missing or contains errors: File:\WINDOWS\system.32\DRIVERS\MbamElam.sys

[Stroh]

Running Malwarebytes free for a month on desktop. Recently tried to do a major Windows 10 update. Update seemed to freeze, let it run overnight nothing changed.  Attempted to reboot computer, it starts to load Windows then just black screen with mouse pointer (pointer will move around). I can get to the troubleshooting screen by turning off & on 3 times. In Advanced options screen, clicking on Startup Repair causes computer to restart and gets to "Startup Repair" screen with "Choose an account to continue" and account name in box but mouse nor keyboard does anything. Clicking on "System Restore" does same thing, shows account but frozen.

Once, I did get to the Recovery Screen and I got this:

Your PC/Device needs to be repaired.
The operating system couldn't be loaded because a critical system driver is missing or contains errors:

File:\WINDOWS\system.32\DRIVERS\MbamElam.sys

Error Code:0xcoooooof

Help

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[Stroh]

I have downloaded the Malwarebytes Support Tool - Advanced Options on to a USB thumb drive but how can I run it when I can't get Windows to load?  Would it be able to run from a command prompt?

[exile360]

Greetings,

Please try booting the system into Safe Mode with Networking as described here and then try uninstalling Malwarebytes normally via the control panel, then restart the system to see if it can now start normally.

If you are unable to boot into Safe Mode you may need to do a refresh install of Windows if you can't get it to boot, however you should be able to do so while still keeping your user accounts and personal files; you'll just have to reinstall any third party applications you had installed and will have to change any settings in Windows that you had modified previously to get them back to the way you prefer once it is done.  Instructions on doing so may be found here under the section labelled OPTION ONE.  Files from the original Windows installation will be backed up in a folder called Windows.Old in the root of the main system drive (usually C:\).

This should only be necessary if you are unable to get System Restore or Startup Repair to work to get the system to start properly and are unable to enter Safe Mode.

Please let us know how it goes.

Thanks

[AdvancedSetup]

Hello @Stroh

You need to get into the Recovery Environment, please see the following link
https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html

https://winaero.com/open-command-prompt-boot-windows-10/

 

From the command prompt in the Windows Recovery Environment you can remove the MbamElam.sys file a couple of ways.

1. issue this command and see if it will remove. If not then run the next command

SC DELETE MbamElam

2. If the SC command was not successful then run this command

DEL C:\WINDOWS\system32\DRIVERS\MbamElam.sys

Then restart the computer again and see if it will now go into Normal Mode in Windows and let us know.

 

If you need more detailed instructions please let us know.

Thanks

 

[Stroh]

exile360 Tried booting the system into Safe Mode with Networking, I get a black screen with just the window 'frame' for a minute then goes to a sign-in screen with the account name and the circle of dots for a minute then goes to the black screen, with nothing on it. if I move the mouse, the cursor shows and it will move normally. That's it. Nothing else happens.

AdvancedSetup  I can access the Recovery Environment and I can choose any or all of the options but when I choose System Image Recovery for example (I have a system repair disc I made when I upgraded to Windows 10 from Windows 7), I get the screen to "choose an account to continue" which only shows the one account in the box, but the computer freezes with no mouse cursor and won't respond to keyboard or mouse.

[Stroh]

AdvancedSetup  Also, I can get to the command prompt but when I try to run the SC DELETE MbamElam command I get 'SC' is not recognized as an internal or external command, operable program or batch file.

 

If I run the DEL C:\WINDOWS\system32\DRIVERS\MbamElam.sys I get 'The system cannot find the path specified.'

 

 

[AdvancedSetup]

Okay, see if you can run NOTEPAD from there and then do a File Open and see which driver letter your installation of Windows is on and let me know.

 

[Stroh]

In the command prompt I did a 'C:' and found no files, did a 'D:' and found several Directories: Windows; Windows.old and Windows10Upgrade. I did the DEL D:\WINDOWS\system32\DRIVERS\MbamElam.sys and it apparently deleted it. I tried the same command for Windows/old and Windows10Upgrade and got "The system cannot find the path specified."

 

Restarted computer and got " Preparing Automatic Repair" with the little circle of balls then it goes to the Select account screen which shows my account but again it's frozen and no

 keystroke will do anything.

 

[Stroh]

I think I am going to bite the bullet and just do a clean reinstall of Win 10.  Thank you for the help.

[AdvancedSetup]

There is a RESET option and some in-place repair options

https://www.laptopmag.com/articles/repair-windows-10

 

[Stroh]

Thanks but I have already started the clean install. I have spent too much time and whichever route I took it would eventually get to the account screen and lock up so clean install.  Not the first time I've had to do it and probably won't be the last.  Thanks again for the help.

[exile360]

I'm sorry to hear that, and I hope all goes well with the clean install.

Please let us know how it turns out and if there is anything we might be of help with.

[AdvancedSetup]

Well, there are good, free methods to image an installation to an external USB drive so that if it does happen again you could recover very quickly.

Macrium Reflect is free and works quite well

If you want more details let us know and good luck with the rebuild