Ver 3.6.1 Causes BSOD 7a when scanning Memory on Win 7

[CCTech]

Need help to resolve BSOD problem. Scans fine until it gets to Memory then freezes and the BSOD appears.  When the computer reboots this message appears that Windows recovered from an unexpected shutdown with the following parameters.

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.1.7601.2.1.0.256.48
  Locale ID:    1033

Additional information about the problem:
  BCCode:    7a
  BCP1:    FFFFF6FC40008420
  BCP2:    FFFFFFFFC0000185
  BCP3:    00000000115D1860
  BCP4:    FFFFF8800108493C
  OS Version:    6_1_7601
  Service Pack:    1_0
  Product:    256_1

Files that help describe the problem:
  C:\Windows\Minidump\092418-26223-01.dmp
  C:\Users\XXXXX XXXXX\AppData\Local\Temp\WER-71058-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt
 

mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
  
   
• Click the Gather Logs button
  
  
   
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
  
     
  
  
  Click "Reveal Hidden Contents" below for details on how to attach a file:
   
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  
   

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[AdvancedSetup]

Hello @CCTech and

The logs are indicating that some of our files cannot be verified. Not sure if that's due to a possible disk error, or maybe Norton is blocking our files.

Temporarily disable Norton and reinstall Malwarebytes over the top of your current installation to ensure the files are correct.

https://downloads.malwarebytes.com/file/mb3/

Next,

Please try adding exclusions to your Norton Antivirus
https://support.malwarebytes.com/docs/DOC-1123

Reboot and see if that helps. If not, then try running a full disk check on your system drive. From an elevated Admin command prompt.

 

CHKDSK   C:  /R

If still no change please try disabling the Self Protection module and reboot. Then let me know if that corrects the issue.

Thanks

Ron

 

Edited September 25, 2018 by AdvancedSetup
Updated information

[dcollins]

We will also need a memory dump if the above doesn't help. If possible, can you see if there's a full memory dump available at C:\Windows\memory.dmp? If so, please zip up this file and use wetransfer.com to generate a download link. If not, then please zip up the minidump at  C:\Windows\Minidump\092418-26223-01.dmp and attach it in your reply

[CCTech]

I followed the directions to disable Norton and reinstalled malwarebytes but when I ran it I still got a blue screen.

https://we.tl/t-ZQd9vLFb1H  Here is the link to download the latest mini dump & memory dump files.

[CCTech]

I haven't heard from anyone since I posted the link to the dump files on 9/27/18. Here is the link again. https://we.tl/t-ZQd9vLFb1H

 

[exile360]

@AdvancedSetup, @dcollins would you guys take a look and assist please?

Thanks

I've alerted them to return to your topic herre so hopefully you'll be hearing from one or both of them soon.

Thank you for your patience and I hope this issue is resolved quickly for you.

[AdvancedSetup]

I apologize for that @CCTech

Didn't realize that Devin was going to be out of office. I've asked another support engineer to take a look at your files. He's off work right now but hopefully can drop in tomorrow and take a look.

@nikhils can you please take a look at the dump file here

Cheers

 

[nikhils]

Hello @CCTech

The Wetransfer link says that the dump file has been  Deleted.

Can you please post the dump file again and we can take a look at it.

Thank you.

[CCTech]

Here is the new link. https://we.tl/t-nvDGlUhVqG

I didn't mention it before but one of the first things I did was to run chkdsk and windows made minor changes, there was no corruption.

Malwarebytes had been working fine a few months ago and had not been updated until September. (this is a client's computer btw). Also Norton security had been renewed but for some reason it was not automatically updated on the PC until I logged into the Norton account and verified the renewal, so the PC was virtually unprotected for ~5 months. Norton Security wouldn't update so I had to remove and reinstall to make it work.  I don't recall if I reinstalled Norton first or the update for Malwarebytes.  Thanks for your assistance.

[nikhils]

Hi @CCTech

Can you please try this:

1. Turn off the rootkit scan option in Malwarebytes and run a scan.

Do you still get a BSOD when you run that ?

Also do you have any disk encryption software on this system ?

[CCTech]

Thank you nikhils,

The scan completed successfully with rootkit disabled and detected nothing.

No encryption.

[CCTech]

nikhils, No BSOD when scanning with "Scan for Rootkit" disabled.  What next?

[nikhils]

Hello @CCTech

Can you try turning on Rootkit scanning but turning off Self protection to see if you get the BSOD again.

Thank you

[CCTech]

Self Protection Module is grayed out

[CCTech]

It's definitely an interaction between Norton Security and MalwareBytes.  I re-enabled "Scan for Rootkits" and added the exclusions for Malwarebytes to Norton from here: https://support.malwarebytes.com/docs/DOC-1123. NOTE: not all files were present in the drivers folder, (mbamchameleon.sys and farflt.sys). Then Disabled Norton Smart Firewall and Auto-Protect and updated to version mb3-setup-consumer-3.6.1.2711-1.0.463-1.0.7197.  Rebooted and ran a scan with MalwareBytes while leaving Norton disabled. It completed successfully.  I re-enabled Norton and ran another scan and it BSOD'd.

[nikhils]

@CCTech

That is interesting. Let me try to see if I can reproduce this in house.

Will keep you posted.

Thank you.

[CCTech]

Would it make sense to copy the missing files from another computer that has them?

(mbamchameleon.sys and farflt.sys)

[CCTech]

I haven't heard from anyone in a while, do you have any further recommendations?  -  CCTECH

[nikhils]

Hello @CCTech

I have not been able to get to reproducing this yet.

I did see that you have added Malwarebytes Exclusions to Norton. Can you also go ahead and exclude Norton folders and drivers from  Malwarebytes.

Exclude the following folders:

C:\Program Files\Norton Security

C:\ProgramData\Norton

Also Can you go to services.msc and set the Malwarebytes service to "Automatic Delayed Start" and reboot your machine.

Let me know what you see.

[CCTech]

I added the exclusions for Norton as you recommended and set Malwarebytes service for a delayed start and rebooted.

I enabled "Scan for Rootkits" and started a scan and it completed successfully so it looks like the problem is resolved.

What doesn't make sense is I have Norton and Malwarebytes installed on several other computers with no exclusions for each other and have had no problems.

Why this one???

Thanks for your help.  That's another one for the books.

[nikhils]

Hello @CCTech

I am glad the settings solved your issue.

Sometimes its just how the software loads up in terms of timing that can cause issues.

I'll run some more tests from our end to investigate further.

Thank you for letting us know.