Mbamswissarmy.sys

jim22

What is MBAMSWISSARMY.SYS? Avast has blocked it as a possible rootkit but I've a feeling its part of malwarebytes which I have.

imho

http://www.google.co.uk/search?q=Mbamswissarmy.sys&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-GB:official&client=firefox-a

RussJK

It's part of Malwarebytes as you've realised so more than likely a false positive. I've never had Avast detect it, so upload it to virustotal.com if you want to be certain that it's not an imposter.

Do you have the pro version of Malwarebytes?

spg_SCOTT

I am guessing that it was about 8 mins after booting?
That is when avast runs the anti-rootkit scan.

There have been occurances of this in the avast forums, and some people get the alert, others don't.

I have had it once,a while ago, and it was when avast did the anti rootkit scan and MBAM was scanning at the same time. (free version)

Choose ignore and check the option to submit to avast.

jim22

Thanks Russ, I have the free version. Somehow I must have deleted the mbamswissarmy.sys file because malwarebytes no longer works reporting that this file is missing. I have done a boot scan using avast and it reports no threat.

spg_SCOTT

No...antirootkit is delete or ignore...

You will have to re-install MBAM I think...

jim22

Thanks both-I've reinstalled malwarebytes. No alerts as yet. I'm wondering whether i should run a malwarebytes scan to see if this triggers avast though I believe avast checks files all the time-does it not?

spg_SCOTT

You can run a scan with MBAM.

Generally this only occurs in specific circumstances (I said I have had it happen once, and have tried repeatedly to work out the exact timing points etc. and not managed to)