# [SOLVED] Malwarebytes will not load Rootkit Driver



## Masterchiefxx17 (Feb 27, 2010)

Hi,

I have been running MBAM on my system for a long time now and recently I have been experiencing a Rootkit driver error from MBAM like this one here:










I have scanned for RootKits with TDDSKiller and MSSE is the antivirus. 

The PC recently had some strange PUP and if I recall a Trojan that followed along. Both have been removed. Reinstalling MBAM did not fix the issue.

Also here is the diagnostics of MBAM:


```
mbam-check result log version:     2.1.1.1001
========================================
User Account type:                 Administrator
OS:                                Windows 7 Service Pack 1 Service Pack 1 64 bit Operating System
Current Version and Build:         6.1.7601.0 
Malwarebytes Anti-Malware:         2.0.4.1028
Installed On:                      2014/12/20
Malware Database:                  0000.00.00.00
Rootkit Database:                  0000.00.00.00
Remediation Database:              0000.00.00.00
IP Database:                       0000.00.00.00
Domain Database:                   0000.00.00.00
License:                           Premium
Malware Protection:                4 (The service is running.)
Malicious Website Protection:      4 (The service is running.)
Chameleon:                         0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon
Log Created:                       2014/12/20 12:40:35
Compatibility Flag Settings:
=================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\appCompatFlags\Layers
 C:\Users\PCUser\AppData\Roaming\SanDisk\SanDiskSecureAccess_Manager.exeREG_SZ  WINXPSP2
 SIGN.IE=0113BC08 AdobeAIRInstaller.exeREG_SZ  VISTARTM
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\appCompatFlags\Layers
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\appCompatFlags\Layers
Malwarebytes Anti-Malware Shell Extension Block Check:
======================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked:
MBAM Startup Entries: 
=====================
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
 NCPluginUpdater               REG_SZ  "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update
Malwarebytes Anti-Malware Service and Driver Status:
=======================================================
--------------Driver File Info:--------------
C:\Windows\system32\drivers\mbam.sys
File Size: 25816     BYTES FileVersion: 0.1.15.0 MD5: [ca43f8904e24bbe49982e4c0b29e6579]
C:\Windows\system32\drivers\mwac.sys
File Size: 63704     BYTES FileVersion: 1.0.6.0 MD5: [a646c2ddb8c46e9b20a326faf566646c]
C:\Windows\system32\drivers\mbamswissarmy.sys
File Size: 129752    BYTES FileVersion: 0.2.13.0 MD5: [26c43960c99ee861a5d0edc4dcf3b1c3]
C:\Windows\system32\drivers\mbamchameleon.sys
File Size: 93400     BYTES FileVersion: 1.1.4.0 MD5: [478cc94c937d235cb0a96ab8f2359d81]
--------------MBAMProtector:--------------
Type:                   2
State:                  4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0
 
--------------MBAMService:--------------
Type:                   16
State:                  4 (The service is running.)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0
 
--------------MBAMScheduler:--------------
Type:                   16
State:                  4 (The service is running.)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0
 
--------------MBAMChameleon:--------------
Type:                   N/A
State:                  0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon
WIN32_EXIT_CODE:        N/A
SERVICE_EXIT_CODE:      N/A
CHECKPOINT:             N/A
WAIT_HINT:              N/A
 
--------------MBAMWebAccessControl:--------------
Type:                   2
State:                  4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0
 
Required Dependencies:
======================
--------------BFE:--------------
Type:                   32
State:                  4 (The service is running.)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
 DisplayName                   REG_SZ  @%SystemRoot%\system32\bfe.dll,-1001
 Group                         REG_SZ  NetworkProvider
 ImagePath                     REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork
 Description                   REG_SZ  @%SystemRoot%\system32\bfe.dll,-1002
 ObjectName                    REG_SZ  NT AUTHORITY\LocalService
 ErrorControl                  REG_DWORD  1
 Start                         REG_DWORD  2
 Type                          REG_DWORD  32
 DependOnService               REG_MULTI_SZ RpcSs
 ServiceSidType                REG_DWORD  3
 RequiredPrivileges            REG_MULTI_SZ SeAuditPrivilege
 FailureActions                REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters
 ServiceDll                    REG_EXPAND_SZ %SystemRoot%\System32\bfe.dll
 ServiceDllUnloadOnStop        REG_DWORD  1
 ServiceMain                   REG_SZ  BfeServiceMain
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime\Filter
 {dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data
 {0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data
 {12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data
 {c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data
 {0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data
 {074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data
 {c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data
 {a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data
 {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data
 {2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data
 {2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data
 {c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data
 {935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data
 {941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Callout
 {22001ee0-8e87-4f75-ba58-248f5918a63a}REG_BINARY Binary Data
 {79f2a265-b693-4cc9-b480-cbcd87bd4747}REG_BINARY Binary Data
 {c4b50f21-503e-4d7a-abd4-ed0a823a2453}REG_BINARY Binary Data
 {91e902db-2cef-4040-b8e2-02fe4fd49c25}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Filter
 {dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data
 {f444c576-6e60-4ea2-9faa-80d57ed12cd2}REG_BINARY Binary Data
 {0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data
 {12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data
 {c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data
 {0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data
 {4d9581d2-aef8-4993-84cd-b986ced80d42}REG_BINARY Binary Data
 {be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc}REG_BINARY Binary Data
 {716b48eb-0a35-4a76-92ab-1d987230d288}REG_BINARY Binary Data
 {1165065e-4996-4338-abaf-4b8556b4d431}REG_BINARY Binary Data
 {07a24961-a760-4e80-b263-6d275e1b09cb}REG_BINARY Binary Data
 {5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9}REG_BINARY Binary Data
 {b6b2ca61-fb98-4422-adc2-e7cf56b3680c}REG_BINARY Binary Data
 {0aa7fff8-919f-453c-928c-28a12122ba38}REG_BINARY Binary Data
 {074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data
 {c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data
 {a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data
 {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data
 {91ffecf0-0a9e-4572-95f1-a7111af86967}REG_BINARY Binary Data
 {64e55933-15a5-495d-a928-ccca43d44875}REG_BINARY Binary Data
 {13bfd422-6f75-4408-8924-9400ec0cb19c}REG_BINARY Binary Data
 {cbfb56db-3c85-4543-9bc2-76ea28cdd74e}REG_BINARY Binary Data
 {2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data
 {375fb39b-08c6-40f2-bdf2-08fa63f970a2}REG_BINARY Binary Data
 {2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data
 {c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data
 {b6fdab6b-dcc6-43e3-99ce-7aeca65063a4}REG_BINARY Binary Data
 {3697a558-3ed3-49be-a4c1-c1a4448653b4}REG_BINARY Binary Data
 {935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data
 {941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary Data
 {b02a4013-b6b5-4859-9168-1e3299e43b24}REG_BINARY Binary Data
 {d870c96c-75ee-46a6-8a02-8e4401a73423}REG_BINARY Binary Data
 {8b50e2ec-7cf0-4b71-b42e-5b0536f6cab8}REG_BINARY Binary Data
 {4137b143-2770-43d4-91a2-55bb0a069830}REG_BINARY Binary Data
 {3180114b-8338-4740-9a16-444134ad62f4}REG_BINARY Binary Data
 {17043d46-fac2-4561-bca1-0c7a05e95f5f}REG_BINARY Binary Data
 {567d3836-3f5b-4067-b9c4-952f677010a2}REG_BINARY Binary Data
 {4e718c57-c397-4221-9fbb-14fd51701d6a}REG_BINARY Binary Data
 {3a90a266-1519-4d23-911b-e84cd0f02ab8}REG_BINARY Binary Data
 {56b4fdc4-bb4e-4c42-a9d8-f627ee15ac21}REG_BINARY Binary Data
 {1ba41ed8-151d-4577-9272-317856bc637c}REG_BINARY Binary Data
 {9248d57e-f843-4159-807d-3813173e2096}REG_BINARY Binary Data
 {4658cd86-525d-44ed-98a5-791a7b8655f1}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Provider
 {decc16ca-3f33-4346-be1e-8fb4ae0f3d62}REG_BINARY Binary Data
 {4b153735-1049-4480-aab4-d1b9bdc03710}REG_BINARY Binary Data
 {1bebc969-61a5-4732-a177-847a0817862a}REG_BINARY Binary Data
 {aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}REG_BINARY Binary Data
 {d4bd4a0f-7591-4da2-ae67-3aa97c3c34c2}REG_BINARY Binary Data
 {42ff0794-3627-44c1-9886-765010075254}REG_BINARY Binary Data
 {839cd73f-1907-49ea-9aa5-0e6be9048087}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\SubLayer
 {b3cdd441-af90-41ba-a745-7c6008ff2300}REG_BINARY Binary Data
 {b3cdd441-af90-41ba-a745-7c6008ff2301}REG_BINARY Binary Data
 {b3cdd441-af90-41ba-a745-7c6008ff2302}REG_BINARY Binary Data
 {9ba30013-c84e-47e5-ac6e-1e1aed72fa69}REG_BINARY Binary Data
 {4224eab7-7d61-4fe0-9264-6d6568d2ddff}REG_BINARY Binary Data
 {8c36b346-4e0c-4049-8b55-5295ac35567c}REG_BINARY Binary Data
--------------fltmgr:--------------
Type:                   2
State:                  4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FltMgr
 AttachWhenLoaded              REG_DWORD  1
 DisplayName                   REG_SZ  @%SystemRoot%\system32\drivers\fltmgr.sys,-10001
 Group                         REG_SZ  FSFilter Infrastructure
 ImagePath                     REG_EXPAND_SZ system32\drivers\fltmgr.sys
 Description                   REG_SZ  @%SystemRoot%\system32\drivers\fltmgr.sys,-10000
 ErrorControl                  REG_DWORD  3
 Start                         REG_DWORD  0
 Tag                           REG_DWORD  1
 Type                          REG_DWORD  2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FltMgr\Enum
 0                             REG_SZ  Root\LEGACY_FLTMGR\0000
 Count                         REG_DWORD  1
 NextInstance                  REG_DWORD  1
 
C:\Windows\system32\drivers\fltmgr.sys
File Size: 289664    BYTES FileVersion: 6.1.7601.17514 MD5: [da6b67270fd9db3697b20fce94950741]
C:\Windows\SysWOW64\comctl32.ocx
File Size: 608448    BYTES FileVersion: 6.0.81.5 MD5: [eb5f811c1f78005b3c147599a0cccf51]
C:\Windows\SysWOW64\mscomctl.ocx
File Size: 1070232   BYTES FileVersion: 6.1.98.39 MD5: [766f501b61c22723536af696a74133d4]
C:\Windows\SysWOW64\olepro32.dll
File Size: 90112     BYTES FileVersion: 6.1.7601.17514 MD5: [703ffd301ab900b047337c5d40fd6f96]
 
MBAM Registry Settings and License Info:
========================================
--------------Settings:--------------
Advanced: 
    AutomaticQuarantine:                                       true 
    AutostartProtection:                                       true 
    LimitedMode:                                               false 
    StartSilentMode:                                           false 
    StartupDelay:                                              0 
ApplicationState: 
    First-Run-After-Installation:                              false 
General: 
    DaysUntilNotifyExpiration:                                 5 
    Language:                                                  en 
    RightClickAccess:                                          true 
    SilentErrors:                                              false 
Logging: 
    ExportLog:                                                 true 
Notification: 
ProtectionTray: 
    DisplayMilliseconds:                                       5000 
ScanHistory: 
    Duration_Complete:                                         473695 
    Duration_Driver:                                           38068 
    Duration_Filesystem:                                       44 
    Duration_Heuristics:                                       1241234 
    Duration_Loading:                                          0 
    Duration_MasterBootRecord:                                 138 
    Duration_Memory:                                           40000 
    Duration_PreScan:                                          128309 
    Duration_Registry:                                         58803 
    Duration_Sector:                                           0 
    Duration_SectorMemory:                                     0 
    Duration_Startup:                                          59174 
    ItemCount_Complete:                                        269941 
    ItemCount_Driver:                                          324 
    ItemCount_Filesystem:                                      54502 
    ItemCount_Heuristics:                                      12536 
    ItemCount_Loading:                                         0 
    ItemCount_MasterBootRecord:                                1 
    ItemCount_Memory:                                          2797 
    ItemCount_PreScan:                                         128250 
    ItemCount_Registry:                                        623 
    ItemCount_Sector:                                          0 
    ItemCount_SectorMemory:                                    221 
    ItemCount_Startup:                                         1766 
    LastScanDateEpoch:                                         1419100247228 
    LastScanType:                                              2 (Custom Scan)
Update: 
    LastUpdate:                                                2014-12-20T18:23:57 
    NotifyInstallReady:                                        true 
    NotifyOutdatedDatabase:                                    7 
    ProxyPassword:                                              
    ProxyPort:                                                 0 
    ProxyServer:                                                
    ProxyUsername:                                              
    UseProxy:                                                  false 
    UseProxyAuthentication:                                    false 
--------------Account:--------------
  Account Status:                                              Premium 
  Expiration Time:                                             2034/03/24 15:29:42 
  Activation Time:                                             2014/03/24 15:29:42 
  Trial Used:                                                  false 
--------------Access Policies:--------------
Scheduler Queue:
================
tasks: 
    09141d10-3b24-4284-bf61-c31210cf8d44:                       
      parameters:                                               
        CheckForUpdatesBeforeScanStart:                        true 
        ProcessLaunchedFromScheduler:                          true 
        ScanConfig:                                             
          ExitWhenNoMalwareDetected:                           false 
          ExitWhenQuarantineCompletes:                         false 
          ExportLog:                                           true 
          FileSystemOption:                                    true 
          RebootSystemWhenMalwareDetected:                     false 
          RemoveMalwareAutomaticallyWhenScanEnds:              true 
          ScanArchives:                                        true 
          ScanExtra:                                           true 
          ScanHeuristic:                                       true 
          ScanMemoryObjects:                                   true 
          ScanPUM:                                             2 
          ScanPUP:                                             1 
          ScanRegistry:                                        true 
          ScanRootkits:                                        true 
          ScanStartup:                                         true 
          ScanTargets:                                          
          ScanType:                                            1 (Threat Scan)
          Silent:                                              true 
          TerminateExplorerWhenMalwareIsRemoved:               false 
        StartTaskFromSystemAccount:                            false 
        TaskType:                                              0 
      triggers:                                                 
        e132a88d-fa41-4e12-abd7-0eb2d29a7532:                   
          dateinterval:                                        7:0:0 
          lastscheduled:                                       Wed, 17 Dec 2014 09:30:00 +0000 
          lasttriggered:                                        
          nextscheduled:                                       Wed, 24 Dec 2014 09:30:00 +0000 
          recovery:                                            04:00:00 
          start:                                               Wed, 01 Jan 2014 09:30:00 +0000 
          timeinterval:                                        00:00:00 
          type:                                                5 
          uuid:                                                e132a88d-fa41-4e12-abd7-0eb2d29a7532 
      type:                                                    scan 
      uuid:                                                    09141d10-3b24-4284-bf61-c31210cf8d44 
    1768da90-4973-46ef-bf97-5099b625fa34:                       
      parameters:                                               
        NotifyWhenUpdateCompletes:                             false 
        ProcessLaunchedFromScheduler:                          true 
        TaskType:                                              3 
      triggers:                                                 
        3a4e49d6-e1f9-4b0b-b199-a17ee327da38:                   
          dateinterval:                                        7:0:0 
          lastscheduled:                                       Wed, 17 Dec 2014 10:00:00 +0000 
          lasttriggered:                                        
          nextscheduled:                                       Wed, 24 Dec 2014 10:00:00 +0000 
          recovery:                                            04:00:00 
          start:                                               Wed, 01 Jan 2014 10:00:00 +0000 
          timeinterval:                                        00:00:00 
          type:                                                5 
          uuid:                                                3a4e49d6-e1f9-4b0b-b199-a17ee327da38 
      type:                                                    update 
      uuid:                                                    1768da90-4973-46ef-bf97-5099b625fa34 
Pending File Rename Operations: 
================================
If any Malwarebytes Anti-Malware items are listed below, the user must reboot to complete a Malwarebytes Anti-Malware upgrade installation.
MBAMProtector Registry Values:
==============================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector
 Type                          REG_DWORD  2
 Start                         REG_DWORD  3
 ErrorControl                  REG_DWORD  1
 ImagePath                     REG_EXPAND_SZ \??\C:\Windows\system32\drivers\mbam.sys
 Group                         REG_SZ  FSFilter Anti-Virus
 DependOnService               REG_MULTI_SZ FltMgr
 WOW64                         REG_DWORD  1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances
 DefaultInstance               REG_SZ  MBAMProtector Instance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances\MBAMProtector Instance
 Altitude                      REG_SZ  328800
 Flags                         REG_DWORD  0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Parameters
 PassThruFile                  REG_SZ  mbampt.exe
 ProductPath                   REG_SZ  C:\Program Files (x86)\Malwarebytes Anti-Malware
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Enum
 0                             REG_SZ  Root\LEGACY_MBAMPROTECTOR\0000
 Count                         REG_DWORD  1
 NextInstance                  REG_DWORD  1
MBAMService Registry Values:
============================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService
 Type                          REG_DWORD  16
 Start                         REG_DWORD  2
 ErrorControl                  REG_DWORD  1
 ImagePath                     REG_EXPAND_SZ "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe"
 DependOnService               REG_MULTI_SZ MBAMProtector
 WOW64                         REG_DWORD  1
 ObjectName                    REG_SZ  LocalSystem
 Description                   REG_SZ  Malwarebytes Anti-Malware service
 DelayedAutostart              REG_DWORD  0
MBAMScheduler Registry Values:
==============================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMScheduler
 Type                          REG_DWORD  16
 Start                         REG_DWORD  2
 ErrorControl                  REG_DWORD  1
 ImagePath                     REG_EXPAND_SZ "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe"
 WOW64                         REG_DWORD  1
 ObjectName                    REG_SZ  LocalSystem
 Description                   REG_SZ  Malwarebytes Anti-Malware scheduler
Terminal Services Status for (null) entries in PM logs and GetUserToken errors:
===============================================================================
--------------TERMService:--------------
Type:                   32
State:                  1 (The service is not running.) (State is stopped)
WIN32_EXIT_CODE:        1077
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0
 
TermService Start is set to: 3 (Manual Startup)
Proxy Status: No proxy is Set
Proxy Override: 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\
 ProxyOverride REG_SZ  *.local
LAN Settings:
=============
only 'Automatically detect settings' is selected
SystemPartition:
================
HKEY_LOCAL_MACHINE\SYSTEM\Setup\
 SystemPartition REG_SZ  \Device\HarddiskVolume1
Balloon Tips Status:
====================
Enabled
Time Format Settings:
=====================
Should be:
  h:mm:ss tt
  AM 
  PM 
  :
Currently:
REG_SZ  h:mm:ss tt
REG_SZ  AM
REG_SZ  PM
REG_SZ  :
Language and Regional Settings:
===============================
ACP:  Language is English (United States)
MACCP:  Language is English (United States)
OEMCP:  Language is English (United States)
Startup Folders for Error_Expanding_Variables Check:
====================================================
All Users Startup Folder Exists.
Current User's Startup Folder Exists.
 
Context Menu Entries:
=====================
 
 
 
 
 
 
 
 
List of MBAM Related Directories:
=================================
C:\Program Files (x86)\Malwarebytes Anti-Malware\
7z.dll                                   File Size: 920888    BYTES FileVersion:  9.20.0.0       MD5: [067f8fee78dc960d6fc36d1d071913e8]
changes.txt                              File Size: 100       BYTES FileVersion:  N/A            MD5: [a4b1260d5fa0045146288698a3db62f0]
license.rtf                              File Size: 39478     BYTES FileVersion:  N/A            MD5: [8627b31943a534aad30d154c2b2c1aaf]
master.conf                              File Size: 1258      BYTES FileVersion:  N/A            MD5: [9702ca5e82d3756c6d8af34a2ababaea]
mbam.dll                                 File Size: 579896    BYTES FileVersion:  1.0.16.0       MD5: [9605659224814baf5dc0b2c37a70b83c]
mbam.exe                                 File Size: 7229752   BYTES FileVersion:  1.0.1.711      MD5: [3c13f26a4766752314a5413038bd86b4]
mbamcore.dll                             File Size: 1829176   BYTES FileVersion:  1.1.20.0       MD5: [b5de1455392f8aea137a79a539536086]
mbamdor.exe                              File Size: 54072     BYTES FileVersion:  1.0.1.0        MD5: [7bda05509585396989e523bede832e9b]
mbamext.dll                              File Size: 310584    BYTES FileVersion:  3.0.6.0        MD5: [62ea0c53933698aa29391c231af21bd0]
mbampt.exe                               File Size: 39736     BYTES FileVersion:  1.0.0.0        MD5: [6c6ced3ffd1b24b39ecdd7416694324d]
mbamscheduler.exe                        File Size: 1871160   BYTES FileVersion:  3.1.1.0        MD5: [0bb29de40c9d9529793dcdb59a43cf5b]
mbamservice.exe                          File Size: 969016    BYTES FileVersion:  3.0.8.1        MD5: [5f82d8188b370b0cf185d4ae2b9b4a0e]
mbamsrv.dll                              File Size: 4463928   BYTES FileVersion:  1.2.0.0        MD5: [5da6de166e1ca56638e931bfe631de53]
msvcp100.dll                             File Size: 421688    BYTES FileVersion:  10.0.40219.325 MD5: [e7a36dc43b2757bdad7f1ba934234834]
msvcr100.dll                             File Size: 774456    BYTES FileVersion:  10.0.40219.325 MD5: [cf5858509b748fe5cefe63d29289f7f3]
QtCore4.dll                              File Size: 2732856   BYTES FileVersion:  4.8.4.0        MD5: [82373bfed2c741677e22dccb16f29960]
QtGui4.dll                               File Size: 8575288   BYTES FileVersion:  4.8.4.0        MD5: [2c0fc2279552ff45ec0d7d9b113f8b92]
QtNetwork4.dll                           File Size: 909112    BYTES FileVersion:  4.8.4.0        MD5: [454b9f0364d41afa69690baebda01217]
unins000.dat                             File Size: 24728     BYTES FileVersion:  N/A            MD5: [fe1e3f372ce02f1e1d2b73b5f6758b3f]
unins000.exe                             File Size: 718037    BYTES FileVersion:  51.52.0.0      MD5: [d2796ecf50731e696f0c065d24c0827a]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\accessible
qtaccessiblewidgets4.dll                 File Size: 198968    BYTES FileVersion:  4.8.4.0        MD5: [9dc9f70942de132a762c974e7ee3bed6]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Chameleon
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Chameleon\Windows
chameleon.chm                            File Size: 235882    BYTES FileVersion:  N/A            MD5: [c4190b71f037714aa77aba294434ba5b]
firefox.com                              File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
firefox.exe                              File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
firefox.pif                              File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
firefox.scr                              File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
iexplore.exe                             File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
mbam-chameleon.com                       File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
mbam-chameleon.exe                       File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
mbam-chameleon.pif                       File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
mbam-chameleon.scr                       File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
mbam-killer.exe                          File Size: 1188664   BYTES FileVersion:  3.0.2.0        MD5: [d6d202229b5cd31085d744f5b5bcf2e3]
rundll32.exe                             File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
svchost.exe                              File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
windows.exe                              File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
winlogon.exe                             File Size: 761656    BYTES FileVersion:  3.1.7.0        MD5: [625bb08813743947985b0deefc35ed12]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\imageformats
qgif4.dll                                File Size: 32568     BYTES FileVersion:  4.8.4.0        MD5: [a99351607fe64cf112d7284b738e0b6a]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Languages
lang_ar.qm                               File Size: 139423    BYTES FileVersion:  N/A            MD5: [9771d098e918204a99fa0068f431e6ba]
lang_bg.qm                               File Size: 147865    BYTES FileVersion:  N/A            MD5: [d250b37179f313e58267f7946e0522d4]
lang_ca.qm                               File Size: 149256    BYTES FileVersion:  N/A            MD5: [0cc2735ee2f231ea5d964c323ca73e08]
lang_cs.qm                               File Size: 142601    BYTES FileVersion:  N/A            MD5: [8426f7126d2851a1e6ca1f1f7e45d2ec]
lang_da.qm                               File Size: 143131    BYTES FileVersion:  N/A            MD5: [6fe13d4a5a44a3390bf9940404eeb6c7]
lang_de.qm                               File Size: 151959    BYTES FileVersion:  N/A            MD5: [9517c7c9865b5641c5c250c84b51a6d1]
lang_el.qm                               File Size: 152327    BYTES FileVersion:  N/A            MD5: [4cd483236d99cf40e9d8cf534bac05e7]
lang_en.qm                               File Size: 137689    BYTES FileVersion:  N/A            MD5: [d34a8afc30bb472c443f7f088513ff04]
lang_es.qm                               File Size: 149211    BYTES FileVersion:  N/A            MD5: [1ee5f6535d02c94812e54e3ed65de6ac]
lang_et.qm                               File Size: 141939    BYTES FileVersion:  N/A            MD5: [f6faee4a33654bb27dcf2f9d4cf955ef]
lang_fi.qm                               File Size: 145730    BYTES FileVersion:  N/A            MD5: [9f4ff431ec70747591ef0e0eaf3ed2cb]
lang_fr.qm                               File Size: 153965    BYTES FileVersion:  N/A            MD5: [8dd69dd62ee617dc3ca4f25ab2c70af8]
lang_he.qm                               File Size: 134117    BYTES FileVersion:  N/A            MD5: [3ad149f1778e6e8f8f89ecfe67a1e62e]
lang_hu.qm                               File Size: 147806    BYTES FileVersion:  N/A            MD5: [7c3ae4dde80fa8759968b218a03a7a73]
lang_id.qm                               File Size: 145710    BYTES FileVersion:  N/A            MD5: [c2a0325d9dfb5c5fce7a4832837896e7]
lang_it.qm                               File Size: 148249    BYTES FileVersion:  N/A            MD5: [4766a519a653d8e6f6ad32094a2a059b]
lang_ja.qm                               File Size: 122782    BYTES FileVersion:  N/A            MD5: [339134f906b770b833653682264bdc23]
lang_ko.qm                               File Size: 119240    BYTES FileVersion:  N/A            MD5: [5042df441910dfe9f6a55d3c005b00c7]
lang_lt.qm                               File Size: 146950    BYTES FileVersion:  N/A            MD5: [5c0fca31ff0a6d2b3f6d1722940a2dc6]
lang_lv.qm                               File Size: 146072    BYTES FileVersion:  N/A            MD5: [8623ed6977cd81c0d520f5fd84788d93]
lang_nl.qm                               File Size: 147725    BYTES FileVersion:  N/A            MD5: [1b391d5599be4724018624a27014eb75]
lang_no.qm                               File Size: 144153    BYTES FileVersion:  N/A            MD5: [2d53348f8e74f26f065e0c83e8fff7fe]
lang_pl.qm                               File Size: 147483    BYTES FileVersion:  N/A            MD5: [ce39bae20f8a2b42f93f2f5a5c6dd63e]
lang_pt_BR.qm                            File Size: 146906    BYTES FileVersion:  N/A            MD5: [b337c75fa23ba36176719d54c0269560]
lang_pt_PT.qm                            File Size: 144956    BYTES FileVersion:  N/A            MD5: [b41016907930a96a11aadb348fd9a1b6]
lang_ro.qm                               File Size: 146821    BYTES FileVersion:  N/A            MD5: [69c447559268a873808d5ae48b425ad9]
lang_ru.qm                               File Size: 148179    BYTES FileVersion:  N/A            MD5: [51d4d0c155de54f24b09be7040a7ff15]
lang_sk.qm                               File Size: 144330    BYTES FileVersion:  N/A            MD5: [3a00a97315c24e6820f8939920ef14b4]
lang_sl.qm                               File Size: 144582    BYTES FileVersion:  N/A            MD5: [47db99ccdd98936e6a38957321c71317]
lang_sv.qm                               File Size: 145435    BYTES FileVersion:  N/A            MD5: [a2b33c0364aad3e9d7daafdd4f286ee1]
lang_th.qm                               File Size: 137957    BYTES FileVersion:  N/A            MD5: [6a24ece552172d805cd428853255d294]
lang_tr.qm                               File Size: 144262    BYTES FileVersion:  N/A            MD5: [18b7fec7611c038780ee77044e523f70]
lang_vi.qm                               File Size: 144480    BYTES FileVersion:  N/A            MD5: [708062759498e791186bbe64b7246d0c]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Plugins
fixdamage.exe                            File Size: 821560    BYTES FileVersion:  1.1.0.1010     MD5: [a8181ce03e9624f2c4606af3984e345e]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware
actions.ref                              File Size: 422       BYTES FileVersion:  N/A            MD5: [1c466b6582685ba56b835ededad7b58f]
domains.ref                              File Size: 38        BYTES FileVersion:  N/A            MD5: [8c30b536b67543eb68e68b9640d4d498]
exclusions.dat                           File Size: 85        BYTES FileVersion:  N/A            MD5: [c3d591d8f80e34fdfc090698d4b5dc75]
ips.ref                                  File Size: 33        BYTES FileVersion:  N/A            MD5: [8a1c580788ea8de3f32862c2c1cf373c]
mbam-setup.exe                           File Size: 20447072  BYTES FileVersion:  2.0.4.1028     MD5: [3bd59d6c407ab1f6ddd7c5d9bd727469]
rules.ref                                File Size: 10542151  BYTES FileVersion:  N/A            MD5: [e42f057492afc2caf0f6d53c1d2640b6]
S-1-5-18-0-ntuser.dat                    File Size: 221184    BYTES FileVersion:  N/A            MD5: [5a17f8f1d816830a089ec59b83292c9d]
S-1-5-18-0-ntuser.dat.LOG1               File Size: 5120      BYTES FileVersion:  N/A            MD5: [da365811e948c366f683fe06ec8bfd2d]
S-1-5-18-0-ntuser.dat.LOG2               File Size: 0         BYTES FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-18-0-ntuser.dat{3f9e982a-8702-11e4-bdca-2c27d7dd731c}.TM.blf File Size: 65536     BYTES FileVersion:  N/A            MD5: [286f32d5223bf6e30313e4d8fdaa91fc]
S-1-5-18-0-ntuser.dat{3f9e982a-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000001.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [c9cc732f9115a340755a67c18582f3ab]
S-1-5-18-0-ntuser.dat{3f9e982a-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000002.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-0-ntuser.dat                    File Size: 249856    BYTES FileVersion:  N/A            MD5: [81fccd09456d3c53df95429f1629365c]
S-1-5-19-0-ntuser.dat.LOG1               File Size: 5120      BYTES FileVersion:  N/A            MD5: [2199f82a3b61c84a6f1ae2f4b530e001]
S-1-5-19-0-ntuser.dat.LOG2               File Size: 0         BYTES FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-19-0-ntuser.dat{3f9e9830-8702-11e4-bdca-2c27d7dd731c}.TM.blf File Size: 65536     BYTES FileVersion:  N/A            MD5: [f359e4fc3b79e3586b6fc16df04b69dc]
S-1-5-19-0-ntuser.dat{3f9e9830-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000001.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [ae32f2c79fa4bbc9e39cc51e3bec1eca]
S-1-5-19-0-ntuser.dat{3f9e9830-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000002.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-0-ntuser.dat                    File Size: 303104    BYTES FileVersion:  N/A            MD5: [08c6e772976e506cebc0495a72f98053]
S-1-5-20-0-ntuser.dat.LOG1               File Size: 5120      BYTES FileVersion:  N/A            MD5: [b159692742a273879570a3b97683abae]
S-1-5-20-0-ntuser.dat.LOG2               File Size: 0         BYTES FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-20-0-ntuser.dat{3f9e9836-8702-11e4-bdca-2c27d7dd731c}.TM.blf File Size: 65536     BYTES FileVersion:  N/A            MD5: [65ec689d10cbc685f10f1880178d5b76]
S-1-5-20-0-ntuser.dat{3f9e9836-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000001.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [600b59ccc425e4aafc62f6172b577856]
S-1-5-20-0-ntuser.dat{3f9e9836-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000002.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3606999548-2892912758-1566111049-1000-0-ntuser.dat File Size: 6270976   BYTES FileVersion:  N/A            MD5: [a60b9b80d997bebda1356781abcea716]
S-1-5-21-3606999548-2892912758-1566111049-1000-0-ntuser.dat.LOG1 File Size: 10240     BYTES FileVersion:  N/A            MD5: [08769680e1b063403c50f16142f1334c]
S-1-5-21-3606999548-2892912758-1566111049-1000-0-ntuser.dat.LOG2 File Size: 0         BYTES FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-21-3606999548-2892912758-1566111049-1000-0-ntuser.dat{3f9e983c-8702-11e4-bdca-2c27d7dd731c}.TM.blf File Size: 65536     BYTES FileVersion:  N/A            MD5: [6bdf0a76747469dc864a95d5fb6ea388]
S-1-5-21-3606999548-2892912758-1566111049-1000-0-ntuser.dat{3f9e983c-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000001.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [5531085d5d3b057b2d60e10ae4d1ccd4]
S-1-5-21-3606999548-2892912758-1566111049-1000-0-ntuser.dat{3f9e983c-8702-11e4-bdca-2c27d7dd731c}.TMContainer00000000000000000002.regtrans-ms File Size: 524288    BYTES FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
swissarmy.ref                            File Size: 24312     BYTES FileVersion:  N/A            MD5: [b19c49271b7c3df3e3b1deb0605a6b66]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration
build.conf                               File Size: 4574      BYTES FileVersion:  N/A            MD5: [f858bd69d779bb096fedd36e2a138a3d]
database.conf                            File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
gatekeeper.conf                          File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
license.conf                             File Size: 554       BYTES FileVersion:  N/A            MD5: [7c651d1ba0689aabf25e9bcedad1c26b]
manifest.conf                            File Size: 1801      BYTES FileVersion:  N/A            MD5: [7c3f07c8633b975debe3149531f8e9db]
marketing.conf                           File Size: 1434      BYTES FileVersion:  N/A            MD5: [19533c40d9c9778b2ab423dbcf063d80]
net.conf                                 File Size: 6069      BYTES FileVersion:  N/A            MD5: [8ff59eedfad58c8339621c1b37e3ab40]
notifications.conf                       File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
scheduler.conf                           File Size: 2217      BYTES FileVersion:  N/A            MD5: [fa7418132f51b08c1ced24b86e243b0f]
settings.conf                            File Size: 2063      BYTES FileVersion:  N/A            MD5: [1e56b8fef328b8d806a109fd63f2d520]
statistics.conf                          File Size: 597       BYTES FileVersion:  N/A            MD5: [aaec3a1d033518d48ac4d5a6c7a8f701]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore
build.conf                               File Size: 4157      BYTES FileVersion:  N/A            MD5: [9aea3bfa13567e5ba9d9fa9861a19a12]
database.conf                            File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
gatekeeper.conf                          File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
license.conf                             File Size: 23        BYTES FileVersion:  N/A            MD5: [0ec01df616b565180556881d8042255b]
manifest.conf                            File Size: 1568      BYTES FileVersion:  N/A            MD5: [4c40858877212acf0acd81e37ff2a99b]
marketing.conf                           File Size: 1434      BYTES FileVersion:  N/A            MD5: [19533c40d9c9778b2ab423dbcf063d80]
net.conf                                 File Size: 5344      BYTES FileVersion:  N/A            MD5: [973e9c5714cc0c56a7b9c83d876754dd]
notifications.conf                       File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
scheduler.conf                           File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
settings.conf                            File Size: 1725      BYTES FileVersion:  N/A            MD5: [06c52d7137dac16e1661f7cf004f2e4d]
statistics.conf                          File Size: 4         BYTES FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs
mbam-log-2014-10-25 (16-31-04).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [1c45cb34ea63375fa638be5e416406e4]
mbam-log-2014-11-02 (16-00-00).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [e6072e23e4a42c886825642a2ca8a3f2]
mbam-log-2014-11-08 (13-16-30).xml       File Size: 2504      BYTES FileVersion:  N/A            MD5: [27cda4745a183ef7a51ca704b8bbc30f]
mbam-log-2014-11-09 (19-29-04).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [9d4fff50d6b9877f1bd1ce1e864a10e2]
mbam-log-2014-11-16 (16-13-54).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [6fefa36ce63e44b8fbbfd4998b93aee0]
mbam-log-2014-11-23 (16-11-52).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [f7f1548ef3ca1d1352821a879dc05fb3]
mbam-log-2014-11-30 (17-17-25).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [351003d88fbcb4d9473c06069fbc1ae4]
mbam-log-2014-12-07 (16-06-22).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [3b9303313d8980a692d36a66c40f8954]
mbam-log-2014-12-07 (18-34-51).xml       File Size: 2504      BYTES FileVersion:  N/A            MD5: [a32c658b8d6cff03db0cd122fb43ed9c]
mbam-log-2014-12-14 (12-05-33).xml       File Size: 2496      BYTES FileVersion:  N/A            MD5: [b88c8258f3ef664790620a6ee3035918]
protection-log-2014-09-16.xml            File Size: 3573      BYTES FileVersion:  N/A            MD5: [90eb5beb6a330b24919b4caa239875e8]
protection-log-2014-09-17.xml            File Size: 2390      BYTES FileVersion:  N/A            MD5: [795fb2587cd49b975db435a51ebf0038]
protection-log-2014-09-18.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [dc631c0773784898d083a5863b7a5632]
protection-log-2014-09-19.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [a3f8aa53927048eb1b749076dd279377]
protection-log-2014-09-20.xml            File Size: 3556      BYTES FileVersion:  N/A            MD5: [d7072ad95b17af650efc2bc629dd7e68]
protection-log-2014-09-21.xml            File Size: 3573      BYTES FileVersion:  N/A            MD5: [fccd218abf15e457e7b51d1f5c4c206b]
protection-log-2014-09-22.xml            File Size: 3267      BYTES FileVersion:  N/A            MD5: [d7129e0a3147270bbd6757d8fee9e84f]
protection-log-2014-09-23.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [fcc8e50a7e229ead2779a138ac38dd13]
protection-log-2014-09-24.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [5398651534414fe3734c0c3426347010]
protection-log-2014-09-25.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [73082e55073bdb330c8e2d644550296e]
protection-log-2014-09-26.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [879d105a0bf78c02facf6fa6f2d7444f]
protection-log-2014-09-27.xml            File Size: 4186      BYTES FileVersion:  N/A            MD5: [3f8cc508c20ccc88d5b042a7d03cb682]
protection-log-2014-09-28.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [6136c37572afd704c5a4d6eaad8a872b]
protection-log-2014-09-29.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [2e39cd327f1fb9b78e11c5eac2c1f7ab]
protection-log-2014-09-30.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [b3981515f95dc999deea3d49c04c3e89]
protection-log-2014-10-01.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [e88945a695b350e503beb6cfe68d2ff7]
protection-log-2014-10-02.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [738b2cd047d952d6a9dc42537b37f40a]
protection-log-2014-10-03.xml            File Size: 3267      BYTES FileVersion:  N/A            MD5: [218c56b95210967b8f43d92957223c79]
protection-log-2014-10-04.xml            File Size: 4120      BYTES FileVersion:  N/A            MD5: [8ccb8ac6418f3f763fff8e8f5c535a4a]
protection-log-2014-10-05.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [445f0c52ea3e1528e95713a345397168]
protection-log-2014-10-06.xml            File Size: 2076      BYTES FileVersion:  N/A            MD5: [05af1971ddfc2b261205999d08f17ef1]
protection-log-2014-10-07.xml            File Size: 2076      BYTES FileVersion:  N/A            MD5: [da1edaaa0dccb81714f27c10e218e195]
protection-log-2014-10-08.xml            File Size: 2076      BYTES FileVersion:  N/A            MD5: [5f1c49616b81e2efe037f7c206bed64b]
protection-log-2014-10-09.xml            File Size: 2076      BYTES FileVersion:  N/A            MD5: [ef08a57603fa98827da25952bfdf0be3]
protection-log-2014-10-10.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [58c00a2f477d95e5d37201b735ce5590]
protection-log-2014-10-11.xml            File Size: 6979      BYTES FileVersion:  N/A            MD5: [ca8621818240694ac784887528d0d31d]
protection-log-2014-10-12.xml            File Size: 7326      BYTES FileVersion:  N/A            MD5: [2a4dbc3d5c26860adf33e600e1cb10d8]
protection-log-2014-10-13.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [54c6575aad1f78d140c755707bd4bea0]
protection-log-2014-10-14.xml            File Size: 2526      BYTES FileVersion:  N/A            MD5: [93e312fac54e2bfdfe9cf6bfa63c92a1]
protection-log-2014-10-15.xml            File Size: 2926      BYTES FileVersion:  N/A            MD5: [ef54aefe206cf8a4e7c7bc5f0937fe89]
protection-log-2014-10-16.xml            File Size: 3556      BYTES FileVersion:  N/A            MD5: [c1dc5fd46f8f60d37092240c345c35c5]
protection-log-2014-10-17.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [8f8d45b324e7eaad3ee2cb47bff581d0]
protection-log-2014-10-18.xml            File Size: 5909      BYTES FileVersion:  N/A            MD5: [b8680df7aed91f1b943a1a15a9431ecf]
protection-log-2014-10-19.xml            File Size: 2926      BYTES FileVersion:  N/A            MD5: [590573a9906ca31187735c5eeaeace8b]
protection-log-2014-10-20.xml            File Size: 2074      BYTES FileVersion:  N/A            MD5: [22e4b898dd0e07994c097421d389c59f]
protection-log-2014-10-21.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [17d72e6963f749c8ba9bca1ab17a3abf]
protection-log-2014-10-22.xml            File Size: 3556      BYTES FileVersion:  N/A            MD5: [b9d44764e552310c0887cc9a26cbd43f]
protection-log-2014-10-23.xml            File Size: 7984      BYTES FileVersion:  N/A            MD5: [9debdb1ca85504bba575974688e9d7ca]
protection-log-2014-10-24.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [6c6a66b8037eb56f2e0c98c67b5226c4]
protection-log-2014-10-25.xml            File Size: 3641      BYTES FileVersion:  N/A            MD5: [115710ba860eae67f7bec39a5f092ba9]
protection-log-2014-10-26.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [fd63dff9ca2d9a03815878ce3a869355]
protection-log-2014-10-27.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [02e2b5feb746752d32665e63c82b07bd]
protection-log-2014-10-28.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [bd290de04b58d261bec20d02578a149f]
protection-log-2014-10-29.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [c55fdc77a2421b2b215071eea1c2e9b9]
protection-log-2014-10-30.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [ce466bc813d6e4b57afbe7b62a3b29c5]
protection-log-2014-10-31.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [12321044d6c3099b8e1dae51c465ad35]
protection-log-2014-11-01.xml            File Size: 3268      BYTES FileVersion:  N/A            MD5: [02ac2e1f08222a4d207d32d14530a9f7]
protection-log-2014-11-02.xml            File Size: 3946      BYTES FileVersion:  N/A            MD5: [a9aad9f2454748a857a39b23405bbd12]
protection-log-2014-11-03.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [0bfa23ef01d9be7b58ef79b73a5d1991]
protection-log-2014-11-04.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [141457a792ba760bd6398e6da2f9496a]
protection-log-2014-11-05.xml            File Size: 3268      BYTES FileVersion:  N/A            MD5: [2da4442d8487492ab9f4bfa3af7918be]
protection-log-2014-11-06.xml            File Size: 2390      BYTES FileVersion:  N/A            MD5: [b8b8d1c498d694aab0ce84fcd4afa39e]
protection-log-2014-11-07.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [51c5e359a53cc9478afc65c404e637eb]
protection-log-2014-11-08.xml            File Size: 3947      BYTES FileVersion:  N/A            MD5: [8b7336726793d03f03746df6a04124c9]
protection-log-2014-11-09.xml            File Size: 3642      BYTES FileVersion:  N/A            MD5: [ec169c104418e31e396e04354256ea05]
protection-log-2014-11-10.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [9878355ac59ada8a0e27ca4ad7ee1a2b]
protection-log-2014-11-11.xml            File Size: 3575      BYTES FileVersion:  N/A            MD5: [81958eebdac200d20936abcd154a42c1]
protection-log-2014-11-12.xml            File Size: 2390      BYTES FileVersion:  N/A            MD5: [e7c6abc8c1c7241697c002bbffa9ee66]
protection-log-2014-11-13.xml            File Size: 2390      BYTES FileVersion:  N/A            MD5: [09c008f2251ff2d7c9d19ab8062a4142]
protection-log-2014-11-14.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [27aacf6cd216af73cfb93c08837b541c]
protection-log-2014-11-15.xml            File Size: 3577      BYTES FileVersion:  N/A            MD5: [f6e082ee7e1ce86b16d6b1fa0c8d6417]
protection-log-2014-11-16.xml            File Size: 4955      BYTES FileVersion:  N/A            MD5: [b87f34eabe7dd397a07eba1f18cc20d3]
protection-log-2014-11-17.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [c75b63e00300d293f41d7838bab5b8fa]
protection-log-2014-11-18.xml            File Size: 2390      BYTES FileVersion:  N/A            MD5: [855f28db35f04360f315d2eb4299bdce]
protection-log-2014-11-19.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [e8f67c2a11bbbf26d38a494c1c124404]
protection-log-2014-11-20.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [99d4fe765f3d64c5e2be7fe5835a8674]
protection-log-2014-11-21.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [4fe69e8f14c6032a19b6c520698cdfc5]
protection-log-2014-11-22.xml            File Size: 2390      BYTES FileVersion:  N/A            MD5: [65409b0cfe4ee5d8115d5bb429917e7d]
protection-log-2014-11-23.xml            File Size: 8046      BYTES FileVersion:  N/A            MD5: [325b20d6e46b6d00f69d73ac662b3099]
protection-log-2014-11-24.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [c11119c7d3c2847c6a5979b01fe16c33]
protection-log-2014-11-25.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [902cc2403630dc9489259ba54d12df16]
protection-log-2014-11-26.xml            File Size: 4974      BYTES FileVersion:  N/A            MD5: [06ca5d15ba5aa952083b78250f1ded5c]
protection-log-2014-11-27.xml            File Size: 3269      BYTES FileVersion:  N/A            MD5: [4db7897ecde204ebab540deb66212fd9]
protection-log-2014-11-28.xml            File Size: 4139      BYTES FileVersion:  N/A            MD5: [b052b11ed7d5f7189384e38c6e8649cd]
protection-log-2014-11-29.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [7922189a5a2d4efa244a3fe2447d3573]
protection-log-2014-11-30.xml            File Size: 6309      BYTES FileVersion:  N/A            MD5: [87eb6a9120a5436e30a4a076bd232f10]
protection-log-2014-12-01.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [e2029eb4533cddd7df517532167fef6c]
protection-log-2014-12-02.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [1c03831b3b25b9fdc44e9ae8833247e7]
protection-log-2014-12-03.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [37c71f9b51698f5157b01a63c110cfd6]
protection-log-2014-12-04.xml            File Size: 33592     BYTES FileVersion:  N/A            MD5: [d4f955983317fbc20610a42dec561d6e]
protection-log-2014-12-05.xml            File Size: 23306     BYTES FileVersion:  N/A            MD5: [6885589150441ed6ab8b7179ca0d7298]
protection-log-2014-12-06.xml            File Size: 24362     BYTES FileVersion:  N/A            MD5: [7f11ef77a23c099f1302e4a03e71153e]
protection-log-2014-12-07.xml            File Size: 8394      BYTES FileVersion:  N/A            MD5: [582242ba37e772677578a04cba227344]
protection-log-2014-12-08.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [ed866433d33ba94ae8ee4a92f8ea6381]
protection-log-2014-12-09.xml            File Size: 4740      BYTES FileVersion:  N/A            MD5: [2ae43dff6e602208aff32d50d41a8d2b]
protection-log-2014-12-10.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [e7d4a300518eb2a79235dc36dd1098bb]
protection-log-2014-12-11.xml            File Size: 3268      BYTES FileVersion:  N/A            MD5: [4479049956f58e75e57be9862fc12878]
protection-log-2014-12-12.xml            File Size: 2390      BYTES FileVersion:  N/A            MD5: [75c86ca5f8d5c9a9add3f512f32f3c66]
protection-log-2014-12-13.xml            File Size: 3269      BYTES FileVersion:  N/A            MD5: [25177ce2364ce6cfda4359e9e5c02a6b]
protection-log-2014-12-14.xml            File Size: 5291      BYTES FileVersion:  N/A            MD5: [2fed7e1ff858645e0e9f663e33b28ad9]
protection-log-2014-12-15.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [ec5cee18be4d05f92d1858b571e5fda3]
protection-log-2014-12-16.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [a7712373453ac30f7e30acd93227366b]
protection-log-2014-12-17.xml            File Size: 1224      BYTES FileVersion:  N/A            MD5: [2797396811f10d3c76ac8b340140951e]
protection-log-2014-12-18.xml            File Size: 6249      BYTES FileVersion:  N/A            MD5: [dc9b941220cdb790d28250e932e39d42]
protection-log-2014-12-19.xml            File Size: 4776      BYTES FileVersion:  N/A            MD5: [32235a74fcd556a2e3c2f9d79df723ac]
protection-log-2014-12-20.xml            File Size: 5734      BYTES FileVersion:  N/A            MD5: [e7a23031832c487128ba86cff6ffdb34]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Quarantine
5875133365.data                          File Size: 769       BYTES FileVersion:  N/A            MD5: [93f9160627c2404bea98fc9c0d345499]
5875133365.quar                          File Size: 32256     BYTES FileVersion:  N/A            MD5: [6e2ab050881152c6dd5e85f480036a09]
Malware Exclusions:
===================
Unable to access exclusion information: Error code 20001Web Exclusions:
================
Unable to access exclusion information: Error code 20001Quarantined Items:
===================
Unable to access quarantine information: Error code 20001===============================================================
END OF FILE
```


----------



## Basementgeek (Feb 7, 2005)

*Re: Malwarebytes will not load Rootkit Driver*

Have you looked here?:

https://forums.malwarebytes.org/index.php?/forum/116-malwarebytes-anti-rootkit-beta-help/

BG


----------



## Masterchiefxx17 (Feb 27, 2010)

*Re: Malwarebytes will not load Rootkit Driver*

Sorry, I am not using the Rootkit tool, but rather the full version of MBAM. The built in Rootkit in MBAM appears to be failing.


----------



## Deejay100six (Nov 24, 2007)

*Re: Malwarebytes will not load Rootkit Driver*

Did you check off the (applicable to your situation) solutions here?


----------



## Masterchiefxx17 (Feb 27, 2010)

*Re: Malwarebytes will not load Rootkit Driver*

But I don't want it turned off. It used to work this entire time, but now this error.


----------



## Rich-M (May 2, 2007)

*Re: Malwarebytes will not load Rootkit Driver*

Justin,
There is a rather long thread at the Mbam forum dealing with this, have a read:
https://forums.malwarebytes.org/index.php?/topic/144813-unable-to-load-the-anti-rootkit-driver/


----------



## tetonbob (Jan 10, 2005)

*Re: Malwarebytes will not load Rootkit Driver*

Hi Justin.

error 20025, run mbam-clean, and reinstall MBAM.
If you're using the Premium licensed version, be sure to have your license information handy first.

You may want to make note of your scheduled updates and scans, as this process will remove those as well, and they will need to be recreated.

• Download and run "mbam-clean.exe" from here: http://downloads.malwarebytes.org/file/mbam_clean
• It will ask to restart your computer, please allow it to do so (this is very important)

Then reinstall the latest version of Malwarebytes Anti-Malware via the link below
http://downloads.malwarebytes.org/file/mbam

Save the file to your desktop then double-click it to begin installation. 

Let us know if this corrects the problem you're experiencing.


----------



## Masterchiefxx17 (Feb 27, 2010)

*Re: Malwarebytes will not load Rootkit Driver*

Okay, I've clean MBAM and reinstalled it. I'll let you know if that fixes the issue.

Thanks.


----------



## tetonbob (Jan 10, 2005)

*Re: Malwarebytes will not load Rootkit Driver*

While exclusions are not always needed with MSE, you may want to do that as well.

How to configure MSE to exclude Malwarebytes files
For 64-bit Windows Vista / 7 / 8.x

C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamdor.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbampt.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

Step 1. Open the MSE application

Step 2. Click the Settings tab

Step 3. In the Settings Window, select "Excluded files and locations" in the left column.

Step 4. On the right side of that same window, click the Browse button.

Step 5. Navigate to C:\Program Files (x86)\Malwarebytes Anti-Malware\ 

Step 6. Select mbam.exe from that list of files and click OK. This puts you back at the Settings screen.

Step 7. Now click the Add button again to select mbam.exe in the box that has a "Remove" button beside it. 
That adds that file to the list of exclusions.

Repeat steps 4-7 for the remaining files listed above. 
When all four files have been added to the MSE exclusion list, close the MSE application.

Now you need to follow these quick steps to add your "Microsoft Security Client" application folder to Malwarebytes "Malware Exclusions" list:

Step 1. Open the Malwarebytes application.
Step 2. Click on Settings
Step 3. Click "Malware Exclusions" in the left column
Step 4. Click on "Add Folder"
Step 4. Navigate to C:\Program Files\
Step 5. Click once on "Microsoft Security Client" folder to highlight it.
Step 6. Click on "Select Folder".
Step 7. Close Malwarebytes.
Step 8. Reboot your computer. <--very important!


----------



## Masterchiefxx17 (Feb 27, 2010)

*Re: Malwarebytes will not load Rootkit Driver*

The issue appears to have been fixed! Thanks for all the help Bob!

I'll make sure to make the exclusions to MSSE and MBAM. :thumb:


----------



## tetonbob (Jan 10, 2005)

Good to hear, I'm glad to help, Justin. :thumb:


----------

