BSOD probably caused by Malwarebytes

[dagar74]

While going to a bank website yesterday with Chrome, then Kaspersky Safe Browser opens as normal. Logged in to my bank and after about 5 minutes of looking up account information, I got a BSOD. WhoCrashed analysis of the memory.dmp file points to farflt.sys, and is included below. Malwarebytes is version 3.3.1.2183, Component 1.0.236 and I had run the definitions update just prior to going to the bank website. I don't have time to run the usual feedback reports today, but will try to do that when I can. This has only happened to me once, but I have not repeated the conditions exactly. I did go to the same bank account, starting with Edge Browser, which started Kaspersky Safe Browser and spent about 20 minutes on that site with no BSOD. When I can, I will make a few more tries using the original browser combination. A person whose computer I previously repaired reported a BSOD under the same browsing/bank condition about 5 days ago, but I have not investigated his problem yet. 

On Fri 11/10/17 9:40:08 AM your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: farflt.sys (farflt+0xA93D)
Bugcheck code: 0x101 (0x18, 0x0, 0xFFFFF802AF6FB180, 0x0)
Error: CLOCK_WATCHDOG_TIMEOUT
file path: C:\WINDOWS\system32\drivers\farflt.sys
product: Malwarebytes Anti-Ransomware Protection
company: Malwarebytes
description: Malwarebytes Anti-Ransomware Protection
Bug check description: This indicates that an expected clock interrupt on a secondary processor, in a multi-processor system, was not received within the allocated interval.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: farflt.sys (Malwarebytes Anti-Ransomware Protection, Malwarebytes).
Google query: Malwarebytes CLOCK_WATCHDOG_TIMEOUT
 

[Maurice Naggar]

Hi,

We do need to get reports from your PC in order to see what had happened.

1. Please get & SAVE Farbar Recovery Scan Tool (FRST)   and later run it to get logs
   1. Download FRST and save it to your desktop
      Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
   2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
   3. Press the "Scan" button
   4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
      • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
2. Create and obtain an mb-check log
   1. Download MB-Check and save to your desktop
   2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
   3. This will produce one log file on your desktop: mb-check-results.zip
      • This file will include the FRST logs generated from the previous set of instructions
      • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

[dcollins]

On top of what @Maurice Naggar has requested, can you please zip up  C:\WINDOWS\memory.dmp and upload it? If it's too large, you can use wetransfer.com to send the file to dcollins@malwarebytes.com. Thanks!

[dagar74]

The mb-check results are attached. Unfortunately, the full C:\WINDOWS\Memory.dmp file is no longer present on the computer. I am also attaching a zip of the mini dump file, however, based on the WhoCrashed analysis of the two dump files, only the full dump file analysis, which was in the original post, showed the issue with farflt.sys. I will try to do some more testing in the next day or so and if I have the problem again, I will save a copy of the full dump file

mb-check-results.zip

111017-4750-01.7z