BSOD Kernel mode trap with 3.1.2.1733 Web Protection Active

[andreacc81]

Like the title with version 3.1.2.1733 web protection active machine crash with BSOD 07f KERNEL MODE TRAP.

If i disable web protection machine works without issues.

Reproducted on 3 machines.

Windows 7 Pro x64

 

Urgent,

i have A LOT of customers using MBAM, i can only imagine the amount of problems i'm going to run into if this will start happening on all machines....

Addition.txt

FRST.txt

mb-check-results.zip

logs.zip

perfmon.zip

SysnativeFileCollectionApp.zip

[dcollins]

Thanks for this! Out of curiosity, do you have any USB wireless adapters plugged in to these devices? And also, do you know what you were doing when the BSOD happened?

Edited May 12, 2017 by dcollins

[andreacc81]

No USB Wireless dongles. But there is integrated wireless controller (disabled). These are Lenovo All In One machines.

The BSOD happens every single time a browser is opened (no matter which browser, tried ie, chrome, firefox... always BSOD)

Edited May 12, 2017 by andreacc81

[dcollins]

Thanks! We are looking into the memory dumps and the logs to try and determine what's going on

[dcollins]

Looks like we'll need a full memory dump instead of a minidump. Can you try the following please:

1. Press Windows Key + R to open the run dialog
2. In the window that comes up, type sysdm.cpl and click Ok
3. In the Window that comes up, click the Advanced tab along the top
4. Under the Startup and Recovery section, click settings
5. In the System Failure section, under the Write Debugging Information section, please change the dropdown to Complete Memory Dump
6. Click Ok to save the changes
7. Now turn on Web Protection and open a browser so your computer crashes
8. Once your computer reboots, please navigate to C:\Windows and there should be a file named MEMORY.dmp
9. Right click MEMORY.dmp and choose Send to -> Compressed (Zipped) folder to create a zip file on your desktop
10. You can try to attach the file as a reply here, but it may too big. If so, please use wetransfer.com to send the file to dcollins@malwarebytes.com

Thanks!

[andreacc81]

I have 3 option (i'm translating from italian)

- Kernel memory dump (already selected)

- Memory dump reduced (256 KB)

- None

Nothing about a complete memory dump. The most complete i think is the first one that was already selected and the dumps you have are generated with this setting.

In the next hours i'm generating and sending you another dump, just to be sure.

Meanwhile have you other ideas to generate the full dump you need?

Thanks

Edited May 16, 2017 by andreacc81

[andreacc81]

I'm uploading to wetransfer a memory.dmp that weighs about 670 MB (202 MB zipped).

You should receive it on your email in a few minutes.

Let me know if you need something else.

 

Thanks

Edited May 16, 2017 by andreacc81

[dcollins]

Thanks, I received the email and we are researching it now

[dcollins]

Can you try uninstall Blue Coat K-9 Web Protection? According to the crash, the blue screen is actually caused by their driver.

[andreacc81]

Yes, uninstalling k9 everything works.

I saw you advice other users to disable the k9 service but, altought this stops the BSOD, it will kill your ability to surf the web since you will start facing a page stating that k9 is not working proprerly. The only real solution is to uninstall it completly

[dcollins]

Thanks for the update, I'll be sure to clarify my instructions