MWB freezes when it hits one set of files

[Terryl]

Howdy folks,

I have just installed the latest free version of MWB (ver 1.51.1.1800) on a dell laptop running MS XP pro (version 2002) with service pack 3, it has AVG free, SpyBot SD, CCleaner and Malwarbytes installed for protection.

And have the following problem.

When running MWB scanning for Klingon's, at or around 20 min into the scan it locks up (both the program and the laptop), it looks like MWB doesn't like scanning the following files. (sorry its a long one)

"C:\windows\installer\$PatchCache$\managed\00002119F2000000000000000F01FEC\12.0.4518\olg.dll" or "\12.0.4518\oisapp.dll" or "\12.0.4518\onenote.exe"

I found those names as the last file scanned before lockup of the program and the laptop, the only way to recover is by a forced power down, I have tried looking for those files but I cant find them in any of the "C:\windows\installer" directory's.(that is strange)

This does not happen if I do a short scan, only on the full scan, any ideas?????

Thanks to all that will help,

at a loss, Terryl

Malwarebyte scan log.

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7244

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

7/23/2011 1:47:32 AM

mbam-log-2011-07-23 (01-47-32).txt

Scan type: Quick scan

Objects scanned: 197076

Time elapsed: 3 minute(s), 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Terryl]

Someone please edit the title for me.

It should say..... MWB freezes when it hits one set of files.

[Esetisthebest]

You can simply ignore the file by open Malwarebytes - ignore list - find the file and add it.

[Guest spc3rd]

Hi Terryl,

You mentioned being unable to locate the files; have you gone to Control Panel > Tools > Folder Options, and checked the Show Hidden Folders/Files box, then looked for those files?

[Terryl]

You can simply ignore the file by open Malwarebytes - ignore list - find the file and add it.

I would if I could find the file, I have tried every search known to find that file, but it's like it doesn't exist on the laptops hard drive, and when the computer locks up I cant recover back to that point as I have to do a forced power down to get it back up and running, can I manually add the file name?

[Terryl]

Hi Terryl,

You mentioned being unable to locate the files; have you gone to Control Panel > Tools > Folder Options, and checked the Show Hidden Folders/Files box, then looked for those files?

Yes I have that checked in the "folders" options, it's like those files do not exist.

And typing them in on the search as a wildcard {*\wxyz.*} doesn't work ether.

[Terryl]

One other note:

I do find the folder ... "C:\windows\installer\....... But not the folder ..... "C:\windows\installer\$PatchCache$\

[1PW]

Hello Terryl:

Do you have reciprocal exclusions entered for both AVG and MBAM?

Section H of the FAQ might be quite helpful.

Please let me know if this was effective. Thank you.

[Terryl]

Hello Terryl:

Do you have reciprocal exclusions entered for both AVG and MBAM?

Section H of the FAQ might be quite helpful.

Please let me know if this was effective. Thank you.

Your going to have to explain that a bit for an old man....

[Terryl]

Your going to have to explain that a bit for an old man....

Never mind I found section "H", I will try it out....

[Terryl]

OK followed section "H" and found the files, put them into the ignore section, and still it locks up when it gets to any file that starts with a letter "o" in it, in the " 12.0.4518\ " files section, I put the whole section under the " 12.0.4518\ " files in the ignore list and am running a scan now, it looks like something in that section does not want to be scanned by MWB and freezes the laptop up.

Will report back after the scan if it makes it that far.

Terryl

[1PW]

Hello Terryl:

Please try a MBAM clean re-install by doing the following:

• Download and run the latest mbam-clean.exe from here.
  
• It will ask to restart your computer, please allow it to do so very important.
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here.
  
  • Note: You will need to reactivate the program using the license within the boxed version or were sent via email if using the PRO version.
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the PRO version. Now setup any reciprocal file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or ask and we'll explain how to do it.
    

Please let us know how it goes.

Please use the "ADD REPLY" button instead of other ones when you start replying.

HTH

[Terryl]

OK scan ran fine and found nothing.

MWB log......

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7248

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

7/23/2011 3:02:59 PM

mbam-log-2011-07-23 (15-02-59).txt

Scan type: Full scan (C:\|)

Objects scanned: 253883

Time elapsed: 31 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

However this does not explain why it stops and freezes the whole laptop up when it starts to scan those files.

Attached (if I can do this)is a screen shot (couldn't get a printout of the files)of the "o" files in that folder, maybe someone has some idea what would keep nthe MWB program from scanning it..

[Terryl]

Hello Terryl:

Please try a MBAM clean re-install by doing the following:

• Download and run the latest mbam-clean.exe from here.
  
• It will ask to restart your computer, please allow it to do so very important.
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here.
  
  • Note: You will need to reactivate the program using the license within the boxed version or were sent via email if using the PRO version.
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the PRO version. Now setup any reciprocal file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or ask and we'll explain how to do it.
    

Please let us know how it goes.

Please use the "ADD REPLY" button instead of other ones when you start replying.

HTH

OK didnt see this post before I ran the last scan.

Did what you mentioned, ran the cleaner and re-downloaded MWB, I am running a new scan without the ignore list (fresh install of MWB) AVG was off during the install and is off now during the scan.

Will report back..

And will use the other reply button, old eye bones didn't see it down there.

This site has a bit of a different layout then the ones I Admin and Mod at.

[Terryl]

OK that didn't do it, it still locks up when it gets to those files, I have put them back in the ignore list.

Now the big question is why they lock up the laptop when MWB scans them.

[1PW]

Hello Terryl:

Please download Oldtimer's latest OTL.exe to your Desktop.

To Download/Run OTL:

• Download the most recent OTL.exe from

here.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
OTL should now start. Change only the following settings:

Change Drivers to:

All

.

Change Standard Registry to:

All

.

Under File Scans, check that

File Age

is

30

.

Click the

Run Scan

button. Do not change any other settings unless otherwise told to do so. The scan shouldn't take long.

When the scan completes, it will open two Notepad windows. OTL.Txt and Extras.Txt (first run only). These are saved in the same location as OTL.exe
Please attach these 2 files in your next reply.

Thank you for your patience.

[Terryl]

OK here are the 2 files you wanted.

OTL.Txt

Extras.Txt

[1PW]

Hello Terryl:

I'm requesting a Malwarebytes' staffer read this thread and look at your OTL output.

Thank you for your continued patience.

[Terryl]

No problems with the wait, I can tell my friend that this will/may take a bit of time to correct.

He can use his wife's laptop if he gets internet withdrawals...Or go weed the garden...

[Terryl]

I see no way to edit my own posts.

But as far as having patience, I'm retired and have till the next millennium to sort this out...

[1PW]

Hello Terryl:

Your editing ability will automatically be enabled after your 50th post.

Also, you will then be promoted to the Honorary Members group and you'll have two bullet holes under your rank.

Welcome to the retirement club, youngster.

[Terryl]

Hello Terryl:

Your editing ability will automatically be enabled after your 50th post.

Also, you will then be promoted to the Honorary Members group and you'll have two bullet holes under your rank.

Welcome to the retirement club, youngster.

Youngster ????? Moses sat in front of me in first grade, I also caused the last ice age..................Sorry...................My fault...

[Terryl]

OK I did a short scan using an older version of MWB, it found over 690 infections listed as PUP.WhiteSmoke, I don't know why the new one didn't find this one but I removed them anyway.

But it still locks up the Laptop when it hits \12.0.4518\ section, I did an individual scan of every file in that folder except for the ones I marked in blue in my photo I posted further up this thread,they all scanned fine, but the second I start to scan any of the blue marked files it locks up the computer.

I'm stumped for now, and it's dinner time here.

[1PW]

Hello Terryl:

In a reply, please attach the relavent mbam-log.txt file that documents the PUPs found. On a XP Pro system the log may be found at:

C:\Documents and Settings\USERNAME\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs

Please do not copy/paste logs of massive length as text reply.

Thank you.

[Terryl]

OK here is the log of the short scan.

mbam-log-2011-07-24 (17-19-04a).txt