BAD_POOL_CALLER - MWAC.SYS CRASH Test Results

[SteveM1]

Hi,

I had a blue screen crash due to Malwarebytes per WhoCrashed.

Is there a fix?

Thanks for the help,

SteveM

On Sun 6/10/2018 6:24:57 AM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: mwac.sys (mwac+0x7FC5)
Bugcheck code: 0xC2 (0x4, 0x0, 0x8000, 0xFFFF800924B209D8)
Error: BAD_POOL_CALLER
file path: C:\WINDOWS\system32\drivers\mwac.sys
product: Malwarebytes Web Protection
company: Malwarebytes
description: Malwarebytes Web Protection
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mwac.sys (Malwarebytes Web Protection, Malwarebytes).
Google query: mwac.sys Malwarebytes BAD_POOL_CALLER
 

[usasma]

Please run this report collecting tool so that we can provide a complete analysis: (from the pinned topic at the top of the forum):  https://forums.malwarebytes.org/topic/170037-blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

FYI - I don't often use the Perfmon report, so if it doesn't work please just let me know.
NOTE:  On problem systems it can take up to 20 minutes for the log files to complete.  Please be patient and let it run.

If you still have problems with it running, there's an alternate tool here (direct download link):  https://github.com/blueelvis/BSOD-Inspector/releases/download/1.0.5/BSODInspector-1.0.5.exe

NOTE:
Please zip up the (.ZIP) files - do not use .RAR, .7z or other compression utilities.
.ZIP is the type file that can be uploaded to the forums.

[SteveM1]

I have ran the tests as asked for my BSOD crash.

The Perfmon report timed out, so I used the other report generator.

See Attached.

SteveM1

SysnativeFileCollectionApp.zip

DESKTOP_T3GFTCQ_6_10_2018_9_48_03_AM.zip

[usasma]

There's no memory dumps in the uploaded reports.
Please run Driver Verifier according to these instructions:  http://www.carrona.org/verifier.html
Please let the system crash at least 3 times.  That will increase the chances of collecting a readable memory dump.
 

Your UEFI/BIOS (version 1.0.15) dates from Feb of 2018.  Please check at the manufacturer's website to see if there are any UEFI/BIOS updates available for your system.  This is just in case there has been a more recent update.
FYI - W8 and W10 communicate more with the UEFI/BIOS than previous versions of Windows, so it's important to ensure that the UEFI/BIOS is kept up to date (and that outdated UEFI/BIOS' may be the cause of some compatibility issues).
 

It appears that you're running a Windows Insider build (17134)
As this is a fast ring build, it's usually more unstable than previous releases.
And, that means that some of the other components on your system may not be compatible with it (or with MalwareBytes)

The first step here is to check your system for older drivers.
Start by looking for older programs and older files in the different Program Files directories and update them.
You can also check in C:\Windows\System32\drivers - but this is a daunting task as there are many Windows drivers that are older also.

I'd start by uninstalling all Apple stuff from the system to test and see if that stops the BSOD's.   It's the most common error in the WER section of MSINFO32
The most faulty process is the AppleIEDAV.exe file - and it's associated with iCloud software.

Other than that, you may want to try uninstalling your VPN also.
This is simply because I'm not familiar with your VPN - and a lot of these MalwareBytes BSOD's are due to problems with networking software.

Once you've tested with the software removed (and find not problems), you can feel free to install a fresh copy of the latest software to see if that helps.
Remember tho' - that the Insider builds aren't stable releases - so problems can continue.
We'll need the memory dumps to get a better idea of what's going on inside the system.

 

Good luck!