MWAC BSOD Windows server 2019 (1809) x64

[ChrisK1965]

Hello. I had a Windows update on FRI 1-10-2020.  Over this weekend my server rebooted after BSOD. Over 12 times since Fri.  BSOD points to MWAC.SYS. IRQL not less or equal. 

Windows cumulative update windows server 2019 (1809) x64 based --      (KB4530715)

We Shut off service to keep business running for the day will try reinstall malwarebytes tonight. 

I have extracted the dump file text and memory dump text. 

From what i gather  windows and malwarebytes are fighting for file control due to file protection, and system protection.

I have not been able to test but an uninstall and reinstall maybe the fix. Basically resetting permissions after Windows does what ever it thinks it needed to do. 

Dumpfile text .txt MemoryDMP.txt

[nikhils]

Hello @ChrisK1965

Can you please follow instructions in the document and send us the mbst logs ?

https://support.malwarebytes.com/docs/DOC-2396

[ChrisK1965]

I will have to do this after business hours as I need the server to function.  

Bought from business tab. Malwarebytes for teams.  4.0.4.49 installed.

 

[ChrisK1965]

When we got the product installed about a month ago, only issue I ran in to was we set to scan for root kits and that BSOD the server. After reading somewhere, root kits needs to be turned off. So we turned that off and had no problems up until now.  I will download the tool and create the logs and use the clean up tool before a fresh install.

 

[Porthos]

58 minutes ago, ChrisK1965 said:

Bought from business tab. Malwarebytes for teams.  4.0.4.49 installed.

That version is not supported on any server OS. It works for most but there is another option for servers. The version you have is for the workstation/computers.

But that is not the issue with the blue screens.

Edited January 13, 2020 by Porthos

[Porthos]

44 minutes ago, ChrisK1965 said:

After reading somewhere, root kits needs to be turned off. So we turned that off and had no problems up until now. 

The Web protection is the issue with the blue screens. Turn that off and it will stop.

[ChrisK1965]

Defeats the purpose of buying the product if I have to turn everything off. 

[ChrisK1965]

@nikhils

You want me to send the zip to support or upload here?

[Maurice Naggar]

< kibbitz >  @ChrisK1965   

I believe Nikhils meant for you to attach the ZIP file here in this thread-topic.    Otherwise, if you wish, you may attach into a personal message to him.

As far as "scan for rootkits" it should be Off by design / default.  Having the rootkit scan makes runs run longer.  It is not needed in most cases.

 

[ChrisK1965]

Zip file

mbst-grab-results.zip

[Maurice Naggar]

@nikhils

[ChrisK1965]

OK, after uninstalling MB,  run windows update. Ran clean up.   Re-installed MB,   ran fine all night.  This morning the system logs looked good.   On another computer on the network, we tried to access our DC drive. Clicked on the short cut folder, and the DC BSOD.  Same error.  MWAC.sys Driver IRQL not less or equal.

 

This short cut worked fine before the windows update on the 01/10/2020  The short cut link is through the network.   \\DC\C$\   Just a basic shortcut. From what I see our security rights for the shortcut is correct.

with out MB, shortcut works fine.      

@nikhils     This zip is from this mornings BSOD.

We are wondering what version of software is needed for use on our server. Its only one server. Nothing elaborate. We were hit with a ransomware in December and are looking for anti-exploit and anti-ransom software that functions but doesn't have the corporate level price and subscriptions.

mbst-grab-results.zip

[nikhils]

Hello @ChrisK1965

Would it be possible to send us the Memory.dmp file located at C:\Windows\MEMORY.DMP   .

It's a large file so use a service like https://wetransfer.com/ to attach the file.

Thank you.

[ChrisK1965]

@nikhils.   From the BSOD on Monday or todays?  

[nikhils]

@ChrisK1965

If you have both that would be great. If now the one from today works too.

Thank you.

[ChrisK1965]

OK.   Here are the Memory dumps.

Monday  --       https://we.tl/t-gxHoQ20nTe

Tuesday --       https://we.tl/t-HiLqkmYy6V

[ChrisK1965]

@nikhils 

 

[nikhils]

Hello @ChrisK1965

Your dump file is consistent with the known BSOD issues we have seen and we are planning to release a fix soon.

This is what you could do:

 

[nikhils]

@ChrisK1965

Also Malwarebytes for Teams (MB 4.x)  is not officially supported on Server OS.

I would recommend going for either EP/EPR for businesses.

They have a minimum seat count of 10 but you could technically protect multiple devices/endpoints in your business.

[ChrisK1965]

OK. Thanks for your help. I am hopeful you can find support for server 2019 at some point, its based on Windows 10 environment correct?

At this point we are looking at our options.    Thanks for the info and your help, I hope I was able to help you guys too .

 

[nikhils]

Hello @ChrisK1965

Your logs was certainly helpful. We are still discussing the possibility of Consumer products supported on servers.

As far as the BSOD goes we plan to have a fix for this issue soon.

You can continue to run the Malwarebytes for Teams on the server but please remember it's not officially supported.

Hope that helps.

[Juna]

I've read every word of this thread.  I have this same problem.  BSOD points to mwac.sys. IRQL not less or equal.

Can you please send me the URL to an earlier version of MB version 4.  I am running the latest 4.04.49  (4.0.0.473 Executables).

I've been running MalwareBytes Premium for many years on this PC without issue until the last few days.

I really need the Web protection to stay on. That is my greatest concern on this PC.

Cheers,

[LiquidTension]

2 hours ago, Juna said:

I've read every word of this thread.  I have this same problem.  BSOD points to mwac.sys. IRQL not less or equal.

Can you please send me the URL to an earlier version of MB version 4.  I am running the latest 4.04.49  (4.0.0.473 Executables).

I've been running MalwareBytes Premium for many years on this PC without issue until the last few days.

I really need the Web protection to stay on. That is my greatest concern on this PC.

Cheers,

If you wish to revert to an earlier version, download links can be found here: https://forums.malwarebytes.com/topic/255466-mwacsys-bsod/?do=findComment&comment=1355676

[Meekon]

Experiencing the same issue on WIndows Server 2016 Essentials. Disabling Web Protection has resolved it.

Is there an ETA to a fix so Web Protection can be re-enabled?

[LiquidTension]

Please try the latest beta version available and let us know if this addresses the issue: https://forums.malwarebytes.com/topic/252170-a-new-malwarebytes-4-beta-is-now-available/?do=findComment&comment=1357781