Jump to content

mwac.sys BSoD


Recommended Posts

7 minutes ago, EvilPeppard said:

Do the logs show the reason I am crashing with Web Protection enabled is because I am still on 4.2.0?

Just asking if you upgraded yet.

8 minutes ago, EvilPeppard said:

I tend to update as soon as the software prompts me of a software update.

That can take a while sometimes.

The company has program updates pushed through the normal updater (the one that checks for database updates) metered in such a way that it is throttled so not every user is offered the new build once it has been released, so it becomes a matter of probability and is somewhat random.  This means that you might be offered it early, or it might take a really long time before it is offered to you, it just all depends.  Basically a luck of the draw kind of deal.

Link to post
Share on other sites

10 minutes ago, Porthos said:

Just asking if you upgraded yet.

That can take a while sometimes.

The company has program updates pushed through the normal updater (the one that checks for database updates) metered in such a way that it is throttled so not every user is offered the new build once it has been released, so it becomes a matter of probability and is somewhat random.  This means that you might be offered it early, or it might take a really long time before it is offered to you, it just all depends.  Basically a luck of the draw kind of deal.

Ok, yeah, I am on 4.2.1 and I just crashed again last night. As I had originally posted with the logs, this computer gets used for nothing but streaming Spotify, and has no other security software on it, so I am really surpirsed Web Protection is crashing it, which is why I am so curious what the logs are showing.

Thank you for your prompt replies and suggestions. :)

Link to post
Share on other sites

3 minutes ago, Porthos said:

They will still be there and yes "I" looked at them. Unfourtantly I have nothing to offer that I am authorized to do here on the forums.

 

I see. Well, I certainly am willing to help out, but I don't want to keep taking the time to create log files, uploads, and screenshots, if my original efforts are not being looked at by support staff who can reply and offer replies based on the info I was asked to supply.

I'm not trying to be difficult, I just don't want to duplicate my efforts, and want to feel like my issues are being addressed.

Thank you for being so quick to reply how you could. I understand your position.

Link to post
Share on other sites

  • 2 weeks later...

I've been having similar issues lately. More and more BSOD crashes w/ "driver_irql_not_less_or_equal" pointing to mwac.sys & "kernel security check failure".

For the kernel BSODs, I used the fixes outlined in "https://forums.tomshardware.com/faq/how-to-fix-windows-10-error-kernel-security-check-failure.2752277/#:~:text=Kernel Security Check Failure means,file that got corrupted somehow."

I've also noticed boot times have seriously degraded. This pc was built in April. 

I've all the latest updates for Windows 10, running 4.2.12 Malwarebytes.

Here is my dump file from the MalwareBytes Support Tool.

mbst-grab-results.zip

Link to post
Share on other sites

Greetings,

I took a look at your logs and discovered you have ExpressVPN installed and at least traces of a past Norton installation.  ExpressVPN is known to conflict with the Web Protection in Malwarebytes which uses the driver mwac.sys and this is likely the cause of the BSODs.  Please refer to this support article for additional info.

In the meantime, if you remove ExpressVPN and restart your system, it should eliminate the issues you've been experiencing.  I'd also suggest running the Norton Removal Tool to eliminate any traces of Norton that might be left behind on the system.

Please let us know how it goes and if you continue to experience any issues or not.

Thanks

Link to post
Share on other sites

Yes, as long as you either keep Web Protection disabled, or disable/remove ExpressVPN, you shouldn't experience any further BSODs.

If you haven't done so already, I'd also recommend installing Malwarebytes Browser Guard as it will give back at least some of the protection normally provided by Web Protection, though only for your web browser rather than your entire system.  It uses many of the same web block databases as Web Protection and also includes behavior based blocking for tech support scam sites and other threats and additionally blocks many ads and trackers to guard your privacy (items not blocked by Web Protection), so if you do end up re-enabling Web Protection later on, you should still keep Malwarebytes Browser Guard as it adds to the shielding provided by Web Protection in Malwarebytes Premium.  It is free and is available for Chromium based browsers as well as Mozilla Firefox.

Link to post
Share on other sites

On 9/17/2020 at 9:07 AM, EvilPeppard said:

I see. Well, I certainly am willing to help out, but I don't want to keep taking the time to create log files, uploads, and screenshots, if my original efforts are not being looked at by support staff who can reply and offer replies based on the info I was asked to supply.

I'm not trying to be difficult, I just don't want to duplicate my efforts, and want to feel like my issues are being addressed.

Thank you for being so quick to reply how you could. I understand your position.

Just checking back. Any word on my log review yet?

Link to post
Share on other sites

On 9/7/2020 at 6:50 AM, EvilPeppard said:

Good morning folks,

I have another computer now crashing from Web Protection. I have several computers running MWB, and two of them that also run AdGuard Premium in tandem, but this is the only one currently crashing.

This particular computer does not have AdGuard Premium on it. This computer is simply used to stream Spotify to our home audio system. I don't use it for the Internet or anything else.

I have uploaded a screenshot from WhoCrashed showing MWB Web Protection crashed the system. This is happening every 24 to 48 hours since installing MWB.

I have also run the MWB support tool and attached the files, as well as included a WeTransfer link to my current 'memory.dmp' file.

Let me know what you find, and what I need to do next. I have disabled Web Protection in the meantime. Thank you!

Memory dump on WeTransfer: https://we.tl/t-NZTqngMpKp

 

MWB-DKPMedia-crash-9-7-2020.PNG

mbst-grab-results.zip 1.33 MB · 8 downloads

For now I have gone ahead and removed MWB all together from this particular system. I was hoping to hear something back on my logs by now. You guys are usually pretty quick with the log file review. Perhaps things are slower right now due to COVID.

I will just standby till I hear back on my log files so I can get some direction on the issue. Hopefully my logs will be reviewed soon so I can hear back on the issue.

Thank you.

Link to post
Share on other sites

37 minutes ago, AdvancedSetup said:

Hello @EvilPeppard

If you want further analysis for this you would need to open a Support Ticket so that an ongoing analysis could be tracked and monitored to assist you.

Thank you

 

Ahh, ok. Sorry, I thought the logs would be looked at here first. They have in the past for me, but I certainly can open a support ticket.

Thanks for the heads up! Have a great day.

Link to post
Share on other sites

FYI  note   regarding the latest Beta for Malwarebytes for Windows, it has a fix for certain MWAC  Stop code Windows aborts

https://forums.malwarebytes.com/topic/262752-malwarebytes-42-beta/?do=findComment&comment=1412784

 

Quote

Some Issues now addressed:

  • Fixed: MB4.2.1 fails to communicate with the license server while 4.1.2 can
  • Fixed: 0x139 MWAC BSOD under certain circumstances
  • Fixed: IPv6 ping doesn't work with enabled MWAC
  • Fixed: Some UI issues

 

Link to post
Share on other sites

  • 2 months later...

2 BSOD in one day, something has changed? 

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
 

STACK_TEXT:  
fffff807`1d073358 fffff807`19207769 : 00000000`00000139 00000000`00000003 fffff807`1d073680 fffff807`1d0735d8 : nt!KeBugCheckEx
fffff807`1d073360 fffff807`19207b90 : ffffbe82`b99e1000 00000000`00000000 00000000`00000000 ffffbe82`b69b1a20 : nt!KiBugCheckDispatch+0x69
fffff807`1d0734a0 fffff807`19205f23 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffff807`1d073680 fffff807`656176e3 : ffffbe82`bdbebbb0 ffffbe82`c82fef50 fffff807`6561a100 fffff807`656058e4 : nt!KiRaiseSecurityCheckFailure+0x323
fffff807`1d073810 ffffbe82`bdbebbb0 : ffffbe82`c82fef50 fffff807`6561a100 fffff807`656058e4 fffff807`6561a100 : mwac+0x176e3
fffff807`1d073818 ffffbe82`c82fef50 : fffff807`6561a100 fffff807`656058e4 fffff807`6561a100 00000000`00000000 : 0xffffbe82`bdbebbb0
fffff807`1d073820 fffff807`6561a100 : fffff807`656058e4 fffff807`6561a100 00000000`00000000 00000000`00000001 : 0xffffbe82`c82fef50
fffff807`1d073828 fffff807`656058e4 : fffff807`6561a100 00000000`00000000 00000000`00000001 00000000`00000000 : mwac+0x1a100
fffff807`1d073830 fffff807`6561a100 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffb0d`459f7a70 : mwac+0x58e4
fffff807`1d073838 00000000`00000000 : 00000000`00000001 00000000`00000000 fffffb0d`459f7a70 fffff807`6561dd90 : mwac+0x1a100
 

DUMP.rar

Link to post
Share on other sites

19 minutes ago, lcfx_lain said:

2 BSOD in one day, something has changed? 

Can you please collect and upload as an attachment the diagnostic data using our MBST?

  • Download and run the Malwarebytes Support Tool
  • Accept the EULA and click Advanced tab on the left (not Start Repair)
  • Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
Link to post
Share on other sites

47 minutes ago, nikhils said:

Hello @lcfx_lain

Can you please send us the following dump files:


C:\WINDOWS\MEMORY.DMP                 

MEMORY DUMP Here: https://1drv.ms/u/s!AjllwI-O3U6aj6cyOEy8wKQ-VgDWkQ?e=ut8AWw

 

Minidumps here: https://forums.malwarebytes.com/topic/255466-mwacsys-bsod/?do=findComment&comment=1429456

 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.