mwac.sys BSoD

[Silver_fang]

1 minute ago, Porthos said:

I suggest the new BETA.

 

Not responding to  my question, eh?

Suggesting people to rather exclude their torrenting application from being analyzed by web feature of mbam as it triggers BSOD's.
 

[Porthos]

1 minute ago, Silver_fang said:

Suggesting people to rather exclude their torrenting application from being analyzed by web feature of mbam as it triggers BSOD's.

Torrent issues were fixed in the last release version.

What version are you running now?

[Silver_fang]

1 minute ago, Porthos said:

Torrent issues were fixed in the last release version.

What version are you running now?

Happened to my friend, he updated his to 4.1.2 now.. though he had the 4.1 version before that. 

[Porthos]

4 minutes ago, Silver_fang said:

he updated his to 4.1.2 now.

4.1.0  had all the issues and the first couple of CU updates did also but Torrent issues have been reported as fixed.

No matter what it is best to exclude the torrent exe in processes that connect to the web unless you like having many IP blocks popping up.

Quote

File sharing involves using technology that allows internet users to share files that are housed on their individual computers. Peer-to-peer (P2P) applications, such as those used to share music files, are some of the most common forms of file-sharing technology. However, P2P applications introduce security risks that may put your information or your computer in jeopardy.  Risks of File-Sharing Technology

I hope this helps, and if there is anything else we might assist you with please let us know.

.

As for why Malwarebytes blocks Torrent based software, this is because Torrent based software, are what are known as Peer-to-Peer (P2P) applications meaning it connects to many different servers/IP addresses (this is how files are downloaded through Torrent based software) and because of this, sometimes Torrent based software will connect to a server that is also known for hosting malicious content.  This is because servers/IP addresses are often shared by multiple sites, so while what you are downloading through Torrent based software may be perfectly safe, some of the sites hosted on some of the IP addresses that Torrent based software connects to may be malicious.  Such connections are not a threat however, and you may exclude Torrent based software from the Web Protection component in Malwarebytes to stop the blocks from happening without compromising your protection (your web browser and other critical web facing programs will still be fully protected from malicious websites and other malicious content).  To do so, add your Torrent based software.exe to your exclusions using the method described under the Exclude an Application that Connects to the Internet section of this support article.

 

[LiquidTension]

Hi @Silver_fang,

Has the BSOD/GSOD been exhibited with Malwarebytes component package 1.0.979 or higher? You can check which component package version is installed using the Settings -> About page in Malwarebytes.

[EvilPeppard]

Good morning folks,

I have another computer now crashing from Web Protection. I have several computers running MWB, and two of them that also run AdGuard Premium in tandem, but this is the only one currently crashing.

This particular computer does not have AdGuard Premium on it. This computer is simply used to stream Spotify to our home audio system. I don't use it for the Internet or anything else.

I have uploaded a screenshot from WhoCrashed showing MWB Web Protection crashed the system. This is happening every 24 to 48 hours since installing MWB.

I have also run the MWB support tool and attached the files, as well as included a WeTransfer link to my current 'memory.dmp' file.

Let me know what you find, and what I need to do next. I have disabled Web Protection in the meantime. Thank you!

Memory dump on WeTransfer: https://we.tl/t-NZTqngMpKp

 

mbst-grab-results.zip

[exile360]

Greetings,

Does disabling or removing Norton make any difference at all?  I ask because it's possible that Web Protection is conflicting with Norton's web filtering components which likely use the same WFP API's.  This support article documents several known applications which conflict with Web Protection currently, however I know of several others not listed there (I will be submitting these to the team for verification and inclusion in the list), and if it is discovered that Norton Security Online also conflicts, I'd like to get it added as well so that users will be aware and so that the Devs/QA will know to test compatibility when rolling out any possible fix for the WFP conflicts.

[EvilPeppard]

46 minutes ago, exile360 said:

Greetings,

Does disabling or removing Norton make any difference at all?  I ask because it's possible that Web Protection is conflicting with Norton's web filtering components which likely use the same WFP API's.  This support article documents several known applications which conflict with Web Protection currently, however I know of several others not listed there (I will be submitting these to the team for verification and inclusion in the list), and if it is discovered that Norton Security Online also conflicts, I'd like to get it added as well so that users will be aware and so that the Devs/QA will know to test compatibility when rolling out any possible fix for the WFP conflicts.

Thank you for your response. Norton is no longer installed. I had uninstalled Norton in lieu of MWB. I just confirmed again that Norton / Symantec was not installed on this machine.

What else can I look at?

[exile360]

If you use any sort of proxy, VPN, third party firewall or third party AV/web filtering software, that might be the cause.

Edit: Apologies, I just realized you mentioned you have AdGuard installed.  It is also known to conflict with Web Protection and is among applications listed in the support article.  If you disable its WFP driver/filter, that should eliminate the issue.

Edited September 7, 2020 by exile360

[EvilPeppard]

2 minutes ago, exile360 said:

If you use any sort of proxy, VPN, third party firewall or third party AV/web filtering software, that might be the cause.

Nothing like that on this particular computer, or on my home network. I have several computers on my home network running MWB, but only this one crashing due to Web Protection.

[exile360]

AdGuard has a WFP filter which conflicts with Malwarebytes; it's among the apps listed in the support article above.  Disabling its WFP filter should prevent the issue so you can verify.

[EvilPeppard]

1 minute ago, exile360 said:

AdGuard has a WFP filter which conflicts with Malwarebytes; it's among the apps listed in the support article above.  Disabling its WFP filter should prevent the issue so you can verify.

Thanks, I knew that about AdGuard. However, I already stated 'This particular computer does not have AdGuard Premium on it.'

- Source: 

 

[exile360]

Ah, apologies, I thought it did have AdGuard but that some of the systems with AdGuard just weren't having the issue.  I recall an issue with Dell Backup and Recovery, however I think that was related to Ransomware Protection, not Web Protection.  Still, it's worth a try to uninstall it and see if it helps.  You can always reinstall the latest version from Dell's support site and we can locate the download for you if you have any trouble finding it.

[exile360]

I'll also go ahead and request a staff member to provide analysis of your memory dump and logs as they may prove more informative as to the cause.  @LiquidTension, would you please take a look when you have a chance?  The memory dump and logs may be found in this post.

Thanks

[EvilPeppard]

4 minutes ago, exile360 said:

Ah, apologies, I thought it did have AdGuard but that some of the systems with AdGuard just weren't having the issue.  I recall an issue with Dell Backup and Recovery, however I think that was related to Ransomware Protection, not Web Protection.  Still, it's worth a try to uninstall it and see if it helps.  You can always reinstall the latest version from Dell's support site and we can locate the download for you if you have any trouble finding it.

No problem. I did have posts in this thread a while back with issues with MWB Web Protection and AdGuard Premium. For those computers, I turned off AdGuard's WFP, as was recommended, and have had no trouble since.

For this computer, it doesn't have Dell Backup and Recovery on it, only Dell Support Assist to help update drivers.

Do the log files I supplied show anything in particular that was causing the BSOD?

Thank you again for the suggestions.

[EvilPeppard]

3 minutes ago, exile360 said:

I'll also go ahead and request a staff member to provide analysis of your memory dump and logs as they may prove more informative as to the cause.  @LiquidTension, would you please take a look when you have a chance?  The memory dump and logs may be found in this post.

Thanks

We were posting at the same time.

Thank you. I look foward to hearing back on the log files!

[EvilPeppard]

On 9/7/2020 at 6:50 AM, EvilPeppard said:

Good morning folks,

I have another computer now crashing from Web Protection. I have several computers running MWB, and two of them that also run AdGuard Premium in tandem, but this is the only one currently crashing.

This particular computer does not have AdGuard Premium on it. This computer is simply used to stream Spotify to our home audio system. I don't use it for the Internet or anything else.

I have uploaded a screenshot from WhoCrashed showing MWB Web Protection crashed the system. This is happening every 24 to 48 hours since installing MWB.

I have also run the MWB support tool and attached the files, as well as included a WeTransfer link to my current 'memory.dmp' file.

Let me know what you find, and what I need to do next. I have disabled Web Protection in the meantime. Thank you!

Memory dump on WeTransfer: https://we.tl/t-NZTqngMpKp

 

mbst-grab-results.zip 1.33 MB · 2 downloads

Good afternoon,

Just wondering if @LiquidTension had a chance to review my logs and see what is making Web Protection BSOD my other computer. I still have Web Protection off for the time being, and the computer is stable.

Let me know, and thank you for your time.

[exile360]

While you wait, I've noted that the following applications also appear to conflict with Web Protection in addition to the others indicated in the support article I linked to in my first reply to you, so if you have any of these installed, try removing it and reboot to see if it fixes the problem:

ExpressVPN
IVACY VPN
Avast VPN
Norton Security Online

[EvilPeppard]

1 minute ago, exile360 said:

While you wait, I've noted that the following applications also appear to conflict with Web Protection in addition to the others indicated in the support article I linked to in my first reply to you, so if you have any of these installed, try removing it and reboot to see if it fixes the problem:

ExpressVPN
IVACY VPN
Avast VPN
Norton Security Online

Thanks. I have none of those installed. I did have Norton, but had uninstalled it in favor of MWB.

Thanks again for the suggestions though!

[exile360]

No problem, I figured you didn't have any of those installed and I didn't recall seeing any in your logs but figured I'd list them just in case.

By the way, Windows Security Center did indicate that Norton is still installed so running NRnR might not be a bad idea, assuming you haven't already, just in case it might have left behind some kind of driver or other item persisting and conflicting with Web Protection.  Of course if you created the logs prior to removing Norton, then that would explain why the entries were listed, though running their removal tool still isn't a bad idea since they do often leave items behind.

[EvilPeppard]

5 minutes ago, exile360 said:

No problem, I figured you didn't have any of those installed and I didn't recall seeing any in your logs but figured I'd list them just in case.

By the way, Windows Security Center did indicate that Norton is still installed so running NRnR might not be a bad idea, assuming you haven't already, just in case it might have left behind some kind of driver or other item persisting and conflicting with Web Protection.  Of course if you created the logs prior to removing Norton, then that would explain why the entries were listed, though running their removal tool still isn't a bad idea since they do often leave items behind.

I had removed Norton before installing MWB and running the logs, but I just ran the tool now, and chose 'Remove Only' under the Advanced Options.

I rebooted and reenabled Web Protection to see how it behaves.

Thanks for that suggestion. I will report back!

[EvilPeppard]

On 9/11/2020 at 4:19 PM, EvilPeppard said:

I had removed Norton before installing MWB and running the logs, but I just ran the tool now, and chose 'Remove Only' under the Advanced Options.

I rebooted and reenabled Web Protection to see how it behaves.

Thanks for that suggestion. I will report back!

Computer is still crashing from MWB Web Protection even after running the Norton uninstaller tool. Just happened again last night.

[EvilPeppard]

On 9/7/2020 at 6:50 AM, EvilPeppard said:

Good morning folks,

I have another computer now crashing from Web Protection. I have several computers running MWB, and two of them that also run AdGuard Premium in tandem, but this is the only one currently crashing.

This particular computer does not have AdGuard Premium on it. This computer is simply used to stream Spotify to our home audio system. I don't use it for the Internet or anything else.

I have uploaded a screenshot from WhoCrashed showing MWB Web Protection crashed the system. This is happening every 24 to 48 hours since installing MWB.

I have also run the MWB support tool and attached the files, as well as included a WeTransfer link to my current 'memory.dmp' file.

Let me know what you find, and what I need to do next. I have disabled Web Protection in the meantime. Thank you!

Memory dump on WeTransfer: https://we.tl/t-NZTqngMpKp

 

mbst-grab-results.zip 1.33 MB · 3 downloads

Still looking for an update on this post from 10 days ago. Anyone look at my log files yet? I really do not like running without Web Protection enabled, but I have no choice right now till we address this BSOD issue.

Thank you.

[Porthos]

1 hour ago, EvilPeppard said:

but I have no choice right now till we address this BSOD issue.

Have you tried the current version?

 

[EvilPeppard]

1 minute ago, Porthos said:

Have you tried the current version?

 

I just checked and am already on 4.2.1. Do the logs show the reason I am crashing with Web Protection enabled is because I am still on 4.2.0?

I tend to update as soon as the software prompts me of a software update.