Jump to content

Caught a Freezing Bug & It won't let go! Help!

Kalecocat

By Kalecocat
in Resolved Malware Removal Logs

 Share

Recommended Posts

Kalecocat

Kalecocat

Posted
  • Author
Posted

Okay that looks fine.

Update MBAM, run a Quick Scan, and post its log. Grab a fresh copy of ComboFix, run it, and post its log.

Here are the logs:

Hi Chris,

The machine is still "locking up" at bootup. By that I mean that it displays the hourglass cursor for at least 8 minutes. During that time neither Task Mgr nor any other program can be executed. The hard drive activity light does not come on nor flash during that 8 minutes. However, if rkill is run promptly, everything seems to work properly (except for being quite slow), but even then it will sometimes later on "lock up" and exhibit the same behaviour. Hope this helps, Mike

------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8343

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/28/2011 11:43:37 AM

mbam-log-2011-12-28 (11-43-37).txt

Scan type: Quick scan

Objects scanned: 174275

Time elapsed: 2 minute(s), 36 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

-------------------------------------------------------------------------------

ComboFix 11-12-28.03 - Katherine 12/28/2011 11:48:38.7.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1538 [GMT -6:00]

Running from: c:\documents and settings\Katherine\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Outdated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

* Created a new restore point

.

.

((((((((((((((((((((((((( Files Created from 2011-11-28 to 2011-12-28 )))))))))))))))))))))))))))))))

.

.

2011-12-28 17:36 . 2011-12-28 17:36 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9B8978DF-639C-44C0-B937-6C09435499BB}\offreg.dll

2011-12-19 17:14 . 2011-12-19 18:06 -------- d-----w- C:\Address Lists

2011-12-12 21:57 . 2011-12-28 17:52 -------- d-----w- c:\documents and settings\Temporary Internet Files\Content.IE5

2011-12-09 11:55 . 2011-11-21 10:47 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9B8978DF-639C-44C0-B937-6C09435499BB}\mpengine.dll

2011-12-07 14:19 . 2011-12-07 16:44 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0

2011-11-28 22:57 . 2011-11-28 22:57 -------- d-----w- c:\documents and settings\Temporary Internet Files\AntiPhishing

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-21 10:47 . 2011-01-22 15:28 6823496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-10-28 16:30 . 2006-10-19 03:47 133632 ----a-w- c:\windows\system32\WPDShServiceObj.dll

2011-10-10 14:22 . 2004-08-04 21:00 692736 ----a-w- c:\windows\system32\inetcomm.dll

.

.

((((((((((((((((((((((((((((( SnapShot@2011-11-02_18.07.54 )))))))))))))))))))))))))))))))))))))))))

.

+ 2006-05-10 13:33 . 2011-11-14 19:35 53100 c:\windows\system32\perfc009.dat

+ 2011-11-14 19:38 . 2001-08-30 10:30 13894 c:\windows\system32\dllcache\zonelibm.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 29760 c:\windows\system32\dllcache\znetm.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 41029 c:\windows\system32\dllcache\zcorem.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 36937 c:\windows\system32\dllcache\zclientm.exe

+ 2011-11-14 19:38 . 2001-08-30 10:30 32339 c:\windows\system32\dllcache\uniansi.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 42573 c:\windows\system32\dllcache\shvlzm.exe

+ 2011-11-14 19:38 . 2001-08-30 10:30 66113 c:\windows\system32\dllcache\shvl.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 42574 c:\windows\system32\dllcache\rvsezm.exe

+ 2011-11-14 19:38 . 2001-08-30 10:30 48706 c:\windows\system32\dllcache\rvse.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 42573 c:\windows\system32\dllcache\hrtzzm.exe

+ 2011-11-14 19:38 . 2001-08-30 10:30 57409 c:\windows\system32\dllcache\hrtz.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 42575 c:\windows\system32\dllcache\chkrzm.exe

+ 2011-11-14 19:38 . 2001-08-30 10:30 40515 c:\windows\system32\dllcache\chkr.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 42577 c:\windows\system32\dllcache\bckgzm.exe

+ 2011-11-14 19:38 . 2001-08-30 10:30 82501 c:\windows\system32\dllcache\bckg.dll

+ 2011-11-02 18:00 . 2000-08-31 00:00 98816 c:\windows\sedx.exe

+ 2011-11-14 19:38 . 2001-08-30 10:30 8261 c:\windows\system32\dllcache\zoneoc.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 4677 c:\windows\system32\dllcache\zeeverm.dll

+ 2006-05-10 13:33 . 2011-11-14 19:35 342750 c:\windows\system32\perfh009.dat

+ 2011-11-14 19:38 . 2001-08-30 10:30 113222 c:\windows\system32\dllcache\zoneclim.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 753236 c:\windows\system32\dllcache\rvseres.dll

+ 2010-01-25 15:42 . 2011-10-10 14:22 692736 c:\windows\system32\dllcache\inetcomm.dll

- 2010-01-25 15:42 . 2011-05-02 15:31 692736 c:\windows\system32\dllcache\inetcomm.dll

+ 2011-09-09 09:12 . 2011-09-28 07:06 599040 c:\windows\system32\dllcache\crypt32.dll

- 2011-09-09 09:12 . 2011-09-09 09:12 599040 c:\windows\system32\dllcache\crypt32.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 217160 c:\windows\system32\dllcache\cmnclim.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 780885 c:\windows\system32\dllcache\chkrres.dll

- 2004-08-04 21:00 . 2011-09-09 09:12 599040 c:\windows\system32\crypt32.dll

+ 2004-08-04 21:00 . 2011-09-28 07:06 599040 c:\windows\system32\crypt32.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 2178131 c:\windows\system32\dllcache\shvlres.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 1175635 c:\windows\system32\dllcache\hrtzres.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 1039955 c:\windows\system32\dllcache\cmnresm.dll

+ 2011-11-14 19:38 . 2001-08-30 10:30 1817687 c:\windows\system32\dllcache\bckgres.dll

+ 2010-01-25 19:37 . 2011-12-08 02:40 50295240 c:\windows\system32\MRT.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 40960]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoRecentDocsNetHood"= 01000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-18 14:58 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]

2006-03-23 12:13 77824 ----a-w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]

2006-03-23 12:17 118784 ----a-w- c:\windows\system32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]

2006-03-23 12:17 94208 ----a-w- c:\windows\system32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]

2011-08-31 22:00 449608 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]

2005-10-11 17:23 1187840 ----a-w- c:\windows\SMINST\Recguard.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]

2008-08-08 05:03 524288 ----a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Lavasoft Ad-Aware Service"=3 (0x3)

"ERSvc"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

.

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/27/2011 9:10 AM 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/27/2011 9:10 AM 22216]

S4 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S4 MpKslbb486b8f;MpKslbb486b8f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{375F8844-661F-41FC-BB49-209573DBDB56}\MpKslbb486b8f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{375F8844-661F-41FC-BB49-209573DBDB56}\MpKslbb486b8f.sys [?]

S4 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe --> c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [?]

.

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = <local>

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-12-28 11:52

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????Y??????`?@?????L?@

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(1816)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2011-12-28 11:54:43

ComboFix-quarantined-files.txt 2011-12-28 17:54

ComboFix2.txt 2011-12-12 21:57

ComboFix3.txt 2011-12-07 16:41

ComboFix4.txt 2011-11-27 02:51

ComboFix5.txt 2011-12-28 17:47

.

Pre-Run: 26,783,326,208 bytes free

Post-Run: 26,766,581,760 bytes free

.

- - End Of File - - C3238264DA10526ED9DA0633B77070B3

Link to post
Share on other sites
Kalecocat

Kalecocat

Posted
  • Author
Posted

Can you post the log from RKill after you use it to get things back to normal please?

Your notification email dated 12-30-11 7:09 pm arrived on my other machine last night(1-2-2012) sometime after I went to bed. Don't know whats happening to cause the delay, but that's why my delay in responding. This response is being written on the machine we've been working on, so we're making progress!

Here's the log. For your information, this time after bootup and starting rkill, it took over 5 minutes to release the machine so this log could display. Also, lately it has been more common that rkill reports nothing terminated. Thanks, Mike

-----------------------------------------------------------------------------------

This log file is located at C:\rkill.log.

Please post this only if requested to by the person helping you.

Otherwise you can close this log when you wish.

Ran as Katherine on 01/02/2012 at 14:10:11.

Processes terminated by Rkill or while it was running:

c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe

C:\DOCUME~1\KATHER~1\LOCALS~1\Temp\RarSFX3\h\iexplore.exe

C:\DOCUME~1\KATHER~1\LOCALS~1\Temp\RarSFX1\h\iexplore.exe

C:\DOCUME~1\KATHER~1\LOCALS~1\Temp\RarSFX3\h\iexplore.exe

Rkill completed on 01/02/2012 at 14:10:19.

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Do these files still exist?

C:\documents and settings\KATHER~1\LOCALSETTINGS\Temp\RarSFX1\h\iexplore.exe

C:\DOCUME~1\KATHER~1\LOCALS~1\Temp\RarSFX3\h\iexplore.exe

If so, zip them up and attach them here.

Run TFC by OldTimer to clear temporary files:

  • Please download TFC from here and save it to your desktop.
  • Close any open programs and Internet browsers.
  • Double click TFC.exe to run it and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  • Please be patient as clearing out temp files may take a while.
  • Once it completes you may be prompted to restart your computer, please do so.
  • Once it's finished you may delete TFC.exe from your Desktop or save it for later use for the cleaning of temporary files.

Reboot. If the problem persists, uninstall Microsoft Security Essentials. Reboot. See if the problem persists. Reinstall it.

Link to post
Share on other sites
Kalecocat

Kalecocat

Posted
  • Author
Posted

Do these files still exist?

C:\documents and settings\KATHER~1\LOCALSETTINGS\Temp\RarSFX1\h\iexplore.exe

C:\DOCUME~1\KATHER~1\LOCALS~1\Temp\RarSFX3\h\iexplore.exe

If so, zip them up and attach them here.

Run TFC by OldTimer to clear temporary files:

  • Please download TFC from here and save it to your desktop.
  • Close any open programs and Internet browsers.
  • Double click TFC.exe to run it and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  • Please be patient as clearing out temp files may take a while.
  • Once it completes you may be prompted to restart your computer, please do so.
  • Once it's finished you may delete TFC.exe from your Desktop or save it for later use for the cleaning of temporary files.

Reboot. If the problem persists, uninstall Microsoft Security Essentials. Reboot. See if the problem persists. Reinstall it.

I've attached the file that I zipped from C:\documents and settings\KATHER~1\LOCALSETTINGS\Temp\RarSFX1\h\iexplore.exe.

The C:\documents and settings\KATHER~1\LOCALSETTINGS\Temp\RarSFX3\h\iexplore.exe does not exist, but there is an Iexplore file that looks to be identical in C:\documents and settings\KATHER~1\LOCALSETTINGS\Temp\RarSFX2\h\iexplore.exe.

I'll run TFC and report back.

Link to post
Share on other sites
Kalecocat

Kalecocat

Posted
  • Author
Posted

Before I went to the website to get TFC, I updated MS Security Essentials and Mbam. Mbam failed the update. It appeared to download the definition file, but the error occurred when trying to install. The error was "PROGRAM_ERROR_LOAD_DATABASE (2,2, CreateSDK) The system cannot find the file specified.".

I went ahead and downloaded and ran TFC. As expected, it removed all the temp and temporary internet folders and the files including the iexplore files.

I can't even access MBAM. I get the same error message. I uninstalled MBAM and tried to re-install, but that also failed with the same error message. I uninstalled Security Essentials but nothing changed.

Worse yet, my other machine that we have been working on is now giving the same error message when I try to access MBAM.

Link to post
Share on other sites
Kalecocat

Kalecocat

Posted
  • Author
Posted

Update to the last post (above): I was able to download the latest version (1.60.0.1800) of MBAM onto the non-Compag, desktop machine that we have been working on and updated the definition version. I ran a scan on that machine, but it found nothing.

Using a flash drive I copied the new MBAM to the laptop Compaq and installed it, seemingly okay. But when I tried to "Enable" the Protection Mode, Windows displayed an error (1072,0, ProtectionEnable) "Specified service marked for deletion". (Repeatedly).

Quit in disgust and left the machine alone for an hour or so. Came back and easily "Enable"ed protection Mode!! Ran a Flash scan, found nothing. Running a full scan now, will report results when complete.

Link to post
Share on other sites
Kalecocat

Kalecocat

Posted
  • Author
Posted

Hi,

Did you try uninstalling Microsoft Security Essentials temporarily as I mentioned above?

The file uploaded does not appear to be malicious:

http://www.virustotal.com/file-scan/report.html?id=22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f-1326225523

Yes, I did. See #32 above. The desktop machine seems to be okay, now. Keeping my fingers crossed. It was "locking up" when I tried to re-run TFC, but after I uninstalled Security Essentials it seemed to be okay. I think S.E. was updating itself and then went into a scan. I don't seem to be able to control it's updating itself even though I've set it so it supposedly needs to be done manually, no auto stuff. That was the main reason I had switched to Comodo. I uninstalled Comodo and now have only S.E. but, if it doesn't behave I'm going to switch back to Comodo again.

I'm now mostly concerned with getting the Compaq laptop cleaned so it quits "locking up" every time it boots. It's still the same situation it was when we started, but now it has a new wrinkle. I was just now trying to verify that Security Essentials was properly set for no automatic updates nor scans, but the "History" and "Settings" tabs are dimmed out and won't allow access.

I probably should just uninstall and re-install, but I'll wait for instructions from you. Mike

Link to post
Share on other sites
Kalecocat

Kalecocat

Posted
  • Author
Posted

Hi Chris,

I think I've found the reason both of these machines are "locking up" at bootup. If I uninstall either Security Essentials or Malwarebytes Pro, there is no "locking up" and everything else seems to work okay. Either one will run just fine by itself, but if I install the other one, the problem occurs. I've tested this several times on both machines and the result is the same. It appears there is a conflict between them.

Before we contracted the rootkit.zero.access and Zentom, the programs coexisted just fine with the current settings they both have.

I won't do anything else to either machine until you give me instructions. Thanks, Mike.

Link to post
Share on other sites
mancillaj

mancillaj

Posted
Posted

Mike & Chris,

Was reading over your posts, felt I was the one writing them, I was having the same issues.

When I read your last post about Malwarebytes, I remembered that a couple years ago I had the same problem with my system locking up, removed Malwarebytes and it corrected the problem.

So, I uninstalled Maylwarebytes and now my system is working fine.

Thanks again for letting us know that your system was fixed and how it was corrected. Out of all the posts, the last one gave me the answer I needed.

Thanks again!!

Steve

Link to post
Share on other sites
Kalecocat

Kalecocat

Posted
  • Author
Posted

Hi Steve,

Thanks for the comment. Glad somebody was able to get some good out of this mess! It's been over two months since screen317 started helping me. I hope he continues to assist me by cleaning up the machines and getting Security Essentials to run with Malwarebytes (especially since I've paid for it!). They were working together just fine before the attack, so I know they can. I also need to remove the tools we loaded on here but I don't think I should without supervision, I might cause more damage. If he doesn't drop by in the next couple of days, I'll try to contact another helper to finish his job. See ya', Mike

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Hi,

I believe setting up exclusions between both programs will allow them to coexist once more. :)

Do all of the following which applies to you.

Set Exclusions for Malwarebytes' Anti-Malware in Microsoft Security Essentials on 32 bit Windows Versions:

  1. Open Microsoft Security Essentials and click on Settings at the top
  2. Click on Excluded processes on the left
  3. Click on the Browse... button
  4. Click on the + next to your primary hard drive (usually C:)
  5. Click on the + next to Program Files
  6. Click on the + next to Malwarebytes' Anti-Malware
  7. Click once on mbam.exe and click on OK
  8. Repeat steps 3-7 for the following files:
    • C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    • C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  • Click on the Add button
  • Click on Save at the bottom and click Continue if prompted
  • Close Microsoft Security Essentials
    Set Exclusions for Malwarebytes' Anti-Malware in Microsoft Security Essentials on 64 bit Windows Versions:

  1. Open Microsoft Security Essentials and click on Settings at the top
  2. Click on Excluded processes on the left
  3. Click on the Browse... button
  4. Click on the + next to your primary hard drive (usually C:)
  5. Click on the + next to Program Files (x86)
  6. Click on the + next to Malwarebytes' Anti-Malware
  7. Click once on mbam.exe and click on OK
  8. Repeat steps 3-7 for the following files:
    • C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    • C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

  • Click on the Add button
  • Click on Save at the bottom and click Continue if prompted
  • Close Microsoft Security Essentials
    Set Exclusions for Microsoft Security Essentials in Malwarebytes' Anti-Malware:

  • Open Malwarebytes' Anti-Malware and click on the Ignore List tab
  • Click the Add button on the lower left
  • In the small browse window that opens, navigate to C:\Program Files and click once on Microsoft Security Essentials and click OK
  • Close Malwarebytes' Anti-Malware

Set Exclusions for Microsoft Security Essentials 2.x in Malwarebytes' Anti-Malware:

  • Open Malwarebytes' Anti-Malware and click on the Ignore List tab
  • Click the Add button on the lower left
  • In the small browse window that opens, navigate to C:\Program Files and click once on Microsoft Security Client and click OK
  • Close Malwarebytes' Anti-Malware

Link to post
Share on other sites
  • 1 month later...
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.