BSOD caused by mwac.sys Support Ticket 3008946

[Arijit]

Since April 22 I am having BSOD after every 2-3 hours. I am running latest version see screenshot.

I did the following till now
1) did a WindBG on minidump and main dump, all of the results point to mwac.sys

2) I  uninstalled - rebooted - reinstalled , still same

3) Downloaded latest support tool, opened a ticket Support Ticket 3008946 and submitted logs, still restart going on!

Never had problems in free version for last 3 years. Did I do in any wrong in paying up?

Thanks

Arijit

042620-19015-01.dmp

winDBG.txt

 

--------------

Use !analyze -v to get detailed debugging information.

BugCheck 133, {0, 501, 500, 0}

*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : mwac.sys ( mwac+122a6 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
    component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: 0000000000000000

 

 

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[Porthos]

I suggest you install the current BETA  then do a manual check for updates until you receive it and see if that corrects the issue.

If that does not work turn off Web Protection and see if that solves the issue for now.

 

[Arijit]

The disclaimer given on the Beta programme is quite fearsome! I am not very keen to crash my live production server more often it is doing now.

 

[Arijit]

I did not sign up for Beta but the software updated to 1.0.22990 and crashed immediately!

I will now try disabling web-protection

 

------------------

Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\042620-18171-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
OK                                             c:\mysymbols
Deferred                                       cache*c:\symbolcache
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: c:\mysymbols;cache*c:\symbolcache;SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
Built by: 9600.19678.amd64fre.winblue_ltsb_escrow.200330-1737
Machine Name:
Kernel base = 0xfffff800`d4e84000 PsLoadedModuleList = 0xfffff800`d51495f0
Debug session time: Sun Apr 26 21:44:12.159 2020 (UTC + 5:30)
System Uptime: 0 days 2:08:03.797
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 133, {0, 501, 500, 0}

*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : mwac.sys ( mwac+122a6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
    component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: 0000000000000000

Debugging Details:
------------------

DPC_TIMEOUT_TYPE:  SINGLE_DPC_TIMEOUT_EXCEEDED

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

BUGCHECK_STR:  0x133

PROCESS_NAME:  System

CURRENT_IRQL:  d

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff800d4fde86a to fffff800d4fc44c0

STACK_TEXT:  
ffffd001`8122bc88 fffff800`d4fde86a : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffd001`8122bc90 fffff800`d4eb2fd1 : 00000000`00000000 00000000`000780f3 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x563a
ffffd001`8122bd20 fffff800`d4e1cac5 : ffffd001`7ddc97a0 00000000`00000001 ffffd001`8121a480 ffffd001`7d9e0180 : nt!KeClockInterruptNotify+0x91
ffffd001`8122bf40 fffff800`d4f38943 : ffffafdd`6c51ec0b 00000000`00000000 ffffe000`86df2010 ffffd001`8121a838 : hal!HalpTimerClockIpiRoutine+0x15
ffffd001`8122bf70 fffff800`d4fc59ca : ffffe000`868eb1e0 ffffd001`8121a480 ffffe000`877eed20 ffffd001`8121a838 : nt!KiCallInterruptServiceRoutine+0xa3
ffffd001`8122bfb0 fffff800`d4fc5e77 : ffffd001`8121ae50 00000000`00000000 fffff800`95e4d4c0 ffffd001`8121a2c0 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffd001`8121a2a0 fffff800`d4f07073 : ffffe000`877eed20 ffffd001`8121ae50 ffffe000`86df2010 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffd001`8121a430 fffff800`95e492a6 : ffffe000`8ef1fc30 00000000`00000001 ffffd001`8121a628 fffff800`00000000 : nt!KxWaitForLockOwnerShip+0x27
ffffd001`8121a460 ffffe000`8ef1fc30 : 00000000`00000001 ffffd001`8121a628 fffff800`00000000 ffffd001`83216590 : mwac+0x122a6
ffffd001`8121a468 00000000`00000001 : ffffd001`8121a628 fffff800`00000000 ffffd001`83216590 fffff800`95e51b11 : 0xffffe000`8ef1fc30
ffffd001`8121a470 ffffd001`8121a628 : fffff800`00000000 ffffd001`83216590 fffff800`95e51b11 ffffe000`86df2002 : 0x1
ffffd001`8121a478 fffff800`00000000 : ffffd001`83216590 fffff800`95e51b11 ffffe000`86df2002 00000000`00000000 : 0xffffd001`8121a628
ffffd001`8121a480 ffffd001`83216590 : fffff800`95e51b11 ffffe000`86df2002 00000000`00000000 00000000`00000000 : 0xfffff800`00000000
ffffd001`8121a488 fffff800`95e51b11 : ffffe000`86df2002 00000000`00000000 00000000`00000000 fffff800`95e3da0b : 0xffffd001`83216590
ffffd001`8121a490 ffffe000`86df2002 : 00000000`00000000 00000000`00000000 fffff800`95e3da0b 00000000`00000000 : mwac+0x1ab11
ffffd001`8121a498 00000000`00000000 : 00000000`00000000 fffff800`95e3da0b 00000000`00000000 ffffe000`877eed20 : 0xffffe000`86df2002

STACK_COMMAND:  kb

FOLLOWUP_IP: 
mwac+122a6
fffff800`95e492a6 ??              ???

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  mwac+122a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mwac

IMAGE_NAME:  mwac.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5e84a7fa

FAILURE_BUCKET_ID:  0x133_DPC_mwac+122a6

BUCKET_ID:  0x133_DPC_mwac+122a6

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x133_dpc_mwac+122a6

FAILURE_ID_HASH:  {5fb89f40-2c9e-f340-840d-969068313f39}

Followup: MachineOwner
---------

[exile360]

Please try installing the beta if you wouldn't mind.  It is the only possible means of correcting the BSOD (database updates will not and cannot fix this sort of issue as the problem is in the Web Protection driver) and the beta is reported to correct numerous known BSODs with Web Protection so it very likely will fix the issue.

Your other option would be to continue with Web Protection disabled and wait for the final release of the current beta.

[Arijit]

OK,

I signed up for Beta and MalwareBytes updated and enabled web Protection back on. 

Now lets see

[exile360]

Excellent, please let us know how it goes and if the issue is fixed or not.

Thanks

[lgkahn]

same issue here please keep me informed since last week or so dpc_watchdog error in mwc..

 

thought it was my c drive ssd .. replaced that same issue.. went away for days when i removed malware bytes.. 

 

any updates on a solution would be good.. for now i removed malwarebytes..

on like 9 other of my machines all is ok..

but this particular machine a precision t5610 24 core is up 24 x 7

 

thanks

 

ie 

malbytes.txt

[Arijit]

5 hours ago, exile360 said:

Excellent, please let us know how it goes and if the issue is fixed or not.

Thanks

No, it was OK for a few hours then bad again. MWB last updated to 1.0.23000 

I signed up for Beta 21:46 PM after that had crashes on 01:06 AM, 3.34 AM, 5.52 AM

Had very less sleep last night. A completely perfect running server of over 3 years now getting rendered useless by this issue.

1) Disabling web protection now

2) Will uninstall if problem still persists

3) Is there a way I can downgrade to a previous all working'version?

 

[Arijit]

5 hours ago, exile360 said:

Excellent, please let us know how it goes and if the issue is fixed or not.

Thanks

No, it was OK for a few hours then bad again. MWB last updated to 1.0.23000 

I signed up for Beta 21:46 PM after that had crashes on 01:06 AM, 3.34 AM, 5.52 AM

Had very less sleep last night. A completely perfect running server of over 3 years now getting rendered useless by this issue.

1) Disabling web protection now

2) Will uninstall if problem still persists

3) Is there a way I can downgrade to a previous all working'version?

 

[Arijit]

I was checking other posts in the forum on BSOD relating to mwac.sys to find if I have any similar situation, I read 9 pages of this link below but couldn't relate any link.

- I am not running ad blocking software

- Just the normal windows Firewall

= Default Windows Filtering Platform is on and working

- This is in fact a remote server where nobody sits and so not in use. I manage it and didn't have to look at the screen for days, and now I am logging in every hour

 

 

 

 

[Porthos]

4 minutes ago, Arijit said:

This is in fact a remote server where nobody sits and so not in use. I manage it and didn't have to look at the screen for days, and now I am logging in every hour

Does this system run a server OS?

[Arijit]

Yes Windows 2012 R2

[lgkahn]

mine is not it is running windows 10 pro

[Porthos]

13 minutes ago, Arijit said:

Is there a way I can downgrade to a previous all working'version?

 

Just now, Arijit said:

Yes Windows 2012 R2

The consumer version of Malwarebytes is not supported on any server OS even if seems to work correctly even in the past.

Now with that being said...

You also have the option of reverting to an earlier component package version, which will allow you to keep Web Protection enabled.
You can download this from here: https://malwarebytes.box.com/s/z6cravnwptrzx5tyjw36jq6zt6c7apsx

Once installed, you will need to disable the two update options found in Settings -> General -> Application updates to prevent the product from updating back to the affected version.

I suggest using the following clean install guide.

Please do the following Uninstall and reinstall using the Malwarebytes Support Tool

Please have lots of patience with the tool.  The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up.   Please be patient and have faith.  Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install. Say no and use the download from my above link and install the old version and disable the update before you do anything else.

 Let me know if that clears up the issue or not.

[Porthos]

1 minute ago, lgkahn said:

mine is not it is running windows 10 pro

You either need to turn off web protection or use the instructions I posted for the other user and revert to the old version.

[lgkahn]

how will we know when it is fixed if we put an older version. in addition, i assume then we will not be download any definition updates? or is it ok to still get definition updates.. as i said i am not on server.

[Porthos]

1 minute ago, lgkahn said:

how will we know when it is fixed if we put an older version. in addition, i assume then we will not be download any definition updates? or is it ok to still get definition updates.. as i said i am not on server.

You still get definition updates. You will have to monitor these forums to see if the future versions fix the issue.

[Arijit]

5 minutes ago, Porthos said:

The consumer version of Malwarebytes is not supported on any server OS even if seems to work correctly even in the past.

As you correctly said, I too have seen Malwarebytes working [perfectly in windows 2003, 2008, 2012, R2, 2016, 2019 all servers. So I have had a perfect experience till April 22. In fact in my other installations of windows 2012 R2 and windows 2008 R2 they are working fine. So unless it is violation of license agreements or something I am happy with what I am getting

8 minutes ago, Porthos said:

You also have the option of reverting to an earlier component package version, which will allow you to keep Web Protection enabled.

Now, as I said since this is 'server' is not being used as a 'desktop workstation', is web protection really necessary at this stage when issues are there

Which one is better -
1) Go back to previous version with web protection on (even through I am not using any browsers on the machine)

2) Stay updated with current stable version, web protection off

3) Beta with web-protection off

[Porthos]

Just now, Arijit said:

2) Stay updated with current stable version, web protection off

3) Beta with web-protection off

I personally if I were in your shoes, I would just keep the beta with Web Protection off because the the beta will release as GA soon anyway. Just turn the beta setting off until there is a confirmed working fix.

3 minutes ago, Arijit said:

So unless it is violation of license agreements or something

Staff will need to answer that question. I have not read the current agreement lately. Also I have no clients on any servers to worry about it personally.

[exile360]

Just FYI, I'm not aware of any issues with the EULA and running the software on Windows Server, at least as long as it is only being used to protect that specific device/OS and not being used as some sort of protection for any other systems or virtual operating systems which might be connected to/running on the device (which wouldn't really work anyway since Malwarebytes' protection only monitors the current system/OS where it is installed/running).  As far as it being unsupported, that of course is true so there could be any number of issues running it in that environment, however I don't believe they test it at all so I don't know and it seems more likely to me that this issue is simply down to whatever is causing it on other supported Windows versions.

[lgkahn]

Any update on a new version that fixes this

[exile360]

Greetings,

While I am not aware of this specific issue being addressed, it is worth ensuring that you have the latest version installed to benefit from any recent changes and bugfixes which have been implemented.  To do so, open Malwarebytes and navigate to settings by clicking the gear icon in the upper right then select the About tab and click the Check for updates link and allow it to install any updates then restart your system.

[lgkahn]

THATS counter intuitive.. if you read the thread it was recommended to install the older version that does not have this bug.. i was told to check in here to see if it was fixed.