Hey guys.

I have absolutely no idea why this is occuring, but i was looking through my event viewer and noticed 2 entries for Audit Failures.

Here's the log;



Any ideas?

mbamswissarmy.sys is a driver for MBAM just add it to the exceptions so it doesn't get scanned.

Try this:

Open Windows Defender

click Tools > settings click options scroll down to Advanced Options and under Do not scan these files or locations click add and navigate to mbamswissarmy click OK. You should stop seeing the warning from WD.

Path: XP is C:\WINDOWS\system32\drivers\mbamswissarmy.sys
Path: Win 7: C:\WINDOWS\system32\drivers\mbam.sys


Cheers

Thanks for your response, I'm glad someone feels like reciprocating the favour

I don't have Defender and it doesn't seem like it's a security app that's causing it. I'm seeing this in the Event Viewer.

What OS are you currently running?

I have mine turned off.....you can add an exception within MalwareBytes and/or your FW/AV program?

Cheers
Rick

I'm running 7 ultimate. I don't think it's my AV/FW causing the audit failures though.

Emmm.....Have you tried adding an exception to Malwarebytes? It's related to malwarebytes....you can just add an exclusion to that file from being scanned.....

Are you running malwarebytes as well?

Nope, i dont have MWB installed on this system.

Then remove it, from System32 folder...you can delete it because it's part of MWB.....clear events logs, reboot it then look at your events log again...try and see if it comes back.

Or you can remove the file itself to a different but external hard drive or USB for back up.....

Yeah, i've already moved the offending files to a different destination and it seems the system doesn't require them (i'll keep them JIC). The failures haven't come back and to be fair it only happened the once. I'm more wondering why when they were there they failed the audit checks and gave the errors they did???

Did you at any point have MWB presented on that drive in the past? It could be because that Windows does not recognize the file as TRUE to the system and not a FAULTY error like issues in your Events Log.

Sometimes, especially new OS and other programs are not 100% interwoven with each other, thus neglect the EVENT VIEWER thinking it's a problem or show errors.

Thoughts?