jsljustin

Hi Bob, no worries at all! It has been many days now without a BSOD at all, I am wondering if it only gets triggered when trying to register / install the farflt.sys driver? In which case, should I uninstall MBAM 3 premium and then reinstall it again, to see if I can trip up a BSOD? If so, is there a preferred way to uninstall MBAM 3, or is via control-panel OK? Also, I have set my dumps to a full memory dump, but I am worried as sometimes dumps don't get written - if there is any problem, sometimes the dump file doesn't get written at all (volmgr issues). Anyway, what do you think? Thanks - Justin.

Hi Bob, yes, I can set my virtual memory size to automatic, it won't need to be any set size, I just have it set to the recommended (around 2GB) as this avoids the crazy high CPU usage bug. I'll set it up now and set the dump to a full memory dump. But it will require that I get another BSOD, which may or may not happen, as Windows 10 seems to be somewhat "adaptive" and seems to adjust things if BSOD's are occuring (that has been my experience, anyway). The only other concern is that sometimes memory dumps don't get written, for whatever reason. But I will try and get a BSOD and full memory dump for you. I will PM you with a link if/when I have what you need. Thanks.

Hi again tetonbob, please find attached a minidump file for (I think) the first of the two BSOD that seemed to be caused by farflt.sys. It does point to memory (memory management) as the cause, but looking at parameter 1 suggests "a corrupt PTE has been detected". You probably would know better than me, but my understanding is that this parameter value can often come about due to page faults or hard page faults. I actually got similar BSOD not that long ago when trying to update to the latest Windows 10 update, so I did run memtest86 (not memtest86+ which gives false positives at test #7 when using multicore CPU's) - ran it for 19 passes on a known good stick (4GB) to test the motherboard Ram slot 1 - came back with no errors. Then I ran it for 15 hours (8 passes) on the two 8GB sticks (16GB) of ram that I normally use and am using now, again it came back with no errors at all. Let me know how you go. Thanks - Justin. 111017-5890-01.zip

Hi tetonbob, I've attached the event viewer log for you. Note that it is the event viewer log for Windows > System, this is the log that is relevant and shows the bugcheck events. I tried setting the memory dump settings to a full dump, but it requires me to set my pagefile to 16GB which is not the recommended value. I have the pagefile set to the recommended settings for the reason that setting it to 16GB (Automatic management) causes a well known issue where the CPU can run at 99% continuously. I will post back shortly with the minidump file, see how you go with that. If only absolutely necessary, I can set the pagfile to 16GB and set the dumps to a full memory dump. As for reproducing the problem, that might be tricky. The BSOD occurred twice today so far, only on booting into windows, but it doesn't do it every time. Thanks. JustinL_EventLog.zip

Hi tetonbob, I got the crashes before I even had a chance to go over all the windows 10 settings, so the windows 10 default was in place (automatic memory dumps). Also, one BSOD failed to write the memory dump (volmgr failure due to whatever reason). I've attached the mb-check-results.zip file after following the instructions per your link above. I will get a dump file to you as soon as I can, note that it is a minidump, not a full kernel dump, due to the settings in windows 10 being at their defaults. Note that an examination of the dump file is not all the evidence. Careful examination of event viewer has shown me that two of the BSOD occurred immediately after the farflt.sys driver was registered in event viewer as installed (within 1 second a bugcheck error was generated in event viewer). Thanks. mb-check-results.zip

Sorry, I meant to say in "Event Viewer" I was able to notice that within 1 second of farflt.sys being installed, a bugcheck was listed (in event viewer).

Hi all, just reinstalled Windows 10, and have had several BSOD (Blue Screens, or Bugchecks). Am running Windows 10 1709 (Fall 2017 feature update). All blue screens have shown that within a second of farflt.sys being installed (kernel mode driver), which appears to be a Malwarebytes driver component, I get a system crash (BSOD). Am running Malwarebytes Premium Version 3.3.1.2183. Analysis of 2 of the 3 BSOD (1 failed to write the dump to disk) give memory management errors, but I already tested my memory over 3 days using memtest86, and tested 2 different slots and 3 different sticks of ram, and after 19 passes on 1 4GB stick and 8 passes on 2X8GB sticks, all came back with no errors. Plus, the BSOD all occurred immediately (within 1 second) of farflt.sys being installed, which suggests to me that this component is a fault. I also suspect that this driver is not installing properly due to the BSOD's, hence the reason why it keeps trying. Any help on this? I read in another thread to disable ransomware protection, but I thought I'd ask for advice and/or have this reported to see if we can get a fix for it. Thanks - Justin

Hi geekGirl999, yes, good points. Unfortunately, Windows update keeps re-downloading the Fall creator update for me in the background, the best I can do at the moment is kick it forward by snoozing it for 3 days. I did rule out Avast AV and MBAM 3 - at least, I still got BSOD's with both of these uninstalled, but the update seemed to get further along before Blue Screening with AV and MBAM uninstalled. I agree that we are defacto beta-testers for the Windows 10 enterprise users - they get the updates after all the bugs that we get to find get ironed out :-) I am fairly confident that this update has caused some sort of conflict either with software or drivers on my system, but unfortunately I still am at a point where I have to test my hardware now as well, as I am out of ideas and options.

If it helps, I was getting a BSOD during the Windows 10 Feature update 1709 about a week ago. I tried uninstalling MBAM 3 (premium) today and when I installed Windows 10 1709 just now, got another BSOD. So for me at least, MBAM is not the issue (or the only issue). Windows 10 updates the past few months have been giving me a lot of BSOD's (Stop codes). Even with all drivers up-to-date it hasn't helped.

He could have said that, instead of accusing me of something I didn't do and then blame me for that which he created. I respectfully ask you both to move on, as I am. Thank you.

Hi Telos, I didn't make any other posts, thank you. I simply was sharing that I had a similar issue to the original poster, if that was of any help. I'm patient, I just have a right to show one time that I had the same issue as the OP. Thank you.

If it is the same problem as above, my MBAM tray application is messing with my normal desktop interactions. MalwareBytes Premium version 3.2.2. The MBAM tray application now comes up in a list of alt-tabbable running programs, even though MBAM should be minimised to the system tray. What is worse now, is that I killed the tray application as I was not able to alt-tab through my running programs, thinking that if I killed it then restarted MBAM, the issues might go away, but now, whenever I close MBAM, it no longer sends MBAM to the system tray but closes the program down altogether (previously, closing MBAM just minimised it to the system tray). A fix would be useful, thank you.

I was getting the error (failed installation) of CCleaner when trying to upgrade it to version 5.35. Tried disabling ransomware protection, but that didn't work. In the end, shutting down Malwarebytes (premium) completely enabled me to install the CCleaner upgrade. It seems something else with MBAM is blocking the install of CCleaner. I am on 64 bit Windows 10. Hope that helps. Thanks.

Yes, I've now got an unused bunker deep in the ground. What can I do with it? Oh well, will have to wait until Donald Trump pushes that red button, I guess. Anyway, thanks to Malwarebytes staff for fixing this so quickly. Now, what was I doing before all this started?

I can confirm the problem has been fixed. You just need to update MBAM, then perhaps (in my case) shut down and then restart MBAM 3 as described here: Thanks for the speedy fix!

Thanks for the update, Porthos, cheers.

Hi, thanks for the replies. It seems like a lot of other users are having this same problem, so you might want to follow this other thread as well. Cheers.

Same problems here, Windows 10, Malwarebytes version 3.1.2.1733 What is worse is that I thought I might be infected, so I tried doing a scan. Well, the scan lasted all of about 2 seconds. The logs of the attempted scan say "Result: cancelled". So I am unable to enable web-protection and I am unable to do a scan at all, like others here have noted. Anyway, the only good news is that it seems like a lot of people have this problem too, so it is not just me.

Hi, I noticed malwarebytes just updated, I am now running version 3.1.2.1733. The real time protection - web protection is turned off and any and all attempts to turn it on fail, and it keeps defaulting back to "off", and I get constant pop-ups telling me "Real-Time Protection layers turned off". I know that! I am trying to find a way to enable the web protection, but so far have found no way to enable web-protection. I have done a full (cold) reboot, I have uninstalled, cleared all registry, cache data, then reinstalled, but the problem persists. My only solution is to uninstall malwarebytes 3 premium and look for a solution that actually provides me with protection. Is this a known issue? Any ideas on how to fix? Thanks.

Yes, I am getting the "real-time protection is turned off" every time I boot, reboot, or resume from sleep or standby. I just find that if I try and enable protection via the main interface, it gets stuck and won't fix itself, so I just use the pop-up message and click "Turn On". Am using version 3.0.6.1469 as well.

Turning on "Enable self-protection module early start" *seems* to have fixed the issue for me, but it is early days. Will report back if I get the issue again.. Also, when Malwarebytes reported that real-time protection was disabled, I opened the main interface, but the settings showed the real-time protection *was* enabled. Maybe some sort of reporting error? Thanks. Justin

Hi, I am getting the "real time protection layers are turned off" more now since the upgrade than before. It only happened to me once with malwarebytes 3.0.5, but it is happening regularly now with 3.0.6.

I got the warning that the real-time protection is disabled (turned off) for the first time today, just after booting up. I'm on Windows 10 and have avast AV as well. Just FYI, I installed Malwarebytes 3 many weeks ago, and this is the first time I have seen this message about Real-time protection being turned off.

Yes, my Malwarebytes seems to have settled down now, no real issues at all now. Even the Edge browser seems to work now, no issues. Thanks.

I get the same with Edge (but I'm not in the Windows Insider program) - on Windows 10. I noticed that Edge is working fine now with Malwarebytes 3.0.5 but only after I turned off then turned on Malwarebytes again, then re-launched the Edge browser. Before that, I just got no page loading at all in Edge. Edit - I just checked, and my smart screen filter is disabled.