Jump to content

MBAM the application was unable to start correctly 0xc0000279

EffWerd

By EffWerd
in Resolved Malware Removal Logs

 Share

Recommended Posts

EffWerd

EffWerd

Posted
Posted

Hi,

I'm having issues getting MBAM or MBAM Clean to run.  I keep getting this error "the application was unable to start correctly 0xc0000279".

It seems to be only affecting the operation of MBAM however no other malware detection programs seem to be able to pick up on anything.

I usually only run MBAM and Windows Defender, but I downloaded AVG and tried scanning with that and also the ESET online scanner which turned up nothing.

I've tried running Rkill, TDSSKiller.  And also FRST in and outside of windows.

Computer specs:

OS Name    Microsoft Windows 10 Home
Version    10.0.14393 Build 14393
Other OS Description     Not Available
OS Manufacturer    Microsoft Corporation
System Name    KEVSLAPTOP
System Manufacturer    Hewlett-Packard
System Model    HP ENVY 17 Notebook PC
System Type    x64-based PC
System SKU    F7P64PA#ABG
Processor    Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz, 2401 Mhz, 4 Core(s), 8 Logical Processor(s)
BIOS Version/Date    Insyde F.68, 22/07/2016
SMBIOS Version    2.7
Embedded Controller Version    147.82
BIOS Mode    UEFI
BaseBoard Manufacturer    Hewlett-Packard
BaseBoard Model    Not Available
BaseBoard Name    Base Board
Platform Role    Mobile
Secure Boot State    On
PCR7 Configuration    Binding Not Possible
Windows Directory    C:\WINDOWS
System Directory    C:\WINDOWS\system32
Boot Device    \Device\HarddiskVolume2
Locale    New Zealand
Hardware Abstraction Layer    Version = "10.0.14393.206"
User Name    Kevslaptop\Kevin
Time Zone    New Zealand Daylight Time
Installed Physical Memory (RAM)    8.00 GB
Total Physical Memory    7.93 GB
Available Physical Memory    5.50 GB
Total Virtual Memory    9.18 GB
Available Virtual Memory    6.63 GB
Page File Space    1.25 GB
Page File    C:\pagefile.sys
Hyper-V - VM Monitor Mode Extensions    Yes
Hyper-V - Second Level Address Translation Extensions    Yes
Hyper-V - Virtualization Enabled in Firmware    No
Hyper-V - Data Execution Protection    Yes
 

 

Log files are attached.

Any help would be much appreciated.

Cheers

Addition.txt

FRST.txt

Rkill.txt

Addition - recovery mode.txt

FRST - recovery mode.txt

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted (edited)

Hello,

 

Check Disk

  • Press the WindowsKey.png on your keyboard. Type cmd and right click >> Run as Administrator.
  • Copy/Enter the command below and press Enter: 
  • chkdsk C: /r
  • You should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.
  • All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.


Check Disk report:

  • Press the WindowsKey.png + R on your keyboard at the same time. Type eventvwr and click OK.
  • In the left panel, expand Windows Logs and then click on Application.
  • Now, on the right side, click on Filter Current Log.
  • Under Event Sources, check only Wininit and click OK.
  • Now you'll be presented with one or multiple Wininit logs.
  • Click on an entry corresponding to the date and time of the disk check.
  • On the top main menu, click Action > Copy > Copy Details as Text.
  • Paste the contents into your next reply.

 

 

2eyjdoj.pngSystem File Checker

  • Press the WindowsKey.png on your keyboard. Type cmd and right click >> Run as Administrator.
  • Copy/Enter the command below and press Enter: 
  • sfc /scannow
  • Windows will begin with system scan.
  • When done, please reboot your system.


System File Checker report:

  • Press WindowsKey.png + R on your keyboard at the same time. Type cmd and click OK.
  • Copy/Enter the command below and press Enter: 
  • findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"
  • Attach sfcdetails.txt from your Desktop in your next reply.

 

 

Edited by TwinHeadedEagle
Link to post
Share on other sites
EffWerd

EffWerd

Posted
  • Author
Posted

Logs as requested:

 

 

Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          21/11/2016 3:18:22 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Kevslaptop
Description:


Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.

A disk check has been scheduled.
Windows will now check the disk.                         

Stage 1: Examining basic file system structure ...
  492032 file records processed.                                                        
File verification completed.
  16758 large file records processed.                                  
  0 bad file records processed.                                    

Stage 2: Examining file name linkage ...
  592928 index entries processed.                                                      
Index verification completed.
  0 unindexed files scanned.                                        
  0 unindexed files recovered to lost and found.                    

Stage 3: Examining security descriptors ...
Cleaning up 13 unused index entries from index $SII of file 0x9.
Cleaning up 13 unused index entries from index $SDH of file 0x9.
Cleaning up 13 unused security descriptors.
Security descriptor verification completed.
  50449 data files processed.                                          
CHKDSK is verifying Usn Journal...
  40892616 USN bytes processed.                                                          
Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
  492016 files processed.                                                              
File data verification completed.

Stage 5: Looking for bad, free clusters ...
  94295914 free clusters processed.                                                      
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.

Windows has made corrections to the file system.
No further action is required.

 953325770 KB total disk space.
 575342392 KB in 245807 files.
    163780 KB in 50450 indexes.
         0 KB in bad sectors.
    635938 KB in use by the system.
     65536 KB occupied by the log file.
 377183660 KB available on disk.

      4096 bytes in each allocation unit.
 238331442 total allocation units on disk.
  94295915 allocation units available on disk.

Internal Info:
00 82 07 00 b4 84 04 00 7d 2b 08 00 00 00 00 00  ........}+......
31 02 01 00 fb 7b 00 00 00 00 00 00 00 00 00 00  1....{..........

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-11-20T14:18:22.895205100Z" />
    <EventRecordID>5745</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Kevslaptop</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.

A disk check has been scheduled.
Windows will now check the disk.                         

Stage 1: Examining basic file system structure ...
  492032 file records processed.                                                        
File verification completed.
  16758 large file records processed.                                  
  0 bad file records processed.                                    

Stage 2: Examining file name linkage ...
  592928 index entries processed.                                                      
Index verification completed.
  0 unindexed files scanned.                                        
  0 unindexed files recovered to lost and found.                    

Stage 3: Examining security descriptors ...
Cleaning up 13 unused index entries from index $SII of file 0x9.
Cleaning up 13 unused index entries from index $SDH of file 0x9.
Cleaning up 13 unused security descriptors.
Security descriptor verification completed.
  50449 data files processed.                                          
CHKDSK is verifying Usn Journal...
  40892616 USN bytes processed.                                                          
Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
  492016 files processed.                                                              
File data verification completed.

Stage 5: Looking for bad, free clusters ...
  94295914 free clusters processed.                                                      
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.

Windows has made corrections to the file system.
No further action is required.

 953325770 KB total disk space.
 575342392 KB in 245807 files.
    163780 KB in 50450 indexes.
         0 KB in bad sectors.
    635938 KB in use by the system.
     65536 KB occupied by the log file.
 377183660 KB available on disk.

      4096 bytes in each allocation unit.
 238331442 total allocation units on disk.
  94295915 allocation units available on disk.

Internal Info:
00 82 07 00 b4 84 04 00 7d 2b 08 00 00 00 00 00  ........}+......
31 02 01 00 fb 7b 00 00 00 00 00 00 00 00 00 00  1....{..........

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
  </EventData>
</Event>

 

 

sfcdetails.txt

Link to post
Share on other sites
EffWerd

EffWerd

Posted
  • Author
Posted

The situation is the same unfortunately.

 

I was reading another post where you helped someone with the same issue.

You got them to run a fixlist through FRST outside of windows which seemed to resolve it for them.

Composing said fixlist and what exactly you had it do is beyond me.

Can we deconstruct MBAM outside of windows with FRST from the command prompt?

 

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

That was a different case, but who knows maybe it will be needed here too.

 

FRST.gif Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition.txt option is checked. option is checked.

    2873ryc.png

  • Press Scan button and wait.

  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.


Please attach report into your next reply.

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Sorry for delay. Let me know if this helped:

 

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif


icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

fixlist.txt

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.