System Service Exception

[Nikilet]

I have been getting a BSOD on a regular basis ever since Dell remotely worked on my machine to fix their Dell Support Assist app. 

I went to the Windows 10 forum and they had me run a tool, after which they said this: The 6/26 dump shows a problem with mwac.sys which belongs to malwarebytes MBAMWebProtection. If you would like to check out that post this is the link for it: https://www.tenforums.com/bsod-crashes-debugging/159460-system-service-exception.html#post1951916

I had a lot of trouble with both my Malwarebytes and Emsisoft programs after Dell techs accessed my machine. I thought I finally had everything worked out and both programs seem to be working now, but I've got this BSOD that keeps popping up, and I am also having a continuous WiFi connection problem that also started about the same time as the rest of this.

SysnativeFileCollectionApp.zip

Edited June 28, 2020 by Nikilet

[Porthos]

Does it stop if you disable web protection??

[Nikilet]

That doesn't seem to be something that's workable. It's not like it's a continuous thing. I would have to leave web protection off for quite some time in order to have any assurance that is the problem. Isn't there any other way of checking this out? I thought perhaps that folder I was asked to attach would tell something about what's causing this.

[Porthos]

Please get the logs from the MB support tool as well.

Can you please follow the directions from the following KB article and post back your logs so that we can review

Upload Malwarebytes Support Tool logs manually

[Nikilet]

Here are the logs you asked for.

mbst-grab-results.zip

[Porthos]

Since mwac.sys belongs to web protection I would add that to exclusions in Emisoft.

I would find the exe's to the following programs and add them to "applications that connect to the internet" section of the allow list as well.

Quote

Exclusion Info:
==================================
Malware Exclusions:
C:\ProgramData\Emsisoft                                                                                 [folder]
C:\Program Files\Emsisoft Anti-Malware                                                                  [folder]
C:\Program Files\Dell\SupportAssistAgent                                                                [folder]
C:\ProgramData\Dell Inc                                                                                 [folder]
C:\ProgramData\SupportAssist                                                                            [folder]

Ransomware Exclusions:
C:\ProgramData\Emsisoft                                                                                 [folder]
C:\Program Files\Emsisoft Anti-Malware                                                                  [folder]
C:\Program Files\Dell\SupportAssistAgent                                                                [folder]
C:\ProgramData\Dell Inc                                                                                 [folder]
C:\ProgramData\SupportAssist                                                                            [folder]

 

If you have not already, Add the following files/folders to Emisoft's exclusion lists as well.

Quote

C:\Windows\System32\drivers\mbae64.sys
C:\Windows\System32\drivers\mbam.sys

C:\Windows\System32\drivers\MbamElam.sys
C:\Windows\System32\drivers\MBAMChameleon.sys
C:\Windows\System32\drivers\MBAMSwissArmy.sys
C:\Windows\system32\Drivers\farflt.sys

C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe

C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe

C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe

C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe

C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe

C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

Folders
Also the MB folder in Program Files and the one in Program Data (it is hidden by default)

C:\Program Files\Malwarebytes
C:\ProgramData\Malwarebytes   (Enable hidden files to add this one.)

 

[Nikilet]

6 hours ago, Porthos said:

Since mwac.sys belongs to web protection I would add that to exclusions in Emisoft.

I would find the exe's to the following programs and add them to "applications that connect to the internet" section of the allow list as well.

If you have not already, Add the following files/folders to Emisoft's exclusion lists as well.

 

I'm confused. In the first set, you list Malware Exclusions and then the very same items under Ransonware Exclusions. Then, are you telling me to add those folders, or find exe files for each of them and add ... or both? Where/how do I view a complete listing of any files or folders that have been allowed or excluded in MBAM?

 

 

[Porthos]

30 minutes ago, Nikilet said:

Where/how do I view a complete listing of any files or folders that have been allowed or excluded in MBAM?

Settings- allow list. The same place where you added the ones you have now.

I am just trying to rule out any conflict with Emisoft.

 

[GT500]

There is currently a known BSoD issue caused by Malwarbytes' Web Protection when it's installed alongside Emsisoft Anti-Malware (EAM). @AdvancedSetup may know more.

A workaround for anyone who has this issue is to do the following:

1. Right-click on the little Emsisoft icon in the lower-right corner of the screen (to the left of the clock).
2. Go to Protection status.
3. Select Disable Web Protection.

Note that after doing this you will need to restart the computer. On Windows 8.1 and Windows 10 you will need to restart by right-clicking on the Start button, going to Shut down or sign out, and selecting Restart from this menu to bypass Fast Startup.

Edited June 29, 2020 by GT500

[AdvancedSetup]

We are reviewing logs to see if there is something we can do on our end. Basically anyone using certain features of the Windows Filtering Platform (WFP) can run into possible conflicts. As both products are attempting to do the same thing.

Thank you

 

[Nikilet]

I don't even know what Windows Filtering Platform is.

[Porthos]

15 minutes ago, Nikilet said:

I don't even know what Windows Filtering Platform is.

That is the protocol of Windows Firewall built into Windows and many programs use it.

Edited June 29, 2020 by Porthos

[exile360]

The following links explain what the WFP APIs are and how it is used in applications as well as some info on how Web Protection in Malwarebytes works:

About Windows Filtering Platform
Windows Filtering Platform
About Windows Filtering Platform From Wikipedia
Understanding the Windows Filtering Platform

Malwarebytes Web Protection Module

I hope this helps, and please let us know if you have any further questions or issues.

Thanks

Edited June 29, 2020 by exile360