Jump to content
Nikilet

System Service Exception

Recommended Posts

Posted (edited)

I have been getting a BSOD on a regular basis ever since Dell remotely worked on my machine to fix their Dell Support Assist app. 

I went to the Windows 10 forum and they had me run a tool, after which they said this: The 6/26 dump shows a problem with mwac.sys which belongs to malwarebytes MBAMWebProtection. If you would like to check out that post this is the link for it: https://www.tenforums.com/bsod-crashes-debugging/159460-system-service-exception.html#post1951916

I had a lot of trouble with both my Malwarebytes and Emsisoft programs after Dell techs accessed my machine. I thought I finally had everything worked out and both programs seem to be working now, but I've got this BSOD that keeps popping up, and I am also having a continuous WiFi connection problem that also started about the same time as the rest of this.

SysnativeFileCollectionApp.zip

BSOD.JPG

Edited by Nikilet

Share this post


Link to post
Share on other sites

Does it stop if you disable web protection??

Share this post


Link to post
Share on other sites

That doesn't seem to be something that's workable. It's not like it's a continuous thing. I would have to leave web protection off for quite some time in order to have any assurance that is the problem. Isn't there any other way of checking this out? I thought perhaps that folder I was asked to attach would tell something about what's causing this.

Share this post


Link to post
Share on other sites

Since mwac.sys belongs to web protection I would add that to exclusions in Emisoft.

I would find the exe's to the following programs and add them to "applications that connect to the internet" section of the allow list as well.

Quote

Exclusion Info:
==================================
Malware Exclusions:
C:\ProgramData\Emsisoft                                                                                 [folder]
C:\Program Files\Emsisoft Anti-Malware                                                                  [folder]
C:\Program Files\Dell\SupportAssistAgent                                                                [folder]
C:\ProgramData\Dell Inc                                                                                 [folder]
C:\ProgramData\SupportAssist                                                                            [folder]

Ransomware Exclusions:
C:\ProgramData\Emsisoft                                                                                 [folder]
C:\Program Files\Emsisoft Anti-Malware                                                                  [folder]
C:\Program Files\Dell\SupportAssistAgent                                                                [folder]
C:\ProgramData\Dell Inc                                                                                 [folder]
C:\ProgramData\SupportAssist                                                                            [folder]

 

If you have not already, Add the following files/folders to Emisoft's exclusion lists as well.

Quote

C:\Windows\System32\drivers\mbae64.sys
C:\Windows\System32\drivers\mbam.sys

C:\Windows\System32\drivers\MbamElam.sys
C:\Windows\System32\drivers\MBAMChameleon.sys
C:\Windows\System32\drivers\MBAMSwissArmy.sys
C:\Windows\system32\Drivers\farflt.sys

C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe

C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe

C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe

C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe

C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe

C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

Folders
Also the MB folder in Program Files and the one in Program Data (it is hidden by default)

C:\Program Files\Malwarebytes
C:\ProgramData\Malwarebytes   (Enable hidden files to add this one.)

 

Share this post


Link to post
Share on other sites
6 hours ago, Porthos said:

Since mwac.sys belongs to web protection I would add that to exclusions in Emisoft.

I would find the exe's to the following programs and add them to "applications that connect to the internet" section of the allow list as well.

If you have not already, Add the following files/folders to Emisoft's exclusion lists as well.

 

I'm confused. In the first set, you list Malware Exclusions and then the very same items under Ransonware Exclusions. Then, are you telling me to add those folders, or find exe files for each of them and add ... or both? Where/how do I view a complete listing of any files or folders that have been allowed or excluded in MBAM?

 

 

Share this post


Link to post
Share on other sites
30 minutes ago, Nikilet said:

Where/how do I view a complete listing of any files or folders that have been allowed or excluded in MBAM?

Settings- allow list. The same place where you added the ones you have now.

I am just trying to rule out any conflict with Emisoft.

 

Share this post


Link to post
Share on other sites
Posted (edited)

There is currently a known BSoD issue caused by Malwarbytes' Web Protection when it's installed alongside Emsisoft Anti-Malware (EAM). @AdvancedSetup may know more.

A workaround for anyone who has this issue is to do the following:

  1. Right-click on the little Emsisoft icon in the lower-right corner of the screen (to the left of the clock).
  2. Go to Protection status.
  3. Select Disable Web Protection.

Note that after doing this you will need to restart the computer. On Windows 8.1 and Windows 10 you will need to restart by right-clicking on the Start button, going to Shut down or sign out, and selecting Restart from this menu to bypass Fast Startup.

Edited by GT500

Share this post


Link to post
Share on other sites

We are reviewing logs to see if there is something we can do on our end. Basically anyone using certain features of the Windows Filtering Platform (WFP) can run into possible conflicts. As both products are attempting to do the same thing.

Thank you

 

Share this post


Link to post
Share on other sites

I don't even know what Windows Filtering Platform is.

Share this post


Link to post
Share on other sites
Posted (edited)
15 minutes ago, Nikilet said:

I don't even know what Windows Filtering Platform is.

That is the protocol of Windows Firewall built into Windows and many programs use it.

Edited by Porthos

Share this post


Link to post
Share on other sites
Posted (edited)

The following links explain what the WFP APIs are and how it is used in applications as well as some info on how Web Protection in Malwarebytes works:

About Windows Filtering Platform
Windows Filtering Platform
About Windows Filtering Platform From Wikipedia
Understanding the Windows Filtering Platform

Malwarebytes Web Protection Module

I hope this helps, and please let us know if you have any further questions or issues.

Thanks

Edited by exile360

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.