mbam.sys cuauses system crash after login

[dalder]

I must have visited a site that dropped something in my computer as explorer started launching new windows and also when I did a google search and clicked on a link it would launch a different site but in the bottom status bar would first show the link fraudmanager or something like that so upon some quick searches I learned about deleting some things from the registry etc for example prunnet.exe etc. I then launch Malwarebytes and let it search for viruses over night ..before I went to bed it found about 20. When I woke up I saw the computer had rebooted to the log on screen upon logging in the computer crashes and says there is a problem witht the mbam.sys file

PAGE_FAULT_IN_NONPAGED_AREA

Ive rebooted a few times trying things like last best known windows, safe mode etc but everything crashes to the blue screen

any ideas on how to recover the system at least temporarily

[AdvancedSetup]

Hello and Welcome to Malwarebytes.org

If you're having Malware related issues with your computer that you're unable to resolve.

1. Please read and follow the instructions provided here: I'm infected - What do I do now?
2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
   
3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.
   

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review
  

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.
  

[dalder]

I have looked at the tools you have but its not possible for me to install anything because the system crashes as soon as I get pass the logon screen the file thats causing the crash is mbam.sys so what do you suggest I do

thanks

[dalder]

Ive looked at the help section of this site but could not find a solution. So am reposting the message below.

I must have visited a site that dropped something in my computer as explorer started launching new windows and also when I did a google search and clicked on a link it would launch a different site but in the bottom status bar would first show the link fraudmanager or something like that so upon some quick searches I learned about deleting some things from the registry etc for example prunnet.exe etc. I then launch Malwarebytes and let it search for viruses over night ..before I went to bed it found about 20. When I woke up I saw the computer had rebooted to the log on screen upon logging in the computer crashes and says there is a problem witht the mbam.sys file

PAGE_FAULT_IN_NONPAGED_AREA

Ive rebooted a few times trying things like last best known windows, safe mode etc but everything crashes to the blue screen

any ideas on how to recover the system at least temporarily

[dalder]

Ive not been able to use my computer for a few days because mbam.sys is crashing the computer upon logging in you would think the support team might offer some suggestions. To date theres been no useful answers. At this point it seems malwarebytes takes your money and provides lousy support and yes I paid for my version.

[GT500]

Ive not been able to use my computer for a few days because mbam.sys is crashing the computer upon logging in you would think the support team might offer some suggestions. To date theres been no useful answers. At this point it seems malwarebytes takes your money and provides lousy support and yes I paid for my version.

First, please note that the forums are not our helpdesk. While I do make an attempt to reply to everyone in the general forum who is not already getting help, some people get overlooked when I see there have been multiple replys, but don't realize that there was no real answer given.

Now, are you able to start your computer in Safe Mode?

[TeMerc]

dalder under what name have you been getting support at the help desk?

A search for your name and the error you have posted here does not return any results in our support system.

Please tell us what name or email you've been using in the support system and who's been helping you.

As of this very second there are no unanswered support tickets.

[dalder]

im not sure how to post a support ticket as the only info Ive seen has passed me to this support site.

I purchased the upgrade for this software under the name Don Alder. No one has been helping me thats why I made the post. Sorry for not understanding your system its quite different from other systems Ive been on where support was required.

dalder under what name have you been getting support at the help desk?

A search for your name and the error you have posted here does not return any results in our support system.

Please tell us what name or email you've been using in the support system and who's been helping you.

As of this very second there are no unanswered support tickets.

[GT500]

im not sure how to post a support ticket as the only info Ive seen has passed me to this support site.

You have not been to our contact page?

I purchased the upgrade for this software under the name Don Alder. No one has been helping me thats why I made the post. Sorry for not understanding your system its quite different from other systems Ive been on where support was required.

No problems, we were just a little confused as to why you were on the forums when we have a separate helpdesk system.

Do you want to open a ticket on our helpdesk, or would you rather work through this forum topic?

[dalder]

youre absolutely right, not sure how I missed that. I dont recall seeing that option on the contact page but I may have been in a panic.

I did create a user account but we can do it here.

I didnt think I was going to hear back from anyone so I took action on my own last night which may lead to some different problems not related to your software. I was trying to get command prompt from an xp cd but couldnt so ended up trying the repair function which I forgot wipes out everything and does a reinstall. However when I went to login it asked for a activation code which I dont have. The OS was installed years ago and I no longer have that disk. I used and XP disc from our office Dell Laptop, they provide a serial number but no activation code so not sure how Im going to deal with that. Once Im able to login Ill see if the system still crashes. I now also have a CD that I can boot to a prompt so can then delete the mbam.sys file to stop the machine from crashing post login. Would thhat be the correct way to go about this.

thanks

You have not been to our contact page?

No problems, we were just a little confused as to why you were on the forums when we have a separate helpdesk system.

Do you want to open a ticket on our helpdesk, or would you rather work through this forum topic?

[GT500]

The easiest first step is always Safe Mode. If that does not work, then a disk such as BartPE can be used to disable MBAM services, and even delete mbam.sys if needed.

Does your computer not have a product code on the side? As long as you use an OEM disk for the same edition of Windows, that product code on the side of your computer should work.

[dalder]

A friend of mine gave me a BartPE disk what a lifesaver. Yes after putting the activation code the machine crashed again on the mbam.sys so I renamed it to not be part of the .sys files and the machine came back to life but with a lot of viruses. Malwarebytes was showing and error code so I upgraded it and then cleaned the system a few times with it. I also have another detection tool that found a few other things. So looks like Im back on track. Can you tell me what mbam.sys is I thought it was part of the malwarebytes software

cheers

The easiest first step is always Safe Mode. If that does not work, then a disk such as BartPE can be used to disable MBAM services, and even delete mbam.sys if needed.

Does your computer not have a product code on the side? As long as you use an OEM disk for the same edition of Windows, that product code on the side of your computer should work.

[GT500]

Can you tell me what mbam.sys is I thought it was part of the malwarebytes software

It's one of our drivers. I think it's part of the protection module, so it's not required to scan for and remove malware.

Now that you've gotten your computer working, and have been able to run MBAM, please download HijackThis from this link, run a scan, and copy and paste the contents of the log file into a reply. I'll be able to suggest some more steps after taking a look at that log.

[dalder]

Well the plot thickens I was getting ready to send you logs. I just wanted to make sure that I did thorough scan of the system. I did see 2 trogans returning so once again got the latest update for malwarebytes then ran an overnight scan and then next morning I was back at the logon screen I went to login and a few seconds later is said I was logging out. I reboot the computer, I turned off etc and when I login it I only get the messasge that Im logging out. Is the 2nd time that when I ran malwarebytes and left it overnight that the system was somehow totally taken over is this just a coincidence or is does leaving malwarebytes running expose an opening to a threat just so weird

Sooo not sure what to do any suggestions. I do have PEBART but not sure what to do with it at this point

It's one of our drivers. I think it's part of the protection module, so it's not required to scan for and remove malware.

Now that you've gotten your computer working, and have been able to run MBAM, please download HijackThis from this link, run a scan, and copy and paste the contents of the log file into a reply. I'll be able to suggest some more steps after taking a look at that log.

[GT500]

That's a problem with userinit.exe but the question here is whether it's a problem with the file, or with the registry entry.

Let me look at RegAlyzer, and see if I can get the blasted thing to work like it's supposed to from a BartPE disk, and I'll give you a download link.

[GT500]

I'm waiting on the Safer Networking team to say something about why RegAlyzer won't work right from BartPE. I'll see if there is another registry editor that works from BartPE.