Cannot boot into windows after malwarebytes install

[uaegangster111]

Hi 

 

After installing malwarbytes in my my windows 10 I restarted then i got this massage . 

The operating system couldt be loaded because a critical system driver is missing or corrupted.  (attched)

File \WINDOWS\system32\DRIVERS\MbamElam.sys

FRST.TXT IS ATTACHED I NEED HELP . As i cant use my pc at all not even safe mode. 

 

 

[uaegangster111]

FRST result

 

Scan result of Farbar Recovery Scan Tool.doc

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

If at all possible can you start your computer in Safe Mode, with or without networking.
How to:
https://support.microsoft.com/en-ca/help/12376/windows-10-start-your-pc-in-safe-mode

Is successful please post the FRST and Addition.txt log in your next reply.

I need to see the logs in a .txt format.
Please use Notepad to save the file as .txt files.

[uaegangster111]

2 minutes ago, nasdaq said:

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

If at all possible can you start your computer in Safe Mode, with or without networking.
How to:
https://support.microsoft.com/en-ca/help/12376/windows-10-start-your-pc-in-safe-mode

Is successful please post the FRST and Addition.txt log in your next reply.

I need to see the logs in a .txt format.
Please use Notepad to save the file as .txt files.

Hi , I cannot boot into anything.  Only in windows Recovery environment.  It's says because or your driver at WINDOWS\system32\DRIVERS\MbamElam.sys is missing or corrupt.   

FRST.txt

[LiquidTension]

Hello,

I've moved this topic over to the Malwarebytes 3 Support section of the forum.

On the Recovery screen, press F8 to access Startup Settings. Once there, press the number corresponding to the Disable early launch anti-malware protection option. This should allow you to boot normally into Windows.

Let me know once you're in Windows and I'll provide follow-up instructions. Selecting this option only applies to one Windows session immediately after the next restart.

Edited February 8, 2019 by LiquidTension

[uaegangster111]

51 minutes ago, LiquidTension said:

Hello,

I've moved this topic over to the Malwarebytes 3 Support section of the forum.

On the Recovery screen, press F8 to access Startup Settings. Once there, press the number corresponding to the Disable early launch anti-malware protection option. This should allow you to boot normally into Windows.

Let me know once you're in Windows and I'll provide follow-up instructions. Selecting this option only applies to one Windows session immediately after the next restart.

Yes I can confirm that's it's fixed now. Now everytime I restart I should do this . Or there is a fix. BTW I have windows defender active.  Or why this happened to me ? 

[LiquidTension]

Thanks for the update! This is only a temporary measure whilst we determine the cause of the issue. We'll have a permanent solution for you.

In the meantime, we need to collect some additional information from the computer. Please carry out the instructions below on running the Malwarebytes Support Tool. Please ensure the Start Repair button is NOT clicked. After running the tool, click Advanced followed by Gather Logs.

Malwarebytes Support Tool (MBST)

• Please download MBST using the link below:
  → http://downloads.malwarebytes.com/file/mbst
• Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
• Double-click mb-support-#.#.#.###.exe to run the program.
• If prompted, place a checkmark next to Accept License Agreement and click Next.
• Do NOT click Start Repair.
• Click the Advanced menu on the left.
• Click Gather Logs.
• Upon completion, click OK.
• A file named mbst-grab-results.zip will be saved to your Desktop.
• Please attach the file in your next email reply.

Edited February 8, 2019 by LiquidTension

[uaegangster111]

5 minutes ago, LiquidTension said:

Thanks for the update! This is only a temporary measure whilst we determine the cause of the issue. We'll have a permanent solution for you.

In the meantime, we need to collect some additional information from the computer. Please carry out the instructions below on running the Malwarebytes Support Tool. Please ensure the Start Repair button is NOT clicked. After running the tool, click Advanced followed by Gather Logs.

Malwarebytes Support Tool (MBST)

• Please download MBST using the link below:
  → http://downloads.malwarebytes.com/file/mbst
• Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
• Double-click mb-support-#.#.#.###.exe to run the program.
• If prompted, place a checkmark next to Accept License Agreement and click Next.
• Do NOT click Start Repair.
• Click the Advanced menu on the left.
• Click Gather Logs.
• Upon completion, click OK.
• A file named mbst-grab-results.zip will be saved to your Desktop.
• Please attach the file in your next email reply.

There you go. 

mbst-grab-results.zip

[LiquidTension]

Thank you.

What was the reason for running Malwarebytes Support Tool (MBST) originally (prior to the issue)? Did you encounter any issues when you ran the tool for the first time?

Please recall your actions leading up to the issue.

Are the following points below accurate? If they are, please fill in the ??? so we can better understand what caused this issue.

• You already had Malwarebytes version 3.7.1 installed.
• You download and ran MBST, then clicked Start Repair.
• ???
• You restarted the computer and were met with the, "Your PC/Device needs to be repaired" message.
   

Do you have the mbst-clean-results.txt file created when you ran a repair with MBST? Was this file saved to your desktop at any point in time?

------

Please do the following:

Collect Troubleshooting Logs

• Please download collect_mbst_logs.bat using the link below.
  → https://malwarebytes.box.com/s/xpz34itvz4kqekayhoplqalehqh9eqnd
• Open your Downloads folder.
• Right-click collect_mbst_logs.bat and select Run as administrator to run the file.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A black Command Prompt window will appear.
• Upon completion, a file named mbst-logs.zip will be saved to your Desktop. Please attach the file in your next reply.
   

Event Logs

• Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
• Expand Windows Logs.
• Right-click Application and click Save All Events As.... Name the file application and click OK.
• Repeat for Security and System.
• Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
• Name the Zip file EventLogs.zip and attach the file to a forum post.

Edited February 8, 2019 by LiquidTension

[uaegangster111]

4 minutes ago, LiquidTension said:

Thank you.

What was the reason for running Malwarebytes Support Tool (MBST) originally (prior to the issue)? Did you encounter any issues when you ran the tool for the first time?

Please recall your actions leading up to the issue.

Are the following points below accurate? If they are, please fill in the ??? so we can better understand what caused this issue.

• You already had Malwarebytes version 3.7.1 installed.
• You download and ran MBST, then clicked Start Repair.
• ???
• You restarted the computer and were met with the, "Your PC/Device needs to be repaired" message.
   

Please do the following:

Collect Troubleshooting Logs

• Please download collect_mbst_logs.bat using the link below.
  → https://malwarebytes.box.com/s/xpz34itvz4kqekayhoplqalehqh9eqnd
• Open your Downloads folder.
• Right-click collect_mbst_logs.bat and select Run as administrator to run the file.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A black Command Prompt window will appear.
• Upon completion, a file named mbst-logs.zip will be saved to your Desktop. Please attach the file in your next reply.

 

well i was having "driver power state failure" on windows 10 every-time i click restart it will be stuck saying restarting then it would crash showing 'driver power state failure"

Then I add both exclusions for both malwarebytes and windows defender EXE'S together thinking it might fix the crash and yet it kept crashing.  then this happens.  This all happened after installing malwarebytes . To bad that the dump files are gone . When i checked in bluescreenview.exe its says that its in Ntoskrnl.Exe  

[uaegangster111]

There you go 

 

 

mbst-logs.zip

[LiquidTension]

Thank you for the information. Please try to answer all of my questions.

When you ran the Malwarebytes Support Tool for the first time and clicked Start Repair, did you encounter any issues with the tool? Were you prompted by the tool to restart the computer? If you were, what happened next?

Did the missing MbamElam.sys file message appear immediately after running a repair with the Malwarebytes Support Tool and rebooting?

Do you have the mbst-clean-results.txt file created when you ran a repair with MBST? Was this file saved to your desktop at any point in time?
 

Event Logs

• Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
• Expand Windows Logs.
• Right-click Application and click Save All Events As.... Name the file application and click OK.
• Repeat for Security and System.
• Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
• Name the Zip file EventLogs.zip and attach the file to a forum post.

[uaegangster111]

4 minutes ago, LiquidTension said:

Thank you for the information. Please try to answer all of my questions.

When you ran the Malwarebytes Support Tool for the first time and clicked Start Repair, did you encounter any issues with the tool? Were you prompted by the tool to restart the computer? If you were, what happened next?

Did the missing MbamElam.sys file message appear immediately after running a repair with the Malwarebytes Support Tool and rebooting?

Do you have the mbst-clean-results.txt file created when you ran a repair with MBST? Was this file saved to your desktop at any point in time?
 

Event Logs

• Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
• Expand Windows Logs.
• Right-click Application and click Save All Events As.... Name the file application and click OK.
• Repeat for Security and System.
• Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
• Name the Zip file EventLogs.zip and attach the file to a forum post.

Yes i clicked Start Repair and i restarted but same thing happened , it crashed while showing "restarting" giving "driver power state failure" . Then i manged to boot in to windows. The last i remember doing was turning off exploit protection and web protection then the problem happened i could not boot in into windows. 

EventLogs.zip

[LiquidTension]

Okay, to summarise:

• You clicked Start Repair.
• Clicked OK to the MBST reboot prompt
• The machine went to restart, but blue screened again (DRIVER_POWER_STATE_FAILURE).
• You restarted the machine again and it booted back into Windows.
• Did the Malwarebytes Support Tool open back up and reinstall Malwarebytes?
• You opened Malwarebytes and proceeded to turn off Exploit Protection and Web Protection.

How did you get from here to the MbamElam.sys missing message?
When you tried to turn off Web Protection, did the computer blue screen again and upon restarting, presented you with the MbamElam.sys missing message?

-----

Let's take a closer look at the dump files generated from the blue screens.

• Please navigate to C:\Windows.
• Right-click MEMORY.dmp and click Send to followed by Compressed (Zipped) folder.
• When prompted if you would like to save the file to your desktop, click Yes.
• Afterwards, scroll up to the Minidump folder.
• Right-click Minidump and click Send to followed by Compressed (Zipped) folder.
• When prompted if you would like to save the file to your desktop, click Yes.

Please upload both Zip files to WeTransfer.com.

• Click Add your files, navigate to your Desktop and double-click the first Zip file.
• Repeat for the second Zip file.
• Click (...) and select the link radio button under Send as.
• Click Transfer.
• Copy the download link and paste it in a new forum post.

Edited February 8, 2019 by LiquidTension

[uaegangster111]

1 minute ago, LiquidTension said:

Okay, to summarise:

• You clicked Start Repair.
• Clicked OK to the MBST reboot prompt
• The machine went to restart, but blue screened again (DRIVER_POWER_STATE_FAILURE).
• You restarted the machine again and it booted back into Windows.
• Once Windows had started up, you opened Malwarebytes and proceeded to turn off Exploit Protection and Web Protection.

How did you get from here to the MbamElam.sys missing message?
When you tried to turn off Web Protection, did the computer blue screen again and upon restarting, presented you with the MbamElam.sys missing message? yes

-----

Let's take a closer look at the dump files generated from the blue screens.

• Please navigate to C:\Windows.
• Right-click MEMORY.dmp and click Send to followed by Compressed (Zipped) folder.
• When prompted if you would like to save the file to your desktop, click Yes.
• Afterwards, scroll up to the Minidump folder.
• Right-click Minidump and click Send to followed by Compressed (Zipped) folder.
• When prompted if you would like to save the file to your desktop, click Yes.

Please upload both Zip files to WeTransfer.com.

• Click Add your files, navigate to your Desktop and double-click the first Zip file.
• Repeat for the second Zip file.
• Click (...) and select the link radio button under Send as.
• Click Transfer.
• Copy the download link and paste it in a new forum post.

The problem is i minidump folder is empty. Maybe because i used DISM (restore health) and SFC they got deleted ?

[LiquidTension]

The logs show them as being present. If they're not there, something done between running MBST Log Gathering and now has deleted them. What about C:\Windows\MEMORY.dmp?

[uaegangster111]

2 minutes ago, LiquidTension said:

The logs show them as being present. If they're not there, something done between running MBST Log Gathering and now has deleted them. What about C:\Windows\MEMORY.dmp?

Yep nothing is there. So what to do now . Should I remove malwarebytes ? Since I can't use it . 

[LiquidTension]

We can script out the remaining elements as you won't be able to uninstall. Let's start by performing a thorough search.

SystemLook

• Please download Find.txt using the link below.
  → https://malwarebytes.box.com/s/blw40e7yw24q2947ii1apf19qetgno08
• Please download SystemLook (x64) using the link below.
  → https://malwarebytes.box.com/s/skzoungfpjhncjw6i4jsxewalmxlk77g
• Right-click SystemLook_x64.exe and select Run as administrator to run the program.
• Open the Find.txt file you downloaded earlier.
• Copy the contents of the Find.txt file and paste into the SystemLook window.
• Click the Look button to start the search.
• Upon completion, a log named SystemLook.txt will be saved in the same location as SystemLook_x64.exe.
• Please attach the log in your next reply.

[uaegangster111]

30 minutes ago, LiquidTension said:

We can script out the remaining elements as you won't be able to uninstall. Let's start by performing a thorough search.

SystemLook

• Please download Find.txt using the link below.
  → https://malwarebytes.box.com/s/blw40e7yw24q2947ii1apf19qetgno08
• Please download SystemLook (x64) using the link below.
  → https://malwarebytes.box.com/s/skzoungfpjhncjw6i4jsxewalmxlk77g
• Right-click SystemLook_x64.exe and select Run as administrator to run the program.
• Open the Find.txt file you downloaded earlier.
• Copy the contents of the Find.txt file and paste into the SystemLook window.
• Click the Look button to start the search.
• Upon completion, a log named SystemLook.txt will be saved in the same location as SystemLook_x64.exe.
• Please attach the log in your next reply.

There you go

SystemLook.txt

[LiquidTension]

Thank you. Please start with the following:

• In the Windows Search bar, type cmd.
• Right-click Command Prompt and click Run as administrator.
• Enter the following text: sc delete mbamelam
• Press Enter on your keyboard.
• Confirm you receive a message stating it was successful. If you don't receive this message, stop and let me know.
   

Once done, proceed with the steps below to remove the remaining items.

Malwarebytes Support Tool (MBST) Clean Uninstall

• If necessary, please redownload MBST using the link below:
  → http://downloads.malwarebytes.com/file/mbst
• Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
• Double-click mb-support-#.#.#.###.exe to run the program.
• Click the Advanced menu on the left. Please do not click Start Repair.
• Click the Clean button followed by Yes to proceed.
• Upon completion, click OK to reboot your computer.
• After the reboot, please wait for the program to reopen.
• You will be presented with the option to reinstall Malwarebytes for Windows. Click No.
• A file named mbst-clean-results.txt will be created on your Desktop. Please attach this file.

Edited February 8, 2019 by LiquidTension

[uaegangster111]

11 minutes ago, LiquidTension said:

Thank you. Please start with the following:

• In the Windows Search bar, type cmd.
• Right-click Command Prompt and click Run as administrator.
• Enter the following text: sc delete mbamelam
• Press Enter on your keyboard.
• Confirm you receive a message stating it was successful. If you don't receive this message, stop and let me know.
   

Once done, proceed with the steps below to remove the remaining items.

Malwarebytes Support Tool (MBST) Clean Uninstall

• If necessary, please redownload MBST using the link below:
  → http://downloads.malwarebytes.com/file/mbst
• Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
• Double-click mb-support-#.#.#.###.exe to run the program.
• Click the Advanced menu on the left. Please do not click Start Repair.
• Click the Clean button followed by Yes to proceed.
• Upon completion, click OK to reboot your computer.
• After the reboot, please wait for the program to reopen.
• You will be presented with the option to reinstall Malwarebytes for Windows. Click No.
• A file named mbst-clean-results.txt will be created on your Desktop. Please attach this file.

After i click clean and it prompt me to restart it kept looping in "restarting" word then the DRIVER_POWER_STATE_FAILURE crash happen but this i was able to boot back in to windows.  I have attached the memory.dmp and minidump files please take a look.  since a complete restart did not go thorough the mbst-clean-results.txt was not available on my desktop. 

https://we.tl/t-zgjz5bDIb1

[LiquidTension]

This confirms the blue screens weren't/aren't being caused by Malwarebytes. It appears the action of restarting the machine is triggering the blue screen, which ties in with it being power management-related (DRIVER_POWER_STATE_FAILURE). This type of blue screen is more commonly seen with network adapters.

The mbst-clean-results.txt is only moved to the desktop post-reboot after a successful relaunch of the tool. You'll find the file in the following folder: %temp%\mwb850B.tmp

We can conclude the following:

• The blue screens are unrelated to Malwarebytes.
• Self-remedy efforts to resolve the blue screens (e.g. failed System Restore) likely caused the system to end up in a "mismatched" state, which is why all Malwarebytes file system elements were missing, but all registry elements were not.

[LiquidTension]

Are you unexpectedly removing any devices from the machine each time the blue screen occurs or performing any consistent actions other than restarting the computer?

Do you have any USB drives or other similar devices attached to the system?

When the computer is "restarting", does this typically last for around 5 minutes before the blue screen eventually occurs?

Edited February 9, 2019 by LiquidTension

[uaegangster111]

I finally figured the problem it's the driver of the Logitech G110 keyboard that is causing the BSOD . The clean process is completed .  I will reinstall malwarebytes after I get a new keyboard.  Hopefully then everything works fine. Also when I install it again in the future , should disable windows defender or keep it running ? 

mbst-clean-results.txt

[exile360]

If you haven't done so already, you could try downloading the latest driver for your keyboard to see if it resolves the issue, that way you don't necessarily need to spend money on a new one.  The latest driver software for the G110 can be found here.