Windows 10 mbamswissarmy.sys causing automatic repair loop

[alevanidov]

Hi,

This morning I woke up to my laptop finishing a Win 10 update, but a few things seemed wrong. At first there was no audio, so I restarted. Then the audio was way too loud, so I thought something might be wrong with the driver, and I restarted. This whole time, Malwarebytes was trying to download an update, same as it usually does every so often. After I finally gave in and updated, I restarted again. After that, I got a BSOD saying mbamswissarmy.sys was corrupted and that Windows 10 was gathering data to try to repair.

The repair failed and now I'm in an automatic repair loop, where the repair fails and directs me to a Logfile called SrtTrail.txt or something. I don't have any restore points to go back to, and resetting the computer "keeping personal files" fails instantly too. I can access the command prompt, though it's a bit weird because it says X:\windows\system32> when I thought my hard drive was C:\. 

But I've seen other topics about this get resolved here with some kind of FRST tool? I do have an external hard drive with some free space on it that I can use as a USB drive. If there's a way to fix this issue, I'd greatly appreciate any help. Thanks!

[kevinf80]

Hello alevanidov and welcome to Malwarebytes,

Download and save FRST or FRST64 (depending on your version of windows) to a USB flash drive from the following link: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ Next, Boot sick PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference... https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html Next, From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 From that window select "Troubleshoot" From the next window select "Advance Options" From that Window select "Command Prompt" Ensure to plug the flash drive into a USB port... You should now be in Recovery Environment with the Command Prompt Window open...... Continue with the following:   Select Command Prompt In the command window type in notepad and press Enter. The notepad opens. Under File menu select Open. Select "Computer" or "My PC" and find your flash drive letter and close the notepad. In the command window type E:\frst64 or E:\frst depending on your version. Press Enter Note: Replace letter E with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply. Thank you, Kevin..

Edited January 16, 2018 by kevinf80
typing error

[kevinf80]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

[kevinf80]

@alevanidov Have reopened your thread as requested...

[alevanidov]

@kevinf80 here's the FRST.txt file from the scan.

FRST.txt

[kevinf80]

Hello alevanidov.

From your spare PC Save the attached file fixlist.txt to your flash drive, same place as FRST.

Plug Flashdrive back into Sick PC, Run System Recovery Options as you did to get the log.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Try rebooting your system to Normal mode, does that happen...?

fixlist.txt

[alevanidov]

Hi Kevin, I've been out of town for a couple days without the sick PC but will try this asap tomorrow. Thanks!

[kevinf80]

Thanks for the update alevanidov, post log when you are ready...

Kevin...

[alevanidov]

I ran the fix, here's the Fixlog.txt file. However, restarting the PC to Normal mode didn't work - when I restarted, it just went back to saying "Preparing Automatic Repair", then "Diagnosing your PC" then into the blue screen that says Automatic Repair and "Your PC did not stat correctly". Same issue as before.

Let me know if there's something else I can do - thanks!

 

Fixlog.txt

[kevinf80]

That fix restored your system back to status as of 13th Jan 2018... Can you go back to reply #2 follow those instructions again, When you get to the "Advanced Options" select "System Restore" instead of "Command Prompt".

From there follow the prompts and restore your system back prior to the Windows Update being installed...

Thank you,

Kevin

[alevanidov]

It says there aren't any restore points to go back to. Is that fix supposed to create a restore point to go back to? Or does it restore my system to its status on Jan 13 and then allow it to restore only IF there was already an existing restore point?

Edited January 19, 2018 by alevanidov

[kevinf80]

The initial scan by FRST looks into the system and lists the last successful registry backup made by the system. It is shown like so in the log LastRegBack: 2018-01-13 01:39

That is what we used with the fix, so all five hives were replaced from a back up created by the system. As that has not worked probably the best way forward is to run a system refresh. The refresh option does save all of your files, videos, pictures etc etc...

Follow option one from here: https://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html

[alevanidov]

The refresh option doesn't work, if I click "Reset PC" and "Keep my files" it just tries to do so for about a second and then just says "There was a problem resetting your PC" and makes me cancel it.

That's the option you're talking about right? Let me know if there's any other option here, because otherwise I might just try to physically unscrew the bottom of the laptop, remove the hard drive, copy what I need to another PC, and then reset this PC with "removing my files." Assuming even that option would work. But that's a last resort.

[kevinf80]

I`m very surprised Refresh did not work, basically windows is reinstalled but all personal stuff is saved. Reset is the same, only difference being nothing is saved.

What exactly happens when you try to boot normally, also what is the make and model of your laptop.

[alevanidov]

So the make and model is a Sony Vaio svf14a190x. When it boots up it goes into a black Vaio loading screen that says "Preparing Automatic Repair", then a command prompt window flashes for half a second, then it goes into the same black Vaio screen which now says "Diagnosing your PC", and then immediately into the blue screen recovery mode that says something like There was a problem repairing your PC. That's where all the options from above like the command prompt are.

HOWEVER, sort of good news, I found out that this Vaio model has a small physical button labeled "Assist" that I've never used before, and booting up by pressing that button instead of the power button led to a whole new recovery menu I'd never seen before. It has a lot of the same options as before (I.e. Refresh still doesn't work) but there's a "Vaio rescue mode" in there which has let me select all the files and folders I want to rescue before resetting the PC. I'm currently waiting on a new external hard drive to be delivered (it was supposed to get here yesterday, now estimated today) so I can try using it to save most of my files before just reinstalling Windows using this new menu.

Hopefully that actually works! Thank you for your patience with all this so far, if it works I'll reply back here to resolve the thread. 

[kevinf80]

Hello again alevanidov,

Yes does sound like good news, sometimes a full reset is the best way forward. Obviously all important data must be saved before making the reset happen.

Let me know how things pan out, i`ve never heard of that "Assist" option you mention.

Thank you,

Kevin..

Edit - you might find this link useful :- https://esupport.sony.com/US/p/model-home.pl?mdl=SVF14A190X

Edited January 21, 2018 by kevinf80
added information link

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks