TripodBob Posted February 15, 2015 ID:939797 Share Posted February 15, 2015 Have been using MBAR 1.8.3.1004 with no problems for a while now. I've been running it every 10 days or so. Today I forgot to stop MBAM before starting MBAR; I immediately got the BSOD with this announcement "A driver has overrun a stack-based buffer...) STOP:F7. Listed at the bottom was the driver mbamchameleon.sys. I restarted the computer and tried MBAR again. I got another BSOD with the same announcement, same stop error but the listed driver was mbamswissarmy.sys. I restarted the computer, stopped MBAM malware protection and malicious website protection. Started MBAR. I got the same BSOD with the same announcement, same stop error but this time no driver was listed. I've reinstalled MBAR and MBAM but problem persists. Next steps? Link to post Share on other sites More sharing options...
1PW Posted February 15, 2015 ID:939801 Share Posted February 15, 2015 Hello TripodBob:Please locate and individually zip the latest two dump files which are very likely located within the C:\WINDOWS\Minidump directory.Then, please read Diagnostic Logs and individually attach the requested files only from Log Set 1 and the zipped dump files in a reply to this thread. Please do not copy/paste nor zip the Farbar output diagnostic text files.Thank you. Link to post Share on other sites More sharing options...
TripodBob Posted February 15, 2015 Author ID:939863 Share Posted February 15, 2015 Thanks for the speedy reply.The Minidump directory is empty but the BSOD did say it was dumping files...maybe somewhere else?Requested Farbar files are attached.Addition.txtFRST.txt Link to post Share on other sites More sharing options...
1PW Posted February 15, 2015 ID:939893 Share Posted February 15, 2015 Hello TripodBob: Thank you for the perfect Farbar report files. The FRST.txt report reveals a recent .DMP file at:2015-02-14 21:35 - 2013-09-22 05:52 - 00000000 _____ () C:\WINDOWS\MEMORY.DMPIf the above date and time coincides with any MBAR related BSOD, then please use either of your currently installed 7-Zip, or WinRAR apps, to compress that .DMP file and attach it in a reply to this thread.If that compressed file is not compatible with the IP.Board software that supports this Malwarebytes Community Forum, you may be requested to temporarily alter your XP's settings for processing BSOD dumps.Thank you. Link to post Share on other sites More sharing options...
TripodBob Posted February 15, 2015 Author ID:939915 Share Posted February 15, 2015 I'd like to comply but C:\Windows\MEMORY.DMP is empty. It's listed as size of 0 kb. Trying notepad showed a blank screen. Link to post Share on other sites More sharing options...
1PW Posted February 15, 2015 ID:939921 Share Posted February 15, 2015 Hello TripodBob: Thank you for your good effort. If you are willing to invest a bit more time and effort, a minimal amount of crash information may still be gleaned. 1. If you have super easy access to any digital camera, please photo the next BSOD display such that you crop the image to yield the most focused/readable result of the entire blue screen's content. e.g. http://www.pcstats.com/articleimages/200409/BSOD_2.gif or 2. Please manually record the blue screen's most relative variable information (usually in the top-most 25%, and the bottom-most 25%) and include this, or an image from above, in your next reply. Thank you for your continued patience and understanding. Link to post Share on other sites More sharing options...
TripodBob Posted February 15, 2015 Author ID:939930 Share Posted February 15, 2015 This time I stoped MBAM before running MBAR but BSOD still shows MBAM driver. bsod.bmp Link to post Share on other sites More sharing options...
Staff tetonbob Posted February 15, 2015 Staff ID:939934 Share Posted February 15, 2015 TripodBob, does the BSOD occur if you run a scan in Safe Mode? Also, can you avoid BSOD by running MBAR this way?•Please run Malwarebytes Anti-Rootkit (MBAR), but we need to run it a special way. Open a command prompt, and CD to the \mbar folder.You can copy/paste this command assuming mbar folder is on desktop as expected:cd "%userprofile%\desktop\mbar"•In the black command prompt box, type in the following and press Enter:mbar.exe /z(note - there is a space between mbar.exe and /z)•MBAR will launch. Update as usual, then click 'Next.Click Scan.•If malware is found, do NOT press the Cleanup button when the scan completes. Click EXIT.Please send me the system-log.txt for review by our developers. You can just attach that log as well. It's in the mbar folder on your desktop. Link to post Share on other sites More sharing options...
1PW Posted February 15, 2015 ID:939942 Share Posted February 15, 2015 (edited) EDIT: Please delete this entire entry. @TripodBob: You could not be in better hands now. Thank you kindly Bob. Edited February 15, 2015 by 1PW Link to post Share on other sites More sharing options...
TripodBob Posted February 16, 2015 Author ID:939955 Share Posted February 16, 2015 Thanks for the help 1PW! MBAR ran fine in safe mode.system-log.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted February 16, 2015 Staff ID:939969 Share Posted February 16, 2015 Thanks for the help, 1PW! TripodBob, thanks for confirming Safe mode works. Can you now try the mbar.exe /z command in Normal Mode? Link to post Share on other sites More sharing options...
TripodBob Posted February 16, 2015 Author ID:939974 Share Posted February 16, 2015 No problem running mbar.exe /z in normal mode either.system-log.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted February 16, 2015 Staff ID:939975 Share Posted February 16, 2015 Great, thanks for confirming. Please see your Private Message inbox. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now