mwac.sys BSoD

[EvilPeppard]

On 2/7/2020 at 11:13 AM, EvilPeppard said:

Ok, done. I have MWB running again with Web Protection turned off at the moment.

Just an update, I have been running with Web Protection turned off for three days now and no crashes since my last report of a BSOD on 2/7/2020.

[EvilPeppard]

Just following up to see if there have been any developments for a fix so I can start using Web Protection again?  feel quite vulnerable not running full protection.

Thank you for any information or updates.

[nikhils]

Hello @EvilPeppard

We are still looking into the issue.

Can you please try this test for us:

1. Uninstall LMI.

2. Turn on web protection In Malwarebytes.

Want to know if this still gives you a BSOD or is it all ok after that. Please let us know.

Thank you.

[EvilPeppard]

1 hour ago, nikhils said:

Hello @EvilPeppard

We are still looking into the issue.

Can you please try this test for us:

1. Uninstall LMI.

2. Turn on web protection In Malwarebytes.

Want to know if this still gives you a BSOD or is it all ok after that. Please let us know.

Thank you.

Ok, let me look into that. LMI is on my work computer, so I may not be able to uninstall LMI.

However, I have also re-enabled MWB and Web Protection on my two home gaming computers, so I will monitor all three and see which, if any, of the three BSOD. We may be able to narrow down computers from there. My home gaming rigs only have Windows Defender / Security on them with MWB, and I believe MWB 4.x now 'replaces' Windows Security.

Between these three computers we should be able to see if LMI is the problem or not, since only my work computer has LMI on it.

Thanks again.

[Porthos]

1 hour ago, EvilPeppard said:

My home gaming rigs only have Windows Defender / Security on them with MWB, and I believe MWB 4.x now 'replaces' Windows Security.

On new versions of 10 MB will disable Defender but that can be over ridden/fixed with one setting change in Malwarebytes. They do run side by side very well and gives you a more layered protection.

 

[EvilPeppard]

1 hour ago, Porthos said:

On new versions of 10 MB will disable Defender but that can be over ridden/fixed with one setting change in Malwarebytes. They do run side by side very well and gives you a more layered protection.

 

Oh cool! Thank you for the tip!

[EvilPeppard]

20 hours ago, EvilPeppard said:

Ok, let me look into that. LMI is on my work computer, so I may not be able to uninstall LMI.

However, I have also re-enabled MWB and Web Protection on my two home gaming computers, so I will monitor all three and see which, if any, of the three BSOD. We may be able to narrow down computers from there. My home gaming rigs only have Windows Defender / Security on them with MWB, and I believe MWB 4.x now 'replaces' Windows Security.

Between these three computers we should be able to see if LMI is the problem or not, since only my work computer has LMI on it.

Thanks again.

I was able to uninstall LMI. I currently have MWB running again with Web Protection enabled on my work computer.

My home game rigs don't have LMI and are running MWB with Web Protection enabled as well.

[EvilPeppard]

Well, my home game rig BSOD'd last night. It had been up for about 24 hours after a previous, normal reboot from doing Windows Updates and such.

I had 25 tabs open in Chrome and had been playing The Division 2 all afternoon when the BSOD happened.

Who Crashed didn't specifically reference MWB this time, but did reference 'tcpip.sys', which has been the common reference between both my home game rigs, and my work computer, since this all started last month.

I have now closed MWB again and turned off the auto start with Windows option, for now.

Here is the Who Crashed report. I am happy to upload any logs or memory dumps, if you want.

Thank you for your time.

On Sun 2/16/2020 7:38:53 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
uptime: 12:16:36
This was probably caused by the following module: tcpip.sys (0xFFFFF8054B5BEF47)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF8054B5BEF47, 0xFFFFD807A5AC9310, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\drivers\tcpip.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: TCP/IP Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
 

[exile360]

I haven't read through this entire thread, however if the BSOD's you are experiencing generally reference tcpip.sys and/or mwac.sys then you may be able to work around the issue by just disabling the Web Protection component in Malwarebytes.  To do so, right-click the Malwarebytes tray icon and click where it says Web Protection: On then click Yes to the User Account Control prompt.  You can then disable the option in Malwarebytes for it to notify you when any protection components in Malwarebytes are disabled (that way you aren't bombarded by alerts while keeping Web Protection disabled until the issue is fixed).  This option is under settings which you access by clicking the small gear icon in the upper right area of the main Malwarebytes UI, then select the Notifications tab and toggle the option to be alerted if any Real-Time Protection modules are turned off to disable it and you won't be alerted about Web Protection being disabled whenever Malwarebytes starts.

I hope this helps, however please disregard if you have already tried disabling individual protection components to try and work around the issue.

[EvilPeppard]

On 2/17/2020 at 7:42 AM, exile360 said:

I haven't read through this entire thread, however if the BSOD's you are experiencing generally reference tcpip.sys and/or mwac.sys then you may be able to work around the issue by just disabling the Web Protection component in Malwarebytes.  To do so, right-click the Malwarebytes tray icon and click where it says Web Protection: On then click Yes to the User Account Control prompt.  You can then disable the option in Malwarebytes for it to notify you when any protection components in Malwarebytes are disabled (that way you aren't bombarded by alerts while keeping Web Protection disabled until the issue is fixed).  This option is under settings which you access by clicking the small gear icon in the upper right area of the main Malwarebytes UI, then select the Notifications tab and toggle the option to be alerted if any Real-Time Protection modules are turned off to disable it and you won't be alerted about Web Protection being disabled whenever Malwarebytes starts.

I hope this helps, however please disregard if you have already tried disabling individual protection components to try and work around the issue.

Thanks. Disabling Web Protection does seem to stop the BSOD. However, and since you haven't read through the thread, this issue was supposedly fixed in a release from earlier in February.

The issue still persists, so I was providing more info to the group in an effort to further track down what changed with MWB staring last month in January where users started experiencing BSOD from MWB with Web Protection enabled.

Turning off Web Protection is a temporary work around, but I personally don't like not being fully protected, especially since I heavily use the Internet and my computer daily for both work and personal. I want to confidently and fully use MWB Pro as intended. I am confident MWB will fix the problem, and I anxiously await to hear about the fix.

[LiquidTension]

On 2/17/2020 at 1:43 PM, EvilPeppard said:

Well, my home game rig BSOD'd last night. It had been up for about 24 hours after a previous, normal reboot from doing Windows Updates and such.

Thanks for letting us know about this.

Please could you zip up and provide C:\Windows\MEMORY.dmp (assuming it was created) along with logs from the Malwarebytes Support Tool: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-manually

[EvilPeppard]

2 hours ago, LiquidTension said:

Thanks for letting us know about this.

Please could you zip up and provide C:\Windows\MEMORY.dmp (assuming it was created) along with logs from the Malwarebytes Support Tool: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-manually

Here are the MWB support tool files, and a link to the memory.dmp from 2/16/2020.

https://we.tl/t-zidT5vAtUm

Let me know how else I can help.

Thank you for your time.

mbst-grab-results.zip

[exile360]

Thanks for the logs and memory dump

I'm sure the Devs will get good info from it and hopefully get this issue resolved soon.

In the meantime, if you are running with Web Protection disabled for daily use, you can still have at least your browser protected by installing Malwarebytes Browser Guard if you haven't already.  It blocks the same sites as Web Protection would and actually blocks some additional threats and undesirable web sites/content on top of that (including behavior based blocking for tech support scam sites; a very powerful feature that I recommend for everyone these days) and it is fully compatible with Web Protection in Malwarebytes so once the BSOD issue has been resolved you can enable Web Protection and keep Malwarebytes Browser Guard installed in your browser(s) to get the benefits of both protections.

You can learn more and download Malwarebytes Browser Guard on this page.

I'll get out of the way now so that you guys can continue to work with LiquidTension on diagnosing and fixing this BSOD issue.

[EvilPeppard]

Thanks.

I currently am running MWB on all three of my computers with Web Protection disabled again for the time being while this issue is investigated.

[EvilPeppard]

On 2/18/2020 at 8:55 AM, LiquidTension said:

Thanks for letting us know about this.

Please could you zip up and provide C:\Windows\MEMORY.dmp (assuming it was created) along with logs from the Malwarebytes Support Tool: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-manually

Any update on my log files I sent over? Did you see anything in particular?

Thank you for your time.

[EvilPeppard]

On 2/18/2020 at 11:07 AM, EvilPeppard said:

Here are the MWB support tool files, and a link to the memory.dmp from 2/16/2020.

https://we.tl/t-zidT5vAtUm

Let me know how else I can help.

Thank you for your time.

mbst-grab-results.zip 4.72 MB · 1 download

Still looking for an update on the files I sent over. Anything of value?

I am still running with Web Protection disabled.

Thank you.

[LiquidTension]

We don't have any updates at this current time.

If you do not wish to leave Web Protection disabled, you have the option of reverting to an earlier version. Here's the installer: https://malwarebytes.box.com/s/z6cravnwptrzx5tyjw36jq6zt6c7apsx

Once installed, you will need to disable the "Application updates" settings found in Settings -> General to prevent the program from automatically updating to the affected version.

[EvilPeppard]

Actually, I see I was just prompted for a version update from 4.0.4.49 to 4.1.0.56.

I have upgraded, rebooted, and reenabled Web Protection on all of my computers. We'll see how this new version behaves.

[nikhils]

Hello @EvilPeppard

Please let us know if you encounter the BSOD with the Beta build 4.1.0.56. 

 

[EvilPeppard]

26 minutes ago, nikhils said:

Hello @EvilPeppard

Please let us know if you encounter the BSOD with the Beta build 4.1.0.56. 

 

Will do. Thank you.

[EvilPeppard]

6 hours ago, nikhils said:

Hello @EvilPeppard

Please let us know if you encounter the BSOD with the Beta build 4.1.0.56. 

 

Bad news. Within 4 hours of installing 4.1.0.56 and enabling Web Protection, one of my computers has already BSOD with tcpip.sys. Whocrashed says it is MWB Web Protection.

I have turned Web Protection back off, again.

Let me know what you need from me this time that is different from what I have sent the previous two times.

Thank you.

[LiquidTension]

Hi @EvilPeppard,

The latest beta does not contain a fix for the issue you're experiencing. We hope to have something available to try in an upcoming update.

[EvilPeppard]

45 minutes ago, LiquidTension said:

Hi @EvilPeppard,

The latest beta does not contain a fix for the issue you're experiencing. We hope to have something available to try in an upcoming update.

Ok, thanks for the update. I will patiently wait and watch for a specific update for the Web Protection piece. In the meantime I will keep running with Web Protection turned off.

[EvilPeppard]

On 2/26/2020 at 7:42 AM, LiquidTension said:

Hi @EvilPeppard,

The latest beta does not contain a fix for the issue you're experiencing. We hope to have something available to try in an upcoming update.

Good morning,

So I just saw this post regarding the new 4.1.0.56 version: 

 

The notes specifically say: 'Fixed: Several BSODs or hangs occurring under certain circumstances'.

Just verifying this update still does not address the Web Protection BSODs I have been experiencing, or does it? I want to know if I should turn on Web Protection again to try and test or not.

Thank you.

[LiquidTension]

Hello,

This is the same version that was released to beta a couple of days ago. It's now been released publicly to all users, so no change with the issue you're experiencing.

Edited February 28 by LiquidTension