BitDefender and bad pool aborts

[enyceedanny]

5 minutes ago, Maurice Naggar said:

You are past needing to have Driver Verifier.  Now, you need to undo it.    Start Driver Verifier.

Choose Delete existing settings then click Finish.   and then Reboot your computer.   Having the driver verifier on slows the system down to a real slow crawl.

oh.. maybe that's why everything feels a bit sluggish, especially when playing media files (netflix) lol

[enyceedanny]

Yesterday I ran into 2 crashes back to back. 2 pointing to mwac.sys, and one to ntkrnlmp.exe with (DRIVER_POWER_STATE_FAILURE). 
What I did today was uninstall some codecs I had installed, along with contacting Corsair and requesting an RMA for my RAM. Since it's so sporadic and it points to other drivers/files on crashes, I'm afraid that there's potentially a hardware issue. They approved the RMA and I should be receiving the replacement kits next week or so. In the meantime, I'll see if the removal of the codecs help. 

 

Will update.

[Maurice Naggar]

Thanks for the update.   Just as an aside, I would like to point out the following.  A few crash-help tool may list mwac in the stack in use.  That should not be treated as fully defininitive.   The only real way is to have a copy of the full memory.dmp file  and use something like Windbg and then have someone who is expert take a deeper look.

If you wish and are inclined, zip up the memory.dmp file which should be in C:\windows

Then see about uploading the zip file to some location  ( perhaps your MS OneDrive )   and then relay the link to me.  I can then provide that to our researchers in QA.

Lastly, it is interesting that you mention RAM here.   unsteady or unreliable or problematic RAM can very well lead to Windows crashes.

[enyceedanny]

Well, the ram I'm still testing and it's been fine so far in the tests. I've tested all 4 dimms, then 1 by 1. I still have 1 dimm to go. Using memtest on these higher density dimms take quite some time (4 hours each) for 3 passes.

I've cleared all the memory dumps, so once I encounter another crash, I will provide the dump file.

Thanks. I'll keep you updated.

[Maurice Naggar]

This thread topic is  for  enyceedanny only. If you are not  enyceedanny   and have a similar problem, do NOT post here;  start your own topic

Note to DianaD I have split off your post.  Please double check your PM.

 

@enyceedanny

Please refresh my recollection.  Was this system custom built by you or not ?

 

[enyceedanny]

Yes, I built the system.

[Maurice Naggar]

Good morning.

Two things.  First, advise us if your pc relies only on WIFI connection.  Or whether, it is on a direct cable link into your internet.   ( e.g., wifi or with a cabled connection).

Also, please recheck one more time, your network card model and check on on any possible latest released driver from that manufacturer.

( 2)

A new Checkresults report, please.

This tool will collect some information on the installation of Malwarebytes and create a report I need to review:

NOTE: You may need to temporarily turn off your antivirus if it interferes with this tool.

Download mbam-check.exe and save it to your desktop    "from this link":http://downloads.malwarebytes.org/file/mbam_check
On Vista/Windows 7, 8, 10, Right-click on *mbam-check-2.3.2.0.exe* & select Run as Administrator & allow to Run when prompted by User Account Control.
On XP,Double-click on *mbam-check-2.3.0.0.exe* to run it.

Do have patience while the tool runs.  It may take a while, and will flash a command prompt window.  And then it will start your text editor ( default is typically NOTEPAD).

It should then open a log file CheckResults.txt.  Just do a File >> Exit in NOTEPAD.
You should attach the *CheckResults.txt* file located on _*your desktop*_ so that I can review.

 

( 3)

I know you'd said you have deleted all memory dump files.   But, if there is a new crash.......

IF you have the time and the means, you can arrange to send us a copy of the memory.dmp file off your machine.
Just locate the file named *memory.dmp*  in the C:\Windows folder
Then zip it up in a zip folder.
Then let me know when it is ready.   I can guide you to where you can upload it to us;  so we could check into it.

you might consider using a free service from Wetransfer
https://www.wetransfer.com/

Upload the  zip file  and then later on send me the link to the uploaded file.

[enyceedanny]

1) I'm using a direct wired connection.
2) attaching the new checkresult.
3) Haven't had a BSOD yet. It's quite sporadic. I'll upload it once I encounter it.

CheckResults.txt

[enyceedanny]

Okay, just had a crash. You can download the zipped memory dump file by clicking over here

[Maurice Naggar]

Thanks for the dump file.   At this point, let me suggest 3 choices to consider.

A) turn off all of the Web protection  (only )  in BitDefender 2016  and then we monitor how it goes over the next day or two.

B) I can guide you to removing the 2016 version of BitDefender and reverting back to the 2015 version of their software.  That one we know works together.  Their 2015 version does work with ours.

C) Turn off the Malicious website protection in M B A M   and keep the 2016 BitDefender.

 

[enyceedanny]

B) I'm not sure if I'd like this route. Purchased the 2016 version, and don't really feel great using an "outdated" version to be honest.
 

Between A and B, which would you rather have me try first?

[Maurice Naggar]

Try A first.

[enyceedanny]

Okay. Felt that you'd say that, so I already did it before I posted the reply.

[enyceedanny]

Is it any way possible that it can indeed be from mwac.sys? Was just browsing the internet in regards to this issue, and based on some forum threads, uninstalling MBAM resolved the BSOD issues. (e.g. here)

Because this would totally be a bummer, considering how useful this program is...

[Maurice Naggar]

Everybody and his brother keeps pointing to mwac just because the mini ( quick) dump analyzer says so.   I only go with the full memory dumps.  Something changed when BitDefender came out with their 2016 version.  We had gone thru something like this a year ago when they came out with the 2015 version.

The other thing too to beware of, is simply just the presence of mwac in the call stack leads lots of folks to blame our service.  They keep forgetting that mwac will always be in the stack when our program is active & running with our real-time.    Plus the case you point to is another one with Asus systemboard ( which can have some unique issues just because of their possible add-on drivers),

It is real hard to reproduce the crashes without having an identical hardware and software setup.   a total clone.

Testing both BitDefender 2016 and MBAM Premium on my system and doing simultaneous scans with the 2 products does not get me a bsod crash.

It is late at night for me.  I have to call it a nite.

[enyceedanny]

Totally understood. Definitely seems that majority of the people that have this issue has both MBAM and BD installed. I'm not blaming MBAM yet. Just trying to find out the root cause of this. 

Either way, I have already disabled the web protection for BD. So let's see how this goes.

Thanks and good night.

[enyceedanny]

Was working on the computer all night, and haven't had a BSOD yet. Still early to tell, so we'll see.

Also, I just received the memory replacements via fedex. Installed it. I don't think it was the memory's fault, but they already sent it - so guess it doesn't hurt anything.

I'll keep you updated.

[Maurice Naggar]

Hi,

I am currently doing some of my own testing on one of my machines with a mix of BitDefender Total Security 2016 and Premium Malwarebytes Anti-Malware.
I think it may be worthwhile to give these following adjustments a try.  A quick and early special test looks promising.

Start the BitDefender Total Security program.  Look on the main screen. Down on the bottom, click the Modules line.

Next, look on the Protections tab.  Then click on the Antivirus line (setting).
At the top section, listed as On-Access scanning, yours should be set to NORMAL.   Please verify that.

Then, look down the screen to the block marked Active Threat Control.
click and set it to PERMISSIVE.

Then you can close the screen.

Then you may start Malwarebytes Anti-Malware.  and turn back on the Malicious Website protection.
Click Settings. Adavanced settings.   check the box "Enable Malicious website protection".

Click the Detection and protection button on the left.  Be sure the line for Malicious website protection is set to Enabled.

Then you can close the window.

Give this a try and let me know how it goes over the next 24 hours.
Thank you for your consideration and patience.

 

 

[enyceedanny]

On bitdefender, active threat control was the only thing I had to change. MBAM was already on those settings.

So far, it seems that maybe disabling BD's web protection may have done the trick? I haven't had a BSOD yet. (crossing my fingers)
But the issue will be that I get a glaring "YOU ARE AT RISK" message within BD since one of their protection modules are disabled...

[AdvancedSetup]

@enyceedanny

 

@Maurice Naggar is not suggesting you turn it off fully as before. He's asking to try it in Permissive Mode (still on but not as aggressive) which may also help to prevent the error.

 

[enyceedanny]

I'm talking about the web protection module of BD. Which I believe is different. So should I enable web protection? 

[AdvancedSetup]

Probably best to wait for Maurice as I don't have BD installed on my system to check. Pretty sure that is the same thing he's talking about though. If he does not come back online tonight he should reply again tomorrow morning.

Thanks

 

[enyceedanny]

Yep, it's set to exactly how he suggested throughout the posts so far.

[Maurice Naggar]

Hi,
My BitDefender is showing "you are protected".   in green.
To briefly recap the adjustments I made:
( and keep in mind this is on a decision to keep the malicious website protection of M B A M).
These adjustments in BitDefender Total Security:
In the Web protection module, just turn off Search advisor.

In The Antivirus module, keep on-access scannning at Normal.
On the Active threat control, set that to Permissive.

That is it in a nutshell.

This may be just a bit different from what was previously suggested.  This works fine.  Do let me know how it does on your system.
Thanks for hanging in with me.  And for your patience.

[enyceedanny]

The search advisor has been off the whole time. I always turn that off, since it's annoying.
The only thing that was on under web protection was "protection against fraud" and "protection against phishing". After I turned those two off, I haven't had a BSOD since...

Planning on turning those back on to see if I BSOD, but at the moment I'm working on some deadlines, so I can't take the chance.