Another farflt.sys BSoD

[dubiousvirtue]

Just had to uninstall Malwarebytes. I kept getting BSoD on farflt.sys.

Although my machine was supposedly writing a dmp file there is none to be found.

No idea why it's just started (literally today 25/8) as there haven't been any updates either hardware or software to my machine.

mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
  
   
• Click the Gather Logs button
  
  
   
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
  
     
  
  
  Click "Reveal Hidden Contents" below for details on how to attach a file:
   
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  
   

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

I don't know if it's related or not, but your User Account Control settings seem to be off default:

Consent Prompt Behavior Admin:    Off

By default, that setting should be enabled.  I also noticed a lot of compatibility entries in your logs for other software, and I don't know if that's related either but it could be that those are only necessary because of the altered UAC setting.  More info on this setting can be found here with the default value being 5 which according to the table on that page means:

This option is the default. It is used to prompt the administrator in Admin Approval Mode to select either "Permit" or "Deny" for an operation that requires elevation of privilege for any non-Windows binaries. If the Consent Admin selects Permit, the operation will continue with the highest available privilege. This operation will happen on the secure desktop.

And also that:

Windows binaries will be allowed to perform an operation that requires elevation without consent or credentials.

Which basically means that Windows will trust its own components without prompting for approval via UAC but third party programs will require your consent to receive elevated privileges should they require them.  Given the fact that the vast majority of software has now been designed to be fully compliant to and compatible with UAC, I'd suggest configuring it to the default setting to reduce the probability of issues with third party software (including potentially Malwarebytes).  Much of the Malwarebytes installation info that the log was supposed to show is also missing, and this could be why if the tool wasn't able to query everything that it needed to due to incorrect permissions/privileges.

I also see that you are running ESET IS, and while it should be compatible with Malwarebytes, it is possible that exclusions are needed to get the two to work properly together.  The items to exclude from ESET's protection components can be found here.

Finally, I don't know if you've tried this already, but it may help to perform a clean installation of Malwarebytes as install corruption may be the reason for the issue.  To do so please follow the instructions below:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced Options on the main page (not Get Started)
3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here
   

[dubiousvirtue]

Thanks.

I've not changed my settings for yonks so it's odd the error has only just started.

I'll work though your suggestions this weekend and let you know how I go.

[exile360]

It may be related to the recently released Malwarebytes patch that came out not long ago.  The timing fits at least and hopefully the clean install fixes it if it was just an issue of a corrupt install/update.

[vbarytskyy]

@dubiousvirtue

Could you get us a memory dump so can look into this issue further? 

• Check your C:\Windows directory for a "MEMORY.DMP" file
  • You'll have to copy the file to the Desktop. Once on the Desktop, right-click > send to > Compressed (this will zip it and make the file smaller so its quicker to upload)
• IF MEMORY.DMP IS NOT FOUND--Check your C:\Windows\Minidump directory for *.DMP files (they'll be random names). Filter by date and send us the latest 2 or 3, if still not found--
  • You'll have to copy the file to the Desktop. Once on the Desktop, right-click > send to > Compressed (this will zip it and make the file smaller so its quicker to upload)
• IF MINIDUMP IS NOT FOUND--You may need to turn "complete memory dumps"
  • Click Start, right-click Computer and select Properties.
  • Click Advanced system settings (on the left).
  • Click Advanced tab.
  • Under the Startup and Recovery section, click Settings.
  • Match your window to the sample below:
    • 
  • Reboot the machine when asked

If you had to turn on dumps, we'll need to wait for a crash to occur and then a C:\Windows\MEMORY.DMP should be written. 

• You'll have to copy the file to the Desktop. Once on the Desktop, right-click > send to > Compressed (this will zip it and make the file smaller so its quicker to upload)

Please use a service like www.wetransfer.com to upload your dump file(s) as they'll be too large to upload to the forum. Click the "3 dots" and you'll be given the option to get a link instead of entering an email address.

 

Thank you,

[dubiousvirtue]

Unfortunately there weren't any dump files created. Which is odd because I saw it supposedly being written. Event logging is on and Kernel Memory Dump is selected in debugging info.
I thought I might have time to reinstall Malwarebytes last weekend, I'll try to get to it this weekend and see if I can get it to BSoD.