inquiringmind Posted November 30, 2011 ID:499730 Share Posted November 30, 2011 A recent scan for hidden registry entries provided 6 hits related to mbamswissarmy.sys. See:Starting search for hidden objects.HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MBAMSwissArmy\type [NOTE] The registry entry is invisible.HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MBAMSwissArmy\start [NOTE] The registry entry is invisible.HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MBAMSwissArmy\errorcontrol [NOTE] The registry entry is invisible.\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sysC:\WINDOWS\system32\drivers\mbamswissarmy.sys [NOTE] The registry entry is invisible.HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MBAMSwissArmy\displayname [NOTE] The registry entry is invisible.HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MBAMSwissArmy\Security\security [NOTE] The registry entry is invisible.This was detected while my free, unregistered version of mbam was not open, and no mbam process was running.I cannot find the file mbamswissarmy.sys anywhere on my hard drive. It certainly is not among the mbam program files and is not in the windows/system32/drivers folder either.Am I infected with some sort of malware? Link to post Share on other sites More sharing options...
exile360 Posted November 30, 2011 ID:499732 Share Posted November 30, 2011 Greetings Please open Malwarebytes Anti-Malware and begin a scan (it can be a Quick scan or a Full scan, your choice) and while the scan is running, mbamswissarmy.sys should be present in C:\Windows\System32\drivers. MBAM simply removes the file when it isn't using it and then replaces it again when it is using it for a scan. Link to post Share on other sites More sharing options...
inquiringmind Posted November 30, 2011 Author ID:499734 Share Posted November 30, 2011 Greetings Please open Malwarebytes Anti-Malware and begin a scan (it can be a Quick scan or a Full scan, your choice) and while the scan is running, mbamswissarmy.sys should be present in C:\Windows\System32\drivers. MBAM simply removes the file when it isn't using it and then replaces it again when it is using it for a scan.I did, and that's exactly what happened. Thanks for the information and reassurance. Very clever! Link to post Share on other sites More sharing options...
exile360 Posted November 30, 2011 ID:499741 Share Posted November 30, 2011 You're welcome, if you need anything else please don't hesitate to post.Thanks Link to post Share on other sites More sharing options...
pixiedust Posted June 7, 2012 ID:558314 Share Posted June 7, 2012 I tried to locate the mbamswissarmy.sys in C:\Windows\System32\drivers on my Windows 7 64-bit laptop while running a free Malwarebytes scan but it doesn't appear. How do I find it? I'm trying to add the file to the Malwarebytes BartPE plugin by following the instructions here: file:///C:/pebuilder3110a/plugin/MalwareBytes%20Anti-Malware/MalwareBytes%20Anti-Malware.htm Link to post Share on other sites More sharing options...
exile360 Posted June 7, 2012 ID:558322 Share Posted June 7, 2012 I tried to locate the mbamswissarmy.sys in C:\Windows\System32\drivers on my Windows 7 64-bit laptop while running a free Malwarebytes scan but it doesn't appear. How do I find it? I'm trying to add the file to the Malwarebytes BartPE plugin by following the instructions here: file:///C:/pebuilder3110a/plugin/MalwareBytes%20Anti-Malware/MalwareBytes%20Anti-Malware.htmGreetings and welcome Currently we do not officially support using Malwarebytes Anti-Malware in any PE/bootable form or environment. That being said, mbamswissarmy.sys does not exist on x64 Windows versions.I hope that clears things up for you. Link to post Share on other sites More sharing options...
pixiedust Posted June 8, 2012 ID:558716 Share Posted June 8, 2012 mbamswissarmy.sys does not exist on x64 Windows versions.Yes it does! Thanks so much for the quick response and warm welcome! Link to post Share on other sites More sharing options...
exile360 Posted June 8, 2012 ID:558744 Share Posted June 8, 2012 You're welcome, I'm glad I could be of service . Link to post Share on other sites More sharing options...
Recommended Posts