BSOD woes

[TimBerlin]

Until 10 days ago, I never had a BSOD on this PC since building it in October 2015. Like others, recently I have been getting frequent BSODs of the BAD_POOL_HEADER flavour. WhoCrashed pointed at mwac.sys. I followed the advice given by Maurice Naggar in this post. In fact I followed it to the letter!

Now I have other BSODs: PAGE_FAULT_IN_NONPAGED_AREA then DRIVER_IRQL_NOT_LESS_OR_EQUAL. Again, WhoCrashed points to mwac.sys

Following advice from Usamsa in recent posts, I checked bdfwfpf.sys both before and after removing/re-installing BitDefender & Mbam. The file date created shows as today, so it has been refreshed, but the file version (v7.00.16 of 9-Feb-2016) is the same as before.

Advice please!

Tim D

 

[usasma]

Try this:

- Uninstall BitDefender
- check to be sure that the driver is gone (if it's not, manually delete it)
- download a fresh copy of the latest BitDefender
- install it
- check the driver version

I'm creating a W10 VM right now - I'm going to try this on that system to see what happens.
 

Edited April 12, 2016 by usasma

[TimBerlin]

 

43 minutes ago, usasma said:

Try this:

- Uninstall BitDefender
- check to be sure that the driver is gone (if it's not, manually delete it)
- download a fresh copy of the latest BitDefender
- install it
- check the driver version
 

This is what I did earlier today.

• Yes, the Bitdefender Uninstall tool removed the driver.
• Yes, I downloaded and installed a fresh copy of the latest Bitdefender
• Yes, I checked the driver version - still v7.00.16 (same as before)

BTW this PC is running Windows 7; spec below.

Further advice eagerly awaited......

TimD

Computer name: IRIS
Windows version: Windows 7 Service Pack 1, 6.1, build: 7601
Hardware: H97-D3H, Gigabyte Technology Co., Ltd., H97-D3H-CF
CPU: GenuineIntel Intel(R) Core(TM) i5-4690 CPU @ 3.50GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 16GB
 

[usasma]

I'm stuck in the installation of W10 right now.
I do have a W7 VM and will attempt it in that later on today.
I also have to reboot my main system to install the latest Insider build (slow ring)

I suspect that I'll see the same thing that you have - so I'd wait for Maurice Naggar to post back and see what he has to say.

I'm hoping that I can reproduce the crash, that way I can experiment with it and see what can be done.
Other thoughts that I've had would be to create exceptions in the BitDefender firewall for all the MalwareBytes stuff, to include the mwac.sys driver.
Or, you could disable the BitDefender Firewall - but I'm not familiar with that.

[TimBerlin]

Thanks Usamsa, I'll wait and see what Maurice Naggar says, or what your experiments turn up.

[Maurice Naggar]

Hello TimBerlin.

I would highly recommend some trust setting adjustments for BitDefender and our program as well.
Generally speaking one needs to set BitDefender to trust the program components of our Malwarebytes 

In order for Malwarebytes Anti-Malware and Bitdefender  to work together instead of conflicting, you must configure both applications.  
 
How to configure *Bitdefender*  to exclude Malwarebytes files -
Step 1. Open *Bitdefender*
Step 2. Click on "Modules"  near the bottom of the window so that you see a white screen
Step 3. You should see a Protection tab with  white background

Step 4. click on the "Trusted applications" line in black, on the left side
Step 5. You should see a new window BitDefender Trusted Applications

Step 6. Click "Add" button (blue color)
Use the navigation tree to get to the C drive and its sub-folders

Step 7. Click on the + sign on the line Windows C drive

Step 8. Navigate to 'C:\Program Files (x86)\Malwarebytes Anti-Malware' , select desired folder and click "OK"

You will need to select each EXE file - one by one

C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamdor.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbampt.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

Step 9. Make sure that the option "Both" is checked and select "Add"

Do also the same for C:\Program Files (x86)\Malwarebytes Anti-Exploit

Step 10. Click "OK"
 
 
How to add your Bitdefender  folder to Malwarebytes "Malware Exclusions" list -
Step 1. Open the Malwarebytes application
Step 2. Click on "Settings"
Step 3. Click "Malware Exclusions" in the left column
Step 4. Click on "Add Folder"
Step 5. Navigate to 'C:\Program Files\Bitdefender\Bitdefender 2016'
Step 6. Click once on "C:\Program Files\Bitdefender\Bitdefender 2016" folder to highlight it
Step 7. Click on "Select Folder"

also do the same for the folder  C:\Program Files\Bitdefender Agent

Step 8. Close Malwarebytes
Step 9. Reboot your computer <--Very Important!

Let us know how it goes after this.  If there is a further hiccup ( and I hope it does not), then I will ask for a set of FRST reports.

Please know the so-called flagging of mwac is just a coincidence since the service will be present in the stack.  But we have not found it to be the trigger for the B S O D.

It may well be that there is another startup app that just happens to have an outdated driver.

This is why we always suggest that you insure that all of your installed programs have the most recent updates.

 

 

[Maurice Naggar]

Keep all up to date.    Check on other update issues as well, by getting, installing and using Secunia Personal Software Inspector (PSI) on a regular basis.
See How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector
http://www.bleepingcomputer.com/tutorials/tutorial174.html

[TimBerlin]

2 hours ago, Maurice Naggar said:

Hello TimBerlin.

I would highly recommend some trust setting adjustments for BitDefender and our program as well.
Generally speaking one needs to set BitDefender to trust the program components of our Malwarebytes In order for Malwarebytes Anti-Malware and Bitdefender  to work together instead of conflicting, you must configure both applications.  
 ......................................

Let us know how it goes after this.  If there is a further hiccup ( and I hope it does not), then I will ask for a set of FRST reports.

Please know the so-called flagging of mwac is just a coincidence since the service will be present in the stack.  But we have not found it to be the trigger for the B S O D.

It may well be that there is another startup app that just happens to have an outdated driver.

This is why we always suggest that you insure that all of your installed programs have the most recent updates.

I have set the exclusions in both Bitdefender and Malwarebytes, as you instructed. I have also reduced the start-up apps to the bare minimum. Still the BSODs continue. The only thing that stops the BSODs is to disable Malwarebytes from starting. It does appear that mwac.sys or another Malwarebytes process is implicated in the BSODs.

Please tell me what FRST reports you would find useful.

Thanks for your help with this......

Tim

[Maurice Naggar]

Lets get diagnostic reports.  

Please read the following and in your next reply ATTACH the 3 requested logs - Diagnostic Logs
(the three files should be CheckResults.txt, FRST.txt and Addition.txt)

Thank You,

[Maurice Naggar]

I would be curious to know just when the last install of BitDefender was

+ whether it was a upgrade over the top of a older version

+ whether Malwarebytes was the last one to be installed

In addition to reviewing the 3 reports from the above step.

[TimBerlin]

7 minutes ago, Maurice Naggar said:

I would be curious to know just when the last install of BitDefender was

+ whether it was a upgrade over the top of a older version

+ whether Malwarebytes was the last one to be installed

In addition to reviewing the 3 reports from the above step.

I will try to dig out the neccesary info. I will also send the logs as requested. However, both will be tomorrow because it is evening time for me and I have a promise to keep!

[Maurice Naggar]

Take your time.  This all requires lots of patience and persistence.    

[TimBerlin]

A late follow-up on this: I have been very short of time and my Bitdefender subscription was due for renewal anyway, so I tested Kaspersky. It had no problems coexisting with Malwarebytes, and I now subscribe to Kaspersky. This has resolved the issue that I raised with you - in fact, since the change of AV software, PC has once again been 100% reliable (touching wood very firmly).

Thank you for your help along the way.

TimD

[usasma]

I'm glad to hear that things are working well for you!

Thanks for letting us know.