Jump to content

Full Scan won't complete.


Recommended Posts

  • Replies 54
  • Created
  • Last Reply

Top Posters In This Topic

New Norton downloaded, rebooted. Added the malwarebytes' file to the sonar exclusion. Do these need to go into the sonar exclusion too?

?C:\Documents and Settings\All Users\Application Data\Malwarebytes

?C:\Windows\System32\drivers\mbam.sys

?C:\Windows\System32\drivers\mbamswissarmy.sys

Because they won't add. Can't find C:\Documents and Settings or 'drivers' under the C:\Windows/System 32 part.

These two are already in the regular scan exclusion (yes I know not to add the *) lol

?C:\Windows\System32\drivers\mbam.sys

?C:\Windows\System32\drivers\mbamswissarmy.sys

But ?C:\Documents and Settings\All Users\Application Data\Malwarebytes is not in the 'basic' exclude list.

One question though about this Norton. Smart Definitions is off, should it be turned on. Also any other tips advice you can give about the NIS2011, things to make sure that are on or off, etc.

THANK YOU!

Link to post
Share on other sites

I just realized I gave you the wrong list for Windows Vista, that's why you couldn't find the files, here's the correct instructions:

Set Exclusions for Malwarebytes' Anti-Malware in Norton Internet Security 2011:

  1. Open Norton Internet Security and click on Settings at the top
  2. Click on Computer Settings
  3. Click Configure [+] to the right of Items to Exclude from Auto-Protect and SONAR
  4. Click Add
  5. Make sure that Include subfolders is checked in the small Add Item window
  6. Click the small folder icon to the right of the blank white space
  7. In the Browse for Folder window that opens, navigate to C:\Program Files
  8. Click once on Malwarebytes' Anti-Malware to highlight it and click on OK
  9. Click OK and verify that in the box under The following items are ignored by both Auto-Protect and SONAR: it says C:\Program Files\Malwarebytes' Anti-Malware
  10. Repeat steps 4-9 for the following files and folders:
    • C:\ProgramData\Malwarebytes
    • C:\Windows\System32\drivers\mbam.sys
    • C:\Windows\System32\drivers\mbamswissarmy.sys

[*]Once you have all of those items in your list, click on Apply then click on OK to close that window and then click Apply and OK to close the Settings window

[*]Close the Norton Internet Security window

Link to post
Share on other sites

Ok, I will leave the settings as is. Which is what I pretty much did in NIS2010 anyhow (with the exception of manually blocking domains, email, urls, in the mail/spam section etc)

All the files now added correctly to the exclude scan and sonar exclude scan and am running a Norton full scan now just because with the new version it said not completed. Still running, so far just a couple of tracking cookies.

Will try a full MWB's scan after and will let you know. Wish me luck! :)

All the help has been wonderful and so appreciated!

Link to post
Share on other sites

It's tough at this point because I'm starting to run out of ideas but I do have a couple more things to try:

  • Make sure MBAM is closed
  • Go to the location of the folder where MBAM gets stuck
  • Right-click on the folder and choose Scan with Malwarebytes' Anti-Malware

Let me know if it gets stuck or not. I hope it does, as that will make troubleshooting this much easier :).

Link to post
Share on other sites

Several times now I have scanned just that folder simply because I hated wasting 55 minutes+ just for it to crash at that same place.

So does this help in possibly finding a solution? Quick scan runs through, no crashes. Full scan and picking just that folder, same file, same crash -everytime.

Ran it again, still stops.

Link to post
Share on other sites

Excellent. That will make this next step much easier since it crashes when you scan just that folder :)

Please do the following:

Create a Process Monitor Log:

  • Create a new folder on your desktop called Logs
  • Please download Process Monitor from here and save it to your desktop
  • Double-click on Procmon.exe to run it
  • In Process Monitor, click on File at the top and select Backing Files...
  • Click the circle to the left of Use file named: and click the ... button
  • Browse to the Logs folder you just created and type MBAM Log in the File name: box and click Save
  • Exit Process Monitor and open it again so that it starts creating the logs
  • Open Malwarebytes' Anti-Malware and perform a scan on the folder it has been crashing on by right-clicking it and choosing Scan with Malwarebytes' Anti-Malware. Once it crashes and MBAM closes, close Process Monitor
  • Right-click on the Logs folder on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
  • Please attach the Logs.zip file you just created to your next reply, or if it is too large, please upload it to Rapidshare and post the link to the download

Thanks ;)

Link to post
Share on other sites

Good morning!

So this morning I decided let me just exclude/ignore the C:\windows policy definitons\en-US file within malwarebytes just to see if I can bybass that and move onto something else, at least attempt a full scan once and for all. It made it quite a ways ... then it stops/crashes at a different file now.

This is what I got from that scan:

Full scan 370594 (files before it stopped)

3hrs, 47min, 20sec

Stopped at this file: C:\windows\system32\winevt\logs\\\\\\\\\\\\\\\\\\\\\\\\\

I unblocked C:\windows policy definitions\en-US from MWB's and downloaded the process file and am running it along with just scanning C:\windows policy definitions\en-US. I already know it will crash (which is the point I know) and then I will upload the file and post the link.

Will I need to do the process thing with this other file that has started stopping/crashing the MWB's?

You should have seen how happy I was, I was like "yah!" its making it (minus scanning that policy file of course) and then I come back to check, there sat that dreaded message that Malwarebytes closed, yadda yadda. Grrrr!!! :)

Anyhow, I'll post back when I get the log thing done and upload a link for you. Thanks for all the help, again ..

Link to post
Share on other sites

I don't even know if I did this right. But here is the link. http://rapidshare.com/files/440966941/Logs.zip

I messed up somewhere in the beginning I think. I closed the whole thing and was supposed to just be(I think) the logs, type file mbam logs, save, exit but I closed the whole thing and couldn't find on my computer where to re-open it so d/led again and re-did it. I hope I did this right.

Link to post
Share on other sites

Will I need to do the process thing with this other file that has started stopping/crashing the MWB's?
No, there shouldn't be any need for that :).
I messed up somewhere in the beginning I think. I closed the whole thing and was supposed to just be(I think) the logs, type file mbam logs, save, exit but I closed the whole thing and couldn't find on my computer where to re-open it so d/led again and re-did it. I hope I did this right.
The log looks correct, and as long as Process Monitor was still open when MBAM crashed, then it should contain the data I needed, thanks ;).
Link to post
Share on other sites

Hello again :D

Please do the following:

Create a Batch File:

  • Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor):
    @color 48
    @echo off
    reg query "HKLM\SOFTWARE\Malwarebytes' Anti-Malware" /v "programversion">"%userprofile%\desktop\Info.txt" 2> nul
    "%userprofile%\desktop\Info.txt" 2> nul
    del /f /q "%userprofile%\desktop\Info.txt" 2> nul
    del /f /q %0 2> nul

    Once you've done that click on File and select Save As...

  • In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  • Name the file Check.bat (the .bat extension is very important)
  • Save the file to your desktop and double click it to run it.
  • Once it finishes it will open the file it created in notepad, please copy and paste the file's contents into your next reply.

Also, please create another crash dump for me. The first one appears to be corrupted, though I suspect it's my fault because I left out one of the steps (leaving the error message open when grabbing the Dr Watson folder):

Create a Crash Dump:

  • Click on START and select Run
  • In the Run box type or copy/paste drwtsn32 and press Enter or click on OK
  • In the Dr. Watson for Windows verify the paths shown in Log File Path and Crash Dump which should be the following:
    • C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
    • C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp

    [*]Next to Crash Dump Type: make certain that Full is selected

    [*]Make certain that under Options the following are all checked:


    • Dump Symbol Table
    • Dump All Thread Contexts
    • Create Crash Dump File

    [*]Click on OK

    [*]Now replicate the crash by right-clicking on the folder it's been crashing on and choosing Scan with Malwarebytes' Anti-Malware

    [*]When the error window pops up, please leave it open and do the following:

    • Once that's done, navigate to C:\Documents and Settings\All Users\Application Data\Microsoft and right-click on the Dr Watson folder and choose Copy
    • Close the explorer window and right-click on your desktop and select Paste
    • Right-click on the Dr Watson folder which you should now see on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
    • Attach the Dr Watson.zip file you just created to your next reply if it is small enough. If it isn't then please upload it to RapidShare
    • Once the upload completes you'll be given a link for the download, please copy and paste that link into your next reply

Thanks ;)

Link to post
Share on other sites

Under start, Run, C/P drwtsn32 this is what I get Windows cannot find drwtsn32. Make sure you typed the name correctly and then try again.

Is this for Vista? I know Vista has the PC Doctor.

Right you are, I gave you the instructions for Windows XP, my apologies.

Here are the proper instructions for Vista:

Create a Crash Dump in Windows Vista and Windows 7:

  • Replicate the crash by performing a scan of the folder that has been causing the issue
  • When the error window pops up, please leave it open and do the following:
    • Press Ctrl+Shift+Esc on your keyboard to open Task Manager
    • Click the button Show processes from all users and click Continue if you receive a User Account Control prompt
    • Right-click on mbam.exe in the list of processes and choose Create Dump file
    • Click on the START vista-7-start.png button and select Run
    • In the Run box type or copy/paste %USERPROFILE%\AppData\Local\Microsoft\Windows\WER\ReportArchive and press Enter or click on OK
    • Copy the most recently created folder and paste it to your desktop
    • Right-click on the folder you just copied to your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
    • Attach the ZIP file you just created to your next reply if it is small enough. If it isn't then please upload it to RapidShare
    • Once the upload completes you'll be given a link for the download, please copy and paste that link into your next reply

Thanks :)

Link to post
Share on other sites

Unfortunately, that wasn't the right one, that one was for an issue where one of Norton's processes was hung up and became unresponsive :).

You can verify which one it is by opening the folder and opening the .wer file with notepad:

  • Double-click on the .wer file and choose Select a program from a list of installed programs and click OK
  • Uncheck Always use this program to open this kind of file
  • Double-click on Notepad
  • It should say AppPath=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe somewhere in the text of the file

Once you find the right one, please upload it here if it's small enough, if not, then please user RapidShare and provide the link so that I may download it.

Thanks, and thank you so much for your patience in working on this issue :).

Link to post
Share on other sites

I don't know what I am doing. I am following these steps to a 't' and still can't find whatever it is I am supposed to zip/upload. Everything seems to be an empty shortcut file though I am copy/pasting whatever file it is that it says was created with the dump thing.

I have file after file sitting on the desktop that I am creating per the instructions and half end up empty, half end up as short cuts, some open saying 'can't find file/folder', the one that I scanned this morning, scanning just the windows policy definitions file, it crashes (new error now 'runtime error 28 out of stack space. No more 'MWB's has encountered a problem and needs to close' --however whatever dump is there its showing for 'internet explorer'.

Seriously beats the heck out of me at this point. I will keep trying. I feel I am following every step, I printed it out and am going down the line with everything to a 't' and I still can't find any dump file named with 'mbam' even though I copied the file where it says the dump file was created/put I can't find it.

I will keep trying I guess but somethings not working. If I can't figure it out I'm just going to uninstall MWB's and find a different malware program. Its not that I have not appreciated all the help from everyone thus far but I am at my breaking point with this program and trying to fix it. Please forgive my frustration and attitude, its not towards you and all the help its just me. I am going to delete everything I have created, new folders named log, whatever the heck it shows on the desk top as mbam, and start over completely because nothing on the desktop seems to be whatever I need to upload.

Will post back later if I can get this right. Thank you!

Link to post
Share on other sites

I can certainly understand your frustrations, you have been more than patient in working through all of this and it is very much appreciated.

I suspect there may be something wrong with my instructions and that may be the problem. Please give the instructions in this tutorial another shot if that's alright. Hopefully it will give us the answers to the problem.

Just for info also, we generally only recommend the Quick Scan anyway, instead of the Full Scan, because the quick scan is designed to look in all of the locations that the infections we detect are known to reside. Any time we find a new location where infections hide, it gets added automatically to the Quick Scan.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.