Jump to content

MBAM Caused Blue Screen Error

Recommended Posts



I dumped all my cache then got the most recent updates for MBAM (free v1.36). I then opened MBAM and when I tried to run a full system scan, the computer crashed and restarted. I logged back in and received a "serious error" message which stated a driver or device problem. I noted that it included a minidump file (text included below). I had that file reviewed and it appears to be related to MBAM.

Current operating system is XP SP3, Avast (free), SAS (free), SpywareBlaster (free) and IE8. The last MBAM full scan I actually ran was just before Microsoft Patch Tuesday and there were no issues. I also use it to scan incoming files as I receive them, so the most recent MBAM scan of an individual file was earlier today, again, no problem. It may be related to the most recent updated definitions. I have since been able to run a full scan with no issues.

Here is the text from the Minidump file that I was advised to post here for your follow-up. If you need to see the file itself, please advise and I will attach it. Thanks in advance.


Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.


Arg1: e2fbd008, memory referenced.

Arg2: 00000000, value 0 = read operation, 1 = write operation.

Arg3: ee6a7e8a, If non-zero, the instruction address which referenced the bad memory


Arg4: 00000001, (reserved)

Debugging Details:


Could not read faulting driver name

Probably caused by : mbamswissarmy.sys ( mbamswissarmy+1e8a )

READ_ADDRESS: e2fbd008



ee6a7e8a 8b7e28 mov edi,dword ptr [esi+28h]





PROCESS_NAME: mbam.exe

LAST_CONTROL_TRANSFER: from ee6a7022 to ee6a7e8a


WARNING: Stack unwind information not available. Following frames may be wrong.

eed8dbb8 ee6a7022 00002c63 00000000 00100002 mbamswissarmy+0x1e8a

eed8dbd8 ee6a7340 e2323388 e1c28840 e1c28840 mbamswissarmy+0x1022

eed8dbec ee6a6a82 e1c28840 eed8dc1c 00000000 mbamswissarmy+0x1340

eed8dc10 ee6ace4b 82017e68 82017ed8 e1c28840 mbamswissarmy+0xa82

eed8dc34 804e37f7 82335040 00000043 806f02d0 mbamswissarmy+0x6e4b

eed8dc44 80567f81 82017ed8 81fb6e50 82017e68 nt!IopfCallDriver+0x31

eed8dc58 8057aa9f 82335040 82017e68 81fb6e50 nt!IopSynchronousServiceTail+0x70

eed8dd00 8058efe3 000001d0 00000000 00000000 nt!IopXxxControlFile+0x611

eed8dd34 804de7ec 000001d0 00000000 00000000 nt!NtDeviceIoControlFile+0x2a

eed8dd34 7c90e514 000001d0 00000000 00000000 nt!KiFastCallEntry+0xf8

0012e064 00000000 00000000 00000000 00000000 0x7c90e514




ee6a7e8a 8b7e28 mov edi,dword ptr [esi+28h]


SYMBOL_NAME: mbamswissarmy+1e8a


MODULE_NAME: mbamswissarmy

IMAGE_NAME: mbamswissarmy.sys


FAILURE_BUCKET_ID: 0x50_mbamswissarmy+1e8a

BUCKET_ID: 0x50_mbamswissarmy+1e8a

Followup: MachineOwner


Link to post
Share on other sites

Two additional things that I neglected to mention in my original post. I had ran a full SAS scan before the MBAM scan. It was completed with no problems detected and I closed SAS before starting MBAM. I didn't think that it would be part of the issue which is why I didn't mention it. Also the Database Version when the error appeared was 2011 - 4/19/2009 (if that is of any help). After the initial problem, the error did not re-occur. I was able to run a full scan.

I have since downloaded Database Version 2015 - 4/20/2009 but have yet to run a scan. I'll repeat the precise steps I took yesterday, including the SAS scan. If the problem crops up again, I'll post a fresh minidump file.


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.