excluded and start over somewhere?

I tried another scan after adding the new file you told me about, still stops at same place and won't continue.

What are the files that should be included with the new 1.50.1.1100 version? Obviously have some old ones in there from somewhere. Like I said I've been trying to correct this problem for well over a year...

Forgive my ignorance but what is the clean removal tool? I was using the windows install/uninstall in the control panel section.

Thank you.

[CoffeeQueen]

Quick update:

Uninstalled MWB's through the uninstall section of the control panel THEN found the MWB's removal tool here and did that, making sure to restart after each step. Added the list back (minus some that you said were from old versions) still will not complete a scan. I added what's in the C:\Malwarebytes file (the .exe's and .dlls)

This is the list, if anything doesn't need to be there or I'm missing one please let me know. Again it's stopping at the same C:\windows policiy definitions\en-US but this time after the \\\\\\\\\\\\\\\\\\\\\(which was just that before) it showed C:\windows policy definitions\en-US\\\\\\\\\\\\\\\\\\\\\CaptureWizard.admx which led me to think I was making progress but then it went back to the \\\\\\'s (nothing behind it) and quit scanning.

Here's the files in Norton's exclude list:

C:\Program Files\Malewarebytes' Anti-Maleware\mbamservice.exe

C:\Program Files\Malewarebytes' Anti-Maleware\mbam.exe

C:\Program Files\Malewarebytes' Anti-Maleware\mbamcore.dll

C:\Program Files\Malewarebytes' Anti-Maleware\vbalsgrid6.ocx

C:\Program Files\Malewarebytes' Anti-Maleware\ssubtmr6.dll

C:\Program Files\Malewarebytes' Anti-Maleware\mbamnet.dll

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref

C:\Program Files\Malewarebytes' Anti-Maleware\mbamext.dll

\System Volume Information\ (still don't know why this is there or if it needs to be there ???)C:\Program Files\Malewarebytes' Anti-Maleware\mbam.dll

C:\WINDOWS\system32'drivers\mbam.sys

C:\Program Files\Malewarebytes' Anti-Maleware\mbamgui.exe

Also it is the new version 1.50.1.1100, version 5448

Thank you!

[CoffeeQueen]

Forgot to say in above post even after the clean uninstall (windows + malwarebytes clean uninstall) going back into Norton all the previous files were still in the exclude list, even the zlib.dll. Beats the heck out of me! I manually removed everything (minus the \windows system information\(?) and manually put back everything I think (hope) needs to be there.

[exile360]

Greetings

Please do the following:

Run a Disk Check on your C: drive in Windows Vista or Windws 7:

• Click the Start button and select Computer
  
• Right-click on C: and select Properties
  
• Click on the Tools tab
  
• Under Error-checking click the Check Now... button and click Continue at the User Account Control prompt
  
• Mark the box next to Automatically fix file system errors and Scan for and attempt recovery of bad sectors
  
• Click on the Start button
  
• When the message box pops up, click the Schedule disk check button and restart your computer
  
• Once your computer restarts it will check the drive, don't press any keys so that it is allowed to do so
  

Once that completes and your computer restarts, try another scan to see if it can complete or not.

If not, then please follow the instructions in this tutorial to create a crash dump for mbam.exe when it crashes.

After that, if the scan still crashed, proceed with the following as well:

Boot into Safe Mode:

• Restart your computer.
  
• When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with the boot options menu.
  
• Select the option for Safe Mode using the arrow keys.
  
• Then press Enter on your keyboard to boot into Safe Mode.
  

Once in Safe Mode, do another Full Scan with Malwarebytes' Anti-Malware to see if it is now able to complete or not.

Please let me know if the Check Disk resolved it, if it was able to complete the scan in Safe Mode and reply with the link to your Crash Dump if you needed to create one.

Thanks.

[CoffeeQueen]

Tried MWB's again last night and it again stopped but it gave me this error this time: run-time error 128'; out of stack space. Gave up last night in frustration. Tried to scan this am, still stops the scan at C:\windows policy definitions\en-US. Realized Norton caught/blocked something duh to my 2 stupid typos this am, re-edited, apply in Norton, OK. Did a reboot just for the heck of it. Again scan won't finish.

^^^^I realized my list had typos. Only 2 in the exclude list had the typos but when I typed them out here I made the typos (tried the c/p with edit but accidentally clicked 2 off so I manually typed them out, ignore the typos as I've since corrected that in the exclude list as Norton caught one this morning. (duh me) ...

Ran the disk check (already did this the first day I posted this problem, sorry I did not post that. I've tried so much, foggy brain!) and ran it in the past, appears to have found nothing wrong or hasn't fixed anything.

Trying to work on the dump file but I'm having problems with that. This is the file it shows as saved for the dump file:C:\Users\Owner\AppDate\Local\Temp\mbam (2).DMP Start, paste into search: C:\Users\Owner\AppDate\Local\Temp Shows two files when you make the dump file then click windows start, search- mbam.DMP and mbam (2).DMP Can't open either. Doing a search for everything thus far as not resulted in a hit, not like it shows in the tutorial. Shows no file, shows no file size.

At the risk of sounding like a redundant whiner, I have yet to be told or have answered what exactly the C:\windows policy definitions\en-US file does as this is the part it always stops at (full scan and also scanning just that file) Quick scan doesn't stop there but with quick scan not sure if it's actually hitting that file or not. Also within the Norton (Internet Security 2010) \system volume information\ already being in there. What's that all about? Googling it online really hasn't helped me much as 1 person says this, another site says that. Even though Norton/Symantic says it's normal and excluded as a 'default'. Thanks again.

Will check back in a few, next option will be safe mode I guess. Also just out of sheer frustration and curiosity at this point what on earth could be stopping MWB's from ever running a full scan, despite being diligent about updates and updates to new versions? Is this common??? Thanks

[exile360]

Any folder marked System Volume Information is a backup created by System Restore.

The Policy Definitions, I'm not sure about but they are a part of the default installation of Windows (I have them on my systems as well).

It is not common at all for Malwarebytes' Anti-Malware to freeze on a full scan, at least not with the current version. The most likely cause is either a a conflict with your antivirus software (which we've pretty much ruled out at this point as you've set up exclusions properly) or b an issue with your hard drive, which is what the Check Disk was an attempt to correct. I'm still leaning toward option b even though the first run of Check Disk didn't fix it.

With regards to the .dmp files, you aren't supposed to open them. You need to upload them to Rapidshare as shown in the tutorial. The easiest way to do that is to right-click on one of them when you locate it using search and select Open file location. Once you're in the folder they're stored in, do the following:

• Create a new folder on your desktop and call it MBAM Dumps
  
• Copy and paste the dump files into that folder
  
• Right-click on the MBAM Dumps folder and hover your mouse over Send To and choose Compressed (zipped) Folder
  
• Attach the MBAM Dumps.zip file you just created to your next post, or if it's too large to be attached here, upload it to Rapidshare
  

To upload a file to RapidShare, do the following:

1. Visit this page
   
2. Click on the Upload File button on the right
   
3. Click on the Select Files button that pops up and browse to the location of the file you wish to upload (in this case, your desktop)
   
4. Click on the file once and then click Open
   
5. The upload will begin. Once it completes it will provide a downloadlink, copy and paste that line of text containing the link into your reply
   

[CoffeeQueen]

Successful dump file:

http://rapidshare.com/files/440754160/mbam.zip

When I first tried the dump file it showed the 2 as I listed above yet both wouldn't open in any way and the mbam.dmp windows said file not found (confusing I know, bear with me) but then I tried the dump file again it created mbam(3).dmp but then it actually finally showed the mbam.dmp (I have no idea how that was there as I've never created a dump file before (mysteries, mysteries)

ANYHOW here is the link, review it and let me know. Will wait on safe mode. Thanks

[CoffeeQueen]

Sorry to keep flooding this as I sometimes forget to add something to my post and no edit button

Anyhow rapidshare also shows a delete link, will I need to delete this once it's reviewed? Thanks

[exile360]

No, there will be no need to delete the file.

Go ahead and try Safe Mode now. It's diagnostically important to find out if a scan in Safe Mode is able to complete or not.

Thanks

[CoffeeQueen]

Ran in safe mode. Scanned everything (full scan) Swear I C/P the log but nothing to paste, anyhow each category said 0 and no malicious items found. YIPPIE!

BUT imagine my surprise when I got out of safe mode (reboot) and did the full scan. It actually went longer than before 132139 55min 25sec .. and then it quit again ... again on C:\windows policy definitions\en-US.

*Microsoft Windows: Malwarebytes' Anti-Malware has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available.

Also I noticed in Norton this am due to my typing error when it stopped and blocked MWB's. I started the most recent scan about 9:40am(this one now that again didn't finish) and in Nortons history it shows: Medium Risk

Date:Tuesday Jan 4th, 2011 9:44am

Actor:C:\Program Files\Malwarebytes'\Anti-Malware\MBAM.EXE (This is specifically listed in the exclude section, put there by me quite some time ago)

Actor PID: 1852

Target: C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccsvchst.exe

Target PID: 1976

Action: Access Process Data

Reaction: Unauthorized Access Blocked

Terminal Session: 1

It blocked it this morning too but I realized I had some file exclusions with typos. I've never seen it actually block it before. Scrolled back through history, picked it up a couple of times last night too. Weird.

What else is there to try at this point? Thanks

[exile360]

I'm not sure how you set the exclusions previously, but there are several places that files can be excluded from Norton Internet Security, so please run through this and make sure that your settings match, I've also included instructions on excluding Norton from Malwarebytes for good measure:

Set Exclusions for Malwarebytes' Anti-Malware in Norton Internet Security 2011:

1. Open Norton Internet Security and click on Settings at the top
   
2. Click on Computer Settings
   
3. Click Configure [+] to the right of Items to Exclude from Auto-Protect and SONAR
   
4. Click Add
   
5. Make sure that Include subfolders is checked in the small Add Item window
   
6. Click the small folder icon to the right of the blank white space
   
7. In the Browse for Folder window that opens, navigate to C:\Program Files
   
8. Click once on Malwarebytes' Anti-Malware to highlight it and click on OK
   
9. Click OK and verify that in the box under The following items are ignored by both Auto-Protect and SONAR: it says C:\Program Files\Malwarebytes' Anti-Malware
   
10. Repeat steps 4-9 for the following files and folders:
    
    • C:\Documents and Settings\All Users\Application Data\Malwarebytes
      
    • C:\Windows\System32\drivers\mbam.sys
      
    • C:\Windows\System32\drivers\mbamswissarmy.sys
      

[*]Once you have all of those items in your list, click on Apply then click on OK to close that window and then click Apply and OK to close the Settings window

[*]Close the Norton Internet Security window

Set Exclusions for Norton Internet Security in Malwarebytes' Anti-Malware:

• Open Malwarebytes' Anti-Malware and click on the Ignore List tab
  
• Click the Add button on the lower left
  
• In the small browse window that opens, navigate to C:\Program Files and click once on Norton Internet Security and click OK
  
• Close Malwarebytes' Anti-Malware
  

Once that's done, try another Full Scan in normal mode (not Safe Mode) and let me know the results.

Thanks

[CoffeeQueen]

I have Norton Internet Security 2010, will this work for it?

[exile360]

It should be similar, but I'll verify it for you.

[exile360]

It appears that SONAR (the realtime protection) doesn't work quite the same in version 2010. The good news is, you should be able to upgrade to version 2011 free of charge by following the instructions on this page. Once the upgrade is complete, set the exclusions as detailed in my post above and try another Full Scan with Malwarebytes to see if it now completes successfully or not.