Jump to content
uaegangster111

Cannot boot into windows after malwarebytes install

Recommended Posts

Hi 

 

After installing malwarbytes in my my windows 10 I restarted then i got this massage . 

The operating system couldt be loaded because a critical system driver is missing or corrupted.  (attched)

File \WINDOWS\system32\DRIVERS\MbamElam.sys

FRST.TXT IS ATTACHED I NEED HELP . As i cant use my pc at all not even safe mode. 

 

 

pc help.jpg

Share this post


Link to post
Share on other sites

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

If at all possible can you start your computer in Safe Mode, with or without networking.
How to:
https://support.microsoft.com/en-ca/help/12376/windows-10-start-your-pc-in-safe-mode

Is successful please post the FRST and Addition.txt log in your next reply.

I need to see the logs in a .txt format.
Please use Notepad to save the file as .txt files.

Share this post


Link to post
Share on other sites
2 minutes ago, nasdaq said:

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

If at all possible can you start your computer in Safe Mode, with or without networking.
How to:
https://support.microsoft.com/en-ca/help/12376/windows-10-start-your-pc-in-safe-mode

Is successful please post the FRST and Addition.txt log in your next reply.

I need to see the logs in a .txt format.
Please use Notepad to save the file as .txt files.

Hi , I cannot boot into anything.  Only in windows Recovery environment.  It's says because or your driver at WINDOWS\system32\DRIVERS\MbamElam.sys is missing or corrupt.   

FRST.txt

Share this post


Link to post
Share on other sites

Hello,

I've moved this topic over to the Malwarebytes 3 Support section of the forum.

On the Recovery screen, press F8 to access Startup Settings. Once there, press the number corresponding to the Disable early launch anti-malware protection option. This should allow you to boot normally into Windows.

image.png.dead8ab38015f246bf5876da110091ba.png

Let me know once you're in Windows and I'll provide follow-up instructions. Selecting this option only applies to one Windows session immediately after the next restart.

Edited by LiquidTension

Share this post


Link to post
Share on other sites
51 minutes ago, LiquidTension said:

Hello,

I've moved this topic over to the Malwarebytes 3 Support section of the forum.

On the Recovery screen, press F8 to access Startup Settings. Once there, press the number corresponding to the Disable early launch anti-malware protection option. This should allow you to boot normally into Windows.

image.png.dead8ab38015f246bf5876da110091ba.png

Let me know once you're in Windows and I'll provide follow-up instructions. Selecting this option only applies to one Windows session immediately after the next restart.

Yes I can confirm that's it's fixed now. Now everytime I restart I should do this . Or there is a fix. BTW I have windows defender active.  Or why this happened to me ? 

Share this post


Link to post
Share on other sites

Thanks for the update! This is only a temporary measure whilst we determine the cause of the issue. We'll have a permanent solution for you.

In the meantime, we need to collect some additional information from the computer. Please carry out the instructions below on running the Malwarebytes Support Tool. Please ensure the Start Repair button is NOT clicked. After running the tool, click Advanced followed by Gather Logs.

YbWgqUx.png Malwarebytes Support Tool (MBST)

  • Please download MBST using the link below:
    http://downloads.malwarebytes.com/file/mbst
  • Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
  • Double-click YbWgqUx.png mb-support-#.#.#.###.exe to run the program.
  • If prompted, place a checkmark next to Accept License Agreement and click Next.
  • Do NOT click Start Repair.
  • Click the Advanced menu on the left.
  • Click Gather Logs.
  • Upon completion, click OK.
  • A file named HSPwQfy.png mbst-grab-results.zip will be saved to your Desktop.
  • Please attach the file in your next email reply.
Edited by LiquidTension

Share this post


Link to post
Share on other sites
5 minutes ago, LiquidTension said:

Thanks for the update! This is only a temporary measure whilst we determine the cause of the issue. We'll have a permanent solution for you.

In the meantime, we need to collect some additional information from the computer. Please carry out the instructions below on running the Malwarebytes Support Tool. Please ensure the Start Repair button is NOT clicked. After running the tool, click Advanced followed by Gather Logs.

YbWgqUx.png Malwarebytes Support Tool (MBST)

  • Please download MBST using the link below:
    http://downloads.malwarebytes.com/file/mbst
  • Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
  • Double-click YbWgqUx.png mb-support-#.#.#.###.exe to run the program.
  • If prompted, place a checkmark next to Accept License Agreement and click Next.
  • Do NOT click Start Repair.
  • Click the Advanced menu on the left.
  • Click Gather Logs.
  • Upon completion, click OK.
  • A file named HSPwQfy.png mbst-grab-results.zip will be saved to your Desktop.
  • Please attach the file in your next email reply.

There you go. 

mbst-grab-results.zip

Share this post


Link to post
Share on other sites

Thank you.

What was the reason for running Malwarebytes Support Tool (MBST) originally (prior to the issue)? Did you encounter any issues when you ran the tool for the first time?

Please recall your actions leading up to the issue.

Are the following points below accurate? If they are, please fill in the ??? so we can better understand what caused this issue.

  • You already had Malwarebytes version 3.7.1 installed.
  • You download and ran MBST, then clicked Start Repair.
  • ???
  • You restarted the computer and were met with the, "Your PC/Device needs to be repaired" message.
     

Do you have the mbst-clean-results.txt file created when you ran a repair with MBST? Was this file saved to your desktop at any point in time?

------

Please do the following:

MgeHyNE.png Collect Troubleshooting Logs

  • Please download collect_mbst_logs.bat using the link below.
    https://malwarebytes.box.com/s/xpz34itvz4kqekayhoplqalehqh9eqnd
  • Open your Downloads folder.
  • Right-click CX41PDv.png collect_mbst_logs.bat and select AVOiBNU.jpg Run as administrator to run the file.
  • Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
  • A black Command Prompt window will appear.
  • Upon completion, a file named HSPwQfy.png mbst-logs.zip will be saved to your Desktop. Please attach the file in your next reply.
     

Event Logs

  • Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
  • Expand Windows Logs.
  • Right-click Application and click Save All Events As.... Name the file application and click OK.
  • Repeat for Security and System.
  • Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
  • Name the Zip file EventLogs.zip and attach the file to a forum post.
Edited by LiquidTension

Share this post


Link to post
Share on other sites
4 minutes ago, LiquidTension said:

Thank you.

What was the reason for running Malwarebytes Support Tool (MBST) originally (prior to the issue)? Did you encounter any issues when you ran the tool for the first time?

Please recall your actions leading up to the issue.

Are the following points below accurate? If they are, please fill in the ??? so we can better understand what caused this issue.

  • You already had Malwarebytes version 3.7.1 installed.
  • You download and ran MBST, then clicked Start Repair.
  • ???
  • You restarted the computer and were met with the, "Your PC/Device needs to be repaired" message.
     

Please do the following:

MgeHyNE.png Collect Troubleshooting Logs

  • Please download collect_mbst_logs.bat using the link below.
    https://malwarebytes.box.com/s/xpz34itvz4kqekayhoplqalehqh9eqnd
  • Open your Downloads folder.
  • Right-click CX41PDv.png collect_mbst_logs.bat and select AVOiBNU.jpg Run as administrator to run the file.
  • Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
  • A black Command Prompt window will appear.
  • Upon completion, a file named HSPwQfy.png mbst-logs.zip will be saved to your Desktop. Please attach the file in your next reply.

 

well i was having "driver power state failure" on windows 10 every-time i click restart it will be stuck saying restarting then it would crash showing 'driver power state failure"

Then I add both exclusions for both malwarebytes and windows defender EXE'S together thinking it might fix the crash and yet it kept crashing.  then this happens.  This all happened after installing malwarebytes . To bad that the dump files are gone . When i checked in bluescreenview.exe its says that its in Ntoskrnl.Exe  

Share this post


Link to post
Share on other sites

Thank you for the information. Please try to answer all of my questions.

When you ran the Malwarebytes Support Tool for the first time and clicked Start Repair, did you encounter any issues with the tool? Were you prompted by the tool to restart the computer? If you were, what happened next?

Did the missing MbamElam.sys file message appear immediately after running a repair with the Malwarebytes Support Tool and rebooting?

Do you have the mbst-clean-results.txt file created when you ran a repair with MBST? Was this file saved to your desktop at any point in time?
 

Event Logs

  • Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
  • Expand Windows Logs.
  • Right-click Application and click Save All Events As.... Name the file application and click OK.
  • Repeat for Security and System.
  • Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
  • Name the Zip file EventLogs.zip and attach the file to a forum post.

Share this post


Link to post
Share on other sites
4 minutes ago, LiquidTension said:

Thank you for the information. Please try to answer all of my questions.

When you ran the Malwarebytes Support Tool for the first time and clicked Start Repair, did you encounter any issues with the tool? Were you prompted by the tool to restart the computer? If you were, what happened next?

Did the missing MbamElam.sys file message appear immediately after running a repair with the Malwarebytes Support Tool and rebooting?

Do you have the mbst-clean-results.txt file created when you ran a repair with MBST? Was this file saved to your desktop at any point in time?
 

Event Logs

  • Press the Windows Key + R on your keyboard at the same time. Type eventvwr.msc and click OK.
  • Expand Windows Logs.
  • Right-click Application and click Save All Events As.... Name the file application and click OK.
  • Repeat for Security and System.
  • Navigate to the location of the files. Highlight the three files, right-click one and click Send to followed by Compressed (zipped) folder.
  • Name the Zip file EventLogs.zip and attach the file to a forum post.

Yes i clicked Start Repair and i restarted but same thing happened , it crashed while showing "restarting" giving "driver power state failure" . Then i manged to boot in to windows. The last i remember doing was turning off exploit protection and web protection then the problem happened i could not boot in into windows. 

EventLogs.zip

Share this post


Link to post
Share on other sites

Okay, to summarise:

  • You clicked Start Repair.
  • Clicked OK to the MBST reboot prompt
  • The machine went to restart, but blue screened again (DRIVER_POWER_STATE_FAILURE).
  • You restarted the machine again and it booted back into Windows.
  • Did the Malwarebytes Support Tool open back up and reinstall Malwarebytes?
  • You opened Malwarebytes and proceeded to turn off Exploit Protection and Web Protection.

How did you get from here to the MbamElam.sys missing message?
When you tried to turn off Web Protection, did the computer blue screen again and upon restarting, presented you with the MbamElam.sys missing message?

-----

Let's take a closer look at the dump files generated from the blue screens.

  • Please navigate to C:\Windows.
  • Right-click MEMORY.dmp and click Send to followed by Compressed (Zipped) folder.
  • When prompted if you would like to save the file to your desktop, click Yes.
  • Afterwards, scroll up to the Minidump folder.
  • Right-click Minidump and click Send to followed by Compressed (Zipped) folder.
  • When prompted if you would like to save the file to your desktop, click Yes.


Please upload both Zip files to WeTransfer.com.

  • Click Add your files, navigate to your Desktop and double-click the first Zip file.
  • Repeat for the second Zip file.
  • Click (...) and select the link radio button under Send as.
  • Click Transfer.
  • Copy the download link and paste it in a new forum post.
Edited by LiquidTension

Share this post


Link to post
Share on other sites
1 minute ago, LiquidTension said:

Okay, to summarise:

  • You clicked Start Repair.
  • Clicked OK to the MBST reboot prompt
  • The machine went to restart, but blue screened again (DRIVER_POWER_STATE_FAILURE).
  • You restarted the machine again and it booted back into Windows.
  • Once Windows had started up, you opened Malwarebytes and proceeded to turn off Exploit Protection and Web Protection.

How did you get from here to the MbamElam.sys missing message?
When you tried to turn off Web Protection, did the computer blue screen again and upon restarting, presented you with the MbamElam.sys missing message? yes

-----

Let's take a closer look at the dump files generated from the blue screens.

  • Please navigate to C:\Windows.
  • Right-click MEMORY.dmp and click Send to followed by Compressed (Zipped) folder.
  • When prompted if you would like to save the file to your desktop, click Yes.
  • Afterwards, scroll up to the Minidump folder.
  • Right-click Minidump and click Send to followed by Compressed (Zipped) folder.
  • When prompted if you would like to save the file to your desktop, click Yes.


Please upload both Zip files to WeTransfer.com.

  • Click Add your files, navigate to your Desktop and double-click the first Zip file.
  • Repeat for the second Zip file.
  • Click (...) and select the link radio button under Send as.
  • Click Transfer.
  • Copy the download link and paste it in a new forum post.

The problem is i minidump folder is empty. Maybe because i used DISM (restore health) and SFC they got deleted ?

Share this post


Link to post
Share on other sites

The logs show them as being present. If they're not there, something done between running MBST Log Gathering and now has deleted them. What about C:\Windows\MEMORY.dmp?

Share this post


Link to post
Share on other sites
2 minutes ago, LiquidTension said:

The logs show them as being present. If they're not there, something done between running MBST Log Gathering and now has deleted them. What about C:\Windows\MEMORY.dmp?

Yep nothing is there. So what to do now . Should I remove malwarebytes ? Since I can't use it . 

Share this post


Link to post
Share on other sites

We can script out the remaining elements as you won't be able to uninstall. Let's start by performing a thorough search.

eDXKyj2.png SystemLook

  • Please download Find.txt using the link below.
    https://malwarebytes.box.com/s/blw40e7yw24q2947ii1apf19qetgno08
  • Please download SystemLook (x64) using the link below.
    https://malwarebytes.box.com/s/skzoungfpjhncjw6i4jsxewalmxlk77g
  • Right-click eDXKyj2.png SystemLook_x64.exe and select AVOiBNU.jpg Run as administrator to run the program.
  • Open the UdawJ7P.png Find.txt file you downloaded earlier.
  • Copy the contents of the Find.txt file and paste into the SystemLook window.
  • Click the Look button to start the search.
  • Upon completion, a log named UdawJ7P.png SystemLook.txt will be saved in the same location as SystemLook_x64.exe.
  • Please attach the log in your next reply.

Share this post


Link to post
Share on other sites
30 minutes ago, LiquidTension said:

We can script out the remaining elements as you won't be able to uninstall. Let's start by performing a thorough search.

eDXKyj2.png SystemLook

  • Please download Find.txt using the link below.
    https://malwarebytes.box.com/s/blw40e7yw24q2947ii1apf19qetgno08
  • Please download SystemLook (x64) using the link below.
    https://malwarebytes.box.com/s/skzoungfpjhncjw6i4jsxewalmxlk77g
  • Right-click eDXKyj2.png SystemLook_x64.exe and select AVOiBNU.jpg Run as administrator to run the program.
  • Open the UdawJ7P.png Find.txt file you downloaded earlier.
  • Copy the contents of the Find.txt file and paste into the SystemLook window.
  • Click the Look button to start the search.
  • Upon completion, a log named UdawJ7P.png SystemLook.txt will be saved in the same location as SystemLook_x64.exe.
  • Please attach the log in your next reply.

There you go

SystemLook.txt

Share this post


Link to post
Share on other sites

Thank you. Please start with the following:

  • In the Windows Search bar, type cmd.
  • Right-click Command Prompt and click Run as administrator.
  • Enter the following text: sc delete mbamelam
  • Press Enter on your keyboard.
  • Confirm you receive a message stating it was successful. If you don't receive this message, stop and let me know.
     

Once done, proceed with the steps below to remove the remaining items.

YbWgqUx.png Malwarebytes Support Tool (MBST) Clean Uninstall

  • If necessary, please redownload MBST using the link below:
    http://downloads.malwarebytes.com/file/mbst
  • Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
  • Double-click YbWgqUx.png mb-support-#.#.#.###.exe to run the program.
  • Click the Advanced menu on the left. Please do not click Start Repair.
  • Click the Clean button followed by Yes to proceed.
  • Upon completion, click OK to reboot your computer.
  • After the reboot, please wait for the program to reopen.
  • You will be presented with the option to reinstall Malwarebytes for Windows. Click No.
  • A file named mbst-clean-results.txt will be created on your Desktop. Please attach this file.
Edited by LiquidTension

Share this post


Link to post
Share on other sites
11 minutes ago, LiquidTension said:

Thank you. Please start with the following:

  • In the Windows Search bar, type cmd.
  • Right-click Command Prompt and click Run as administrator.
  • Enter the following text: sc delete mbamelam
  • Press Enter on your keyboard.
  • Confirm you receive a message stating it was successful. If you don't receive this message, stop and let me know.
     

Once done, proceed with the steps below to remove the remaining items.

YbWgqUx.png Malwarebytes Support Tool (MBST) Clean Uninstall

  • If necessary, please redownload MBST using the link below:
    http://downloads.malwarebytes.com/file/mbst
  • Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
  • Double-click YbWgqUx.png mb-support-#.#.#.###.exe to run the program.
  • Click the Advanced menu on the left. Please do not click Start Repair.
  • Click the Clean button followed by Yes to proceed.
  • Upon completion, click OK to reboot your computer.
  • After the reboot, please wait for the program to reopen.
  • You will be presented with the option to reinstall Malwarebytes for Windows. Click No.
  • A file named mbst-clean-results.txt will be created on your Desktop. Please attach this file.

After i click clean and it prompt me to restart it kept looping in "restarting" word then the DRIVER_POWER_STATE_FAILURE crash happen but this i was able to boot back in to windows.  I have attached the memory.dmp and minidump files please take a look.  since a complete restart did not go thorough the mbst-clean-results.txt was not available on my desktop. 

https://we.tl/t-zgjz5bDIb1

Share this post


Link to post
Share on other sites

This confirms the blue screens weren't/aren't being caused by Malwarebytes. It appears the action of restarting the machine is triggering the blue screen, which ties in with it being power management-related (DRIVER_POWER_STATE_FAILURE). This type of blue screen is more commonly seen with network adapters.

The mbst-clean-results.txt is only moved to the desktop post-reboot after a successful relaunch of the tool. You'll find the file in the following folder: %temp%\mwb850B.tmp

We can conclude the following:

  • The blue screens are unrelated to Malwarebytes.
  • Self-remedy efforts to resolve the blue screens (e.g. failed System Restore) likely caused the system to end up in a "mismatched" state, which is why all Malwarebytes file system elements were missing, but all registry elements were not.

Share this post


Link to post
Share on other sites

Are you unexpectedly removing any devices from the machine each time the blue screen occurs or performing any consistent actions other than restarting the computer?

Do you have any USB drives or other similar devices attached to the system?

When the computer is "restarting", does this typically last for around 5 minutes before the blue screen eventually occurs?

Edited by LiquidTension

Share this post


Link to post
Share on other sites

I finally figured the problem it's the driver of the Logitech G110 keyboard that is causing the BSOD . The clean process is completed .  I will reinstall malwarebytes after I get a new keyboard.  Hopefully then everything works fine. Also when I install it again in the future , should disable windows defender or keep it running ? 

mbst-clean-results.txt

Share this post


Link to post
Share on other sites

If you haven't done so already, you could try downloading the latest driver for your keyboard to see if it resolves the issue, that way you don't necessarily need to spend money on a new one.  The latest driver software for the G110 can be found here.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.