Jump to content
saifrehman23

Bitdefender 2016 + Malwarebytes Premium BSOD

Recommended Posts

· OS - Windows 10 Home
· x64
· What was original installed OS on system? I installed Windows 8.1 Home at first, no preinstalled OS
· Full Retail Version Windows 8.1 Home, upgraded to Windows 10 Home
· Age of system - ~1.3 years for CPU, RAM, PSU; ~1 years for GPU, SSD
· Age of OS installation - have you re-installed the OS? - I did a fresh install three days ago. 

· CPU - FX 8350 @ 4.7Ghz
· Video - Card Titan X
· MotherBoard - Asus Sabertooth 990fx R2.0
· Power Supply - Corsair AX760 Platinum Rated (760w)

· System Manufacturer - Self built
· Exact model number (if laptop, check label on bottom) - N/A

· Desktop

I have already ran 15 hours of memtest86 with no errors. 

I have already tested stability of system with Prime 95 blend for 24 hours. 

I did a fresh install of Windows 10 Home three days ago and installed all software from fresh downloads. 

After my first BSOD I uninstalled Malwarebytes and used the computer for several hours with no crashes. 

I re-installed Malwarebytes, after having disabled Bitdefender on-access scanning, and placed exclusions in both programs. 

I crashed roughly an hour after and that's why I'm here. :)

 

SysnativeFileCollectionApp.zip

perfmon.zip

Share this post


Link to post
Share on other sites

If you search through the BSOD forums you'll see that most of the BSOD posts are from systems with BitDefender 2016 and MalwareBytes Premium.
I have heard different opinions about BitDefender and the most frequent one is to revert to BitDefender 2015.
Another option is to stop MalwareBytes from loading with Windows.  That way you can still do "on-demand" scanning, yet the drivers won't load all the time.

That being said, here's the analysis...........

 

 

Share this post


Link to post
Share on other sites

Your UEFI/BIOS (version 2501) dates from 2014.  Please check at the manufacturer's website to see if there are any UEFI/BIOS updates available for your system.  If you are able to install the update through Windows (without booting from an external drive), then go ahead and update it.  WARNING - if the computer might shut down during this procedure, please don't do it, as this may physically damage the computer and prevent it from booting.
 

Only 4 Windows Update hotfixes installed.  Most build 10586 (TH2/1511) systems have more than this.  Please visit Windows Update and get ALL available Windows Updates.
The actual number is not important.  Rather it's important that you checked manually, installed any available updates, and didn't experience any errors when checking or updating.  The WER section of the MSINFO32 report shows several recent Windows Update failures.

MSI Afterburner and Riva Tuner (along with EVGA Precision) is known to cause BSOD's in some Windows systems (it's driver is usually RTCore64.sys).  Please un-install them immediately!

If you're overclocking, please stop the overclock while we're troubleshooting.  Feel free to resume the overclock once the system has been stabilized.

The memory dumps are of the type that we see when there is a problem between BitDefender 2016 and MalwareBytes.
I suggest reverting back to BitDefender 2015.
Good luck!

Analysis:
The following is for informational purposes only.
**************************Thu Mar 24 00:02:47.688 2016 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\032316-6718-01.dmp]
Windows 10 Kernel Version 10586 MP (8 procs) Free x64
Built by: 10586.162.amd64fre.th2_release_sec.160223-1728
System Uptime: 0 days 1:43:09.359
*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+1dd )
BugCheck 19, {20, ffffe00206cdb0c0, ffffe00206cdb0e0, 402000c}
BugCheck Info: BAD_POOL_HEADER (19)
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: ffffe00206cdb0c0, The pool entry we were looking for within the page.
Arg3: ffffe00206cdb0e0, The next pool entry.
Arg4: 000000000402000c, (reserved)
BUGCHECK_STR:  0x19_20
PROCESS_NAME:  mbamservice.ex
FAILURE_BUCKET_ID:  0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0
  BIOS Version                  2501
  BIOS Release Date             04/08/2014
  Manufacturer                  To be filled by O.E.M.
  Baseboard Manufacturer        ASUSTeK COMPUTER INC.
  Product Name                  To be filled by O.E.M.
  Baseboard Product             SABERTOOTH 990FX R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Mar 23 16:14:51.401 2016 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\032316-6796-01.dmp]
Windows 10 Kernel Version 10586 MP (8 procs) Free x64
Built by: 10586.162.amd64fre.th2_release_sec.160223-1728
System Uptime: 0 days 13:02:20.074
*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string'+9bb0 )
BugCheck C2, {7, 126c, 0, ffffe00185f4e7d8}
BugCheck Info: BAD_POOL_CALLER (c2)
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000126c, (reserved)
Arg3: 0000000000000000, Memory contents of the pool block
Arg4: ffffe00185f4e7d8, Address of the block of pool being deallocated
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  mbamservice.ex
FAILURE_BUCKET_ID:  0xc2_7_NETIO!_??_::FNODOBFM::_string_
  BIOS Version                  2501
  BIOS Release Date             04/08/2014
  Manufacturer                  To be filled by O.E.M.
  Baseboard Manufacturer        ASUSTeK COMPUTER INC.
  Product Name                  To be filled by O.E.M.
  Baseboard Product             SABERTOOTH 990FX R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``


3rd Party Drivers:
The following is for information purposes only.
**************************Thu Mar 24 00:02:47.688 2016 (UTC - 4:00)**************************
AsUpIO.sys                  Mon Aug  2 22:47:59 2010 (4C57835F)
ASUSFILTER.sys              Tue Sep 20 11:46:33 2011 (4E78B559)
AsIO.sys                    Wed Aug 22 05:54:47 2012 (5034AC67)
G3GKB.sys                   Tue Oct 23 05:43:11 2012 (508666AF)
speedfan.sys                Sat Dec 29 15:59:35 2012 (50DF59B7)
asmtxhci.sys                Fri Aug 16 15:28:42 2013 (520E7D6A)
asmthub3.sys                Fri Aug 16 15:28:54 2013 (520E7D76)
mwac.sys                    Tue Jun 17 22:07:00 2014 (53A0F444)
tap0901.sys                 Wed Nov  5 08:16:32 2014 (545A2330)
gzflt.sys                   Wed Apr 29 07:32:17 2015 (5540C141)
rt640x64.sys                Tue May  5 12:21:03 2015 (5548EDEF)
trufos.sys                  Mon May 11 04:26:27 2015 (555067B3)
RTKVHD64.sys                Tue Jun  2 06:47:59 2015 (556D89DF)
asstahci64.sys              Tue Jun 16 23:36:23 2015 (5580EB37)
MBAMSwissArmy.sys           Wed Jul 29 00:26:01 2015 (55B855D9)
mbam.sys                    Tue Aug 11 13:35:19 2015 (55CA3257)
nvhda64v.sys                Mon Sep 21 05:44:17 2015 (55FFD171)
nvvad64v.sys                Thu Dec 17 07:47:18 2015 (5672AED6)
avc3.sys                    Tue Jan 19 08:52:34 2016 (569E3FA2)
avckf.sys                   Tue Jan 19 08:55:54 2016 (569E406A)
mbae64.sys                  Wed Jan 27 11:54:02 2016 (56A8F62A)
bdfwfpf.sys                 Tue Feb  9 07:12:25 2016 (56B9D7A9)
ignis.sys                   Fri Feb 12 08:24:54 2016 (56BDDD26)
nvlddmkm.sys                Tue Mar  8 00:42:16 2016 (56DE6638)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Mar 23 16:14:51.401 2016 (UTC - 4:00)**************************
mbamchameleon.sys           Wed Jan 27 18:48:35 2016 (56A95753)

 


http://www.carrona.org/drivers/driver.php?id=AsUpIO.sys
http://www.carrona.org/drivers/driver.php?id=ASUSFILTER.sys
http://www.carrona.org/drivers/driver.php?id=AsIO.sys
G3GKB.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=speedfan.sys
http://www.carrona.org/drivers/driver.php?id=asmtxhci.sys
http://www.carrona.org/drivers/driver.php?id=asmthub3.sys
http://www.carrona.org/drivers/driver.php?id=mwac.sys
http://www.carrona.org/drivers/driver.php?id=tap0901.sys
http://www.carrona.org/drivers/driver.php?id=gzflt.sys
http://www.carrona.org/drivers/driver.php?id=rt640x64.sys
http://www.carrona.org/drivers/driver.php?id=trufos.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=asstahci64.sys
http://www.carrona.org/drivers/driver.php?id=MBAMSwissArmy.sys
http://www.carrona.org/drivers/driver.php?id=mbam.sys
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys
http://www.carrona.org/drivers/driver.php?id=avc3.sys
http://www.carrona.org/drivers/driver.php?id=avckf.sys
http://www.carrona.org/drivers/driver.php?id=mbae64.sys
http://www.carrona.org/drivers/driver.php?id=bdfwfpf.sys
http://www.carrona.org/drivers/driver.php?id=ignis.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=mbamchameleon.sys

 

 




 

Share this post


Link to post
Share on other sites

Hello! I've crashed twice more, now with different BSOD's. The computer has also frozen twice, leading me with no choice but to restart the computer. I fear it is now a corrupted display driver since no dump file was made during the two freezes. I have attached two new logs. I think the Windows install may be corrupted. I'll do another secure delete and fresh install later today. Thank you for the quick response Usasma!

SysnativeFileCollectionApp.zip

perfmon.zip

Share this post


Link to post
Share on other sites
9 minutes ago, saifrehman23 said:

Hello! I've crashed twice more, now with different BSOD's. The computer has also frozen twice, leading me with no choice but to restart the computer. I fear it is now a corrupted display driver since no dump file was made during the two freezes. I have attached two new logs. I think the Windows install may be corrupted. I'll do another secure delete and fresh install later today. Thank you for the quick response Usasma!

SysnativeFileCollectionApp.zip

perfmon.zip

I forgot to mention that the drive verifier was active when these BSODs and freezes happened. 

Share this post


Link to post
Share on other sites

Furlozza - please start your own topic so that your issues can get the individual attention that they deserve.
 

Share this post


Link to post
Share on other sites

Only one new memory dump in the uploaded files.

MalwareBytes is not present in the memory dump, but BitDefender is.
This memory dump does not show that Driver Verifier was running.
What settings did you use for Driver Verifier?

The memory dump blames ntkrnlmp.exe - the kernel (core) of the operating system.

Quote

ntkrnlmp.exe (also seen as ntoskrnl.exe, ntkrnlpa.exe, or ntkrpamp.exe) is the kernel (core) of the Windows operating system.  It is protected by security features and the Windows System File Checker.  As such, if this file was to blame, you'd be experiencing many more problems other than the occasional BSOD.

In most cases this file is blamed because another file (typically a 3rd party driver) has corrupted the memory space that ntoskrnl.exe considers as it's own.  When this happens, ntoskrnl.exe typically finds unknown data (from the 3rd party driver) in it's memory space.  At this point the OS panics and throws a BSOD to prevent damage to the system.

More info here:  https://en.wikipedia.org/wiki/Ntoskrnl.exe

 

 

Most likely this is a hardware problem, although these sort of problems can occasionally be seen due to low-level drivers or compatibility issues.
I would start with these free, hardware diagnostics:  http://www.carrona.org/hwdiag.html
 

Analysis:
The following is for informational purposes only.
**************************Thu Mar 24 03:09:01.022 2016 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\032416-6281-01.dmp]
Windows 10 Kernel Version 10586 MP (8 procs) Free x64
Built by: 10586.162.amd64fre.th2_release_sec.160223-1728
System Uptime: 0 days 0:02:36.696
Probably caused by : ntkrnlmp.exe ( nt!KiComputeCpuSetAffinity+27 )
BugCheck 3B, {c0000005, fffff8034e6a372f, ffffd00168b62a00, 0}
BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b)
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8034e6a372f, Address of the instruction which caused the bugcheck
Arg3: ffffd00168b62a00, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  GFExperience.e
FAILURE_BUCKET_ID:  0x3B_nt!KiComputeCpuSetAffinity
  BIOS Version                  2501
  BIOS Release Date             04/08/2014
  Manufacturer                  To be filled by O.E.M.
  Baseboard Manufacturer        ASUSTeK COMPUTER INC.
  Product Name                  To be filled by O.E.M.
  Baseboard Product             SABERTOOTH 990FX R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``


3rd Party Drivers:
The following is for information purposes only.
**************************Thu Mar 24 03:09:01.022 2016 (UTC - 4:00)**************************
AsUpIO.sys                  Mon Aug  2 22:47:59 2010 (4C57835F)
ASUSFILTER.sys              Tue Sep 20 11:46:33 2011 (4E78B559)
AsIO.sys                    Wed Aug 22 05:54:47 2012 (5034AC67)
G3GKB.sys                   Tue Oct 23 05:43:11 2012 (508666AF)
speedfan.sys                Sat Dec 29 15:59:35 2012 (50DF59B7)
asmtxhci.sys                Fri Aug 16 15:28:42 2013 (520E7D6A)
asmthub3.sys                Fri Aug 16 15:28:54 2013 (520E7D76)
tap0901.sys                 Wed Nov  5 08:16:32 2014 (545A2330)
gzflt.sys                   Wed Apr 29 07:32:17 2015 (5540C141)
rt640x64.sys                Tue May  5 12:21:03 2015 (5548EDEF)
trufos.sys                  Mon May 11 04:26:27 2015 (555067B3)
RTKVHD64.sys                Tue Jun  2 06:47:59 2015 (556D89DF)
asstahci64.sys              Tue Jun 16 23:36:23 2015 (5580EB37)
nvvad64v.sys                Thu Dec 17 07:47:18 2015 (5672AED6)
NvStreamKms.sys             Tue Dec 22 15:54:00 2015 (5679B868)
avc3.sys                    Tue Jan 19 08:52:34 2016 (569E3FA2)
avckf.sys                   Tue Jan 19 08:55:54 2016 (569E406A)
bdfwfpf.sys                 Tue Feb  9 07:12:25 2016 (56B9D7A9)
ignis.sys                   Fri Feb 12 08:24:54 2016 (56BDDD26)


http://www.carrona.org/drivers/driver.php?id=AsUpIO.sys
http://www.carrona.org/drivers/driver.php?id=ASUSFILTER.sys
http://www.carrona.org/drivers/driver.php?id=AsIO.sys
G3GKB.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=speedfan.sys
http://www.carrona.org/drivers/driver.php?id=asmtxhci.sys
http://www.carrona.org/drivers/driver.php?id=asmthub3.sys
http://www.carrona.org/drivers/driver.php?id=tap0901.sys
http://www.carrona.org/drivers/driver.php?id=gzflt.sys
http://www.carrona.org/drivers/driver.php?id=rt640x64.sys
http://www.carrona.org/drivers/driver.php?id=trufos.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=asstahci64.sys
http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys
http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys
http://www.carrona.org/drivers/driver.php?id=avc3.sys
http://www.carrona.org/drivers/driver.php?id=avckf.sys
http://www.carrona.org/drivers/driver.php?id=bdfwfpf.sys
http://www.carrona.org/drivers/driver.php?id=ignis.sys

 

Share this post


Link to post
Share on other sites

Same problem here, on two computers.  First one is a Windows 10 Pro X64 PC.  Had BitDefender Total Security 2015 on it, alongside Malwarebytes Premium and Malwarebytes anti-exploit premium.  Ran fine with these three products together for almost a year.  Then upgraded to BitDefender Total Security 2016, keeping Malwarebytes Premium and anti-exploit premium.  Bluescreen (Win 10 sad faces) at the rate of at least 5 a day, sometimes while surfing the web, others while reading PDF documents.  So I tried an experiment on another computer...a brand new, clean install DELL XPS 15 laptop - Windows 10 Pro x64.  I put BD 2016 TS, Malwarebytes Premium, and Malwarebytes anti-exploit premium on it.  Within 10 minutes of installing BD 2016, BSOD.  All the BSODs seem to be related to memory handling or corruption issues caused by either BD 2016 TS, or the combination of BD, MB, and MBAE - almost all errors are "BAD_POOL_HEADER".  Not certain who the bad actor is among these three products, but sure seems to me that something changed with BD from 2015 to 2016 that introduced these issues...especially since I am able to easily reproduce on brand new, clean systems.

Share this post


Link to post
Share on other sites

But, the most likely cause here is a conflict between BitDefender 2016 and MalwareBytes Premium.
There's several discussions about this on these forums.
The most common suggestions for fixes are:
- uninstalling either program
- stopping MalwareBytes from running when Windows starts (my suggestion)
- reverting to BitDefender 2015

There's a staff member here named Maurice Naggar who is working hard to fix the problem so that both programs can play nicely together.  You may want to have a look at the topics there to see if there are any newer ideas.

I've checked at the BitDefender forums also, but there doesn't seem to be as much activity there as there is at here.



 

Share this post


Link to post
Share on other sites
On 5/17/2016 at 7:45 PM, usasma said:

But, the most likely cause here is a conflict between BitDefender 2016 and MalwareBytes Premium.
There's several discussions about this on these forums.
The most common suggestions for fixes are:
- uninstalling either program
- stopping MalwareBytes from running when Windows starts (my suggestion)
- reverting to BitDefender 2015

There's a staff member here named Maurice Naggar who is working hard to fix the problem so that both programs can play nicely together.  You may want to have a look at the topics there to see if there are any newer ideas.

I've checked at the BitDefender forums also, but there doesn't seem to be as much activity there as there is at here.



 

I think I can reasonably  confirm, for me anyway, that BitDefender 2016 and MalwareBytes Premium do not play nicely with each other causing a crash with BAD_POOL_HEADER. I can also reasonably confirm that stopping MalwareBytes from running when Windows starts, elminates the crashes.

I have turned off MalwareBytes from running when Windows starts then start it afterwards and the computer runs flawlessly for a couple day test. Whenever I change it back to running when Windows starts, it will crash within a few hours. I have switched back and forth 3 times, so for the 3 times that MalwareBytes has started with Windows, it crashes within a few hours and for the other 3 times that it hasn't started with Windows, the PC runs until I switch MalwareBytes back over to running when Windows has started.

Hopefully Malwarebytes can fix this since I'm paying for real time protection and now that my test is over, I won't be consciously  thinking about manually starting Malwarebytes.

Share this post


Link to post
Share on other sites

This is very interesting.  Thanks for trying these things out.
I'm actually pretty amazed that the system doesn't crash if you start it manually, no matter how long it runs.

FYI - I don't think that this is actually a MBAM problem - as the problem seems associated with the move from BitDefender 2015 to BitDefender 2016.
It seems to me that that was the "tipping point" that started the BSOD's

You may want to create a scheduled task to launch MBAM periodically - so it'll remind you to do a scan.

Or, as it doesn't crash when you run it after Windows starts - create a task to launch it after reboot and set it on auto then (I'm not real familiar with creating tasks, so I'll leave the details up to you :0)
Good luck!
 

Share this post


Link to post
Share on other sites

Well, wouldn't you know it. I thought I did enough testing to post some results and tonight I had another crash. This time, I set up a task as you suggested and had it fire off 30 minutes after I logged in. A couple hours later, "see ya!!".  Now I need to run without Malwarebytes running at all for maybe a week and see what happens to eliminate any other possible issue besides Malwarebytes. This last crash happened when I was in the browser and had clicked on a youtube link. If the computer runs ok, I'll start Malwarebytes with Malware protection and website protection turned off and run that for a week then go from there.

Share this post


Link to post
Share on other sites

Sounds like a good plan to me.  We'll be waiting to see what happens.   Thanks again!

Share this post


Link to post
Share on other sites
On 5/25/2016 at 2:38 AM, usasma said:

Sounds like a good plan to me.  We'll be waiting to see what happens.   Thanks again!

Well, it's been just about a week and I have had no crashes. The machine has been up 100% of the time with everything running but Malwarebytes. I do a bunch of things on my machine. This past week, I have done some gaming, played around with Bluestacks and also did some testing using a VMware virtual machine with several differenct x86-Android images, not to mention the normal browsing, doing some Office stuff, etc.

I think it is safe to say that nothing hardware/other software related was causing the crashes.

Today, I did a reboot and started Malwarebytes on login. I disabled Malicious website protection for now and see how it goes.

Share this post


Link to post
Share on other sites

FYI - this issue has been fixed by an update to BitDefender 2016.
Here's a link to the explanation: 

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.