Windows 10: Farbar

Hello,
I am having problems on my wife's computer in that MBAM takes all the CPU and most of the memory at times. After trying to fix it, I finally had to remove it. I am also running NIS 2015.
On the MBAM forum it is advised to use a program called FSRT.exe downloaded from bleeping computers. When I tried this NIS prevented it from downloading and deleted it. I was advised to disable NIS and download it, which I did. At this time Windows Smartscreen advised not to run it as it was malware. I ran SuperAntispyware after downloading another copy and it deleted it. Tried again and Hitmanpro stated it was suspicious and deleted it. When I finally tried to run it, it pops up a window with a warning that the program is used "as is" and at own risk. It is unsigned or certified.
I am very wary about using it. I've been told it has been used frequently and is a necessary part of the MBAM troubleshooting process.
I am in a quandary as I don't believe everything I am told on the internet *Huh.
Any advise gratefully appreciated.

:)

 

Something keeps resetting proxy settings

I have now resolved the issue. Here is the solution in case someone has the same problem.

A Malwarebytes scan found and removed a trojan. I then ran a Farbar Recovery and Scan Tool (FRST) to fix the damage it had caused.

Laptop is now healthy again.

thanks ...

 

What can I do to restore the optimum utility of Windows Media Player?

Howtogeek how to reset windows media player, Tech-recipes reset windows media player file associations, Windows Repair, Junkware Removal Tool, Farbar recovery scan tool. Thank you for your interest.

(signed) James Worrell

 

Hi, again:*Smile

FRST is a safe, non-invasive scanning tool that has been downloaded nearly 2 million times from its host site.

Please see here and here (and here).

It is a FALSE POSITIVE for Norton to detect FRST as malicious.
It is not uncommon for it to do so, as the AVs don't bother to whitelist it or many of the other, commonly used security and diagnostic scanners.

Thank you,

 

Hey there MM,
I certainly appreciate your time and effort. It is just that with so many AV's listing it as malware or warning against it's use, I would think that the author or MBAM would do something to bring it into a more mainstream certified and signed state. To a point where the program itself doesn't have to warn you that you are taking all risks in your own hands and not theirs.
Hoping to get more of a consensus on it's use and safety!

 

Hi:

As I mentioned in your thread at MBAM forum, a bit of skepticism is healthy.

But Norton is notorious for false-positive detections on harmless tools.
See here
And we are just going around in circles.*Sad

For the record, even though @farbar is an expert at Malwarebytes forum, the FRST tool itself is not a "malwarebytes" tool.
So, they do not "sign" it or host it.

Alas, support is a two-way endeavor.
Both @AdvancedSetup (our forum root Admin with > 30 years of computer support experience) and I have tried to assist you.
We have more than 80,000 posts between us at the MBAM forum.
But we are not magicians.*Sad
There is no way to know why MBAM is causing issues on your wife's laptop without a tiny smidgen of basic system information provided by the FRST tool.
Assuming the computer is neither damaged nor infected, we probably could have resolved the issue days and days ago.

If you are not comfortable running FRST, then I suggested a number of support alternatives here, including a proper clean reinstall with mutual exclusions and opening a ticket at the MBAM Help Desk.

I've taken up enough of your time and mine over the past week, and we are still at the same point we were at the very start. So I will now turn this over to other forum members for help.

I'm sorry I could not resolve your issues.

Good luck and take care,

MM

 

As noted, it seems as if this is such a well used program and a necessary adjunct to troubleshoot a paid product, there would be more effort to stop numerous AV and malware programs as reputedly mislabeling it. Hitmanpro uses quite a number of different av scanners and it also came back in the negative. As posted several times, NIS is not the only program to question FRST.
I did start a support ticket and did use the MBAM tool and sent it's log.
I am sorry that circumstances could not let me accept your assistance.
Good Luck to you also!

 

Does anyone have experience with Farbar Recovery Scan Tool? Again looking to this forum for it's wealth of wisdom and experience.
It seems as if this may be the only way I can attempt to troubleshoot Malwarebytes Anti-malware problem that completely freezes up my wife's computer.
Help!?!!?

 

My advice is to go back to the mbam forums and disable Norton and run FRST. It is not a virus or malicious in any way.

This is the current Virus Total scan of the tool
the first 2 results are from companys that dont count.
https://www.virustotal.com/ro/file/d...is/1452033371/

The tool uses auto it to process and a lot of tools block Auto It because I can be used maliciously But FRST is NOT going to harm your computer.

I work on computers for a living also and have been using it for a long time.

 

Hello Porthos,
Thank you very much for the information. Strangely both Symantec and SuperAntispyware flagged and deleted the program, even though they are listed on that Virus Total Page, also Hitman Pro called it suspicious. It was these things and the fact that no other than yourself would attempt to say more than go ahead and use it "it's safe".
Much appreciated

 

Assuming reasons MBAM telling you to download and use this software from reading about it, you would either have network connectivity issues, corrupted or missing windows files or services, possible Malware and creates a log. So far you used NIS, SuperAntiSpyware, MBAM and they have not found any Malware. Just trying to figure the exact reasons of this tool they told you to use, not stated here. If Windows is corrupt run a System file checker.


http://www.bleepingcomputer.com/down...rvice-scanner/

 

The service scanner is a different tool and is not what is being requested.

 

It is a false reading. If I plugged my my USB into your Norton "protected" computer It would delete several of my legit diagnostic and repair tools as soon as I opened the drive.

 

O.k. i see it now...........

Farbar Recovery Scan Tool (FRST) is a portable diagnostic tool incorporating the ability to execute prepared script solutions on malware infected machines. It will work equally well in normal or safe mode and where a machine has boot up problems it will work efficiently in the Windows Recovery Environment. It's ability to work in the recovery environment makes it particularly useful in dealing with problems associated with machines experiencing difficulty when booting up.

Either assuming another Malware that MBAM or Norton can not fix or boot up issues.

Guess you should try then posting this in MBAM Forum, i also work here too and they are good at Malware and Virus removal Geeks to Go - Free help from tech experts

 

Here is some more explanation on the detection's of these tools.

Certain embedded files that are part of legitimate programs or specialized fix tools, may at times be detected by some anti-virus and anti-malware scanners as suspicious, a Risk Tool, Hacking Tool, Potentially Unwanted Program, a possible threat or even Malware (virus/trojan) when that is not the case. This occurs for a variety of reasons to include the tool's compiler, the files it uses, whether files are compressed or packed, what behavior (routines, scripts, etc) it performs, any registry strings it may contain and the type of security engine that was used during the scan. Other legitimate files which may be obfuscated, encrypted or password protected in order to conceal itself so they do not allow access for scanning but often trigger alerts by anti-virus software.

When flagged by an anti-virus or security scanner, it's because the program includes features, behavior or files that appear suspicious or which can potentially be used for malicious purposes. Compressed and packed files in particular are often flagged as suspicious by security software because they have difficulty reading what is inside them. These detections do not necessarily mean the file is malicious or a bad program. It means it has the potential for being misused by others or that it was simply detected as suspicious or a threat due to the security program's heuristic analysis engine which provides the ability to detect possible new variants of malware. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them. In these cases the detection is a "false positive" and can be ignored.

Most of the well known specialized tools we use as malware fighters are written by known experts at various security forums like Bleeping Computer, TechSupport, GeeksToGo, SypwareInfo and other similar sites so they can be trusted...this includes any program hosted by BC for download. Unfortunately, many of these tools are repeatedly falsely detected by various anti-virus programs from time to time.

The problem is really with the anti-virus vendors who keep targeting these embedded files and NOT with the tools themselves. We can inform the developers but they have encountered this issue many times before and in most cases there isn't much they can do about it. Once the detection is reported to the anti-virus vendor, they are usually quick to fix it by releasing an updated definition database.

If you're attempting to download the file, either have your anti-virus ignore the detection or temporarily disable it until you download and run the tool.