Jump to content

BSOD during custom scan of a whole PC


Recommended Posts

As in title. During custom scan of my whole PC, with all options of scanning enabled, I get blue screen and the whole computer needs to be restarted. The crash happens during the "scanning file system" phase. Translation of the blue screen message is as following (attachment):

 

"Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you.

25% complete

For more information about this issue and possible fixes, visit: http://www.windows.com/stopcode

If you call a support person, give them this info:

Stop code: UNEXPECTED_STORE_EXCEPTION"

 

I have windows 10, with all updated installed, except two optional updates (Intel-system updates), however, the blue screen already occured before these optional updates were available.

I also have G DATA Internet Security antivirus, although I did add Malwarebytes to its exceptions (as advised on Malwarebytes support page: Malwarebytes for Windows antivirus exclusions list – Malwarebytes Support).

BSOD occurs ONLY during Malwarebytes scan - I've never had any blue screens, crashes or other problems with my PC.

BSOD.jpg

Link to post
Share on other sites

  • Staff

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

  • For use when you are on the forums and need to provide logs for assistance
  • For use when you don't need or want to create a ticket with Malwarebytes
  • For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler
  1. Download Malwarebytes Support Tool
  2. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  3. Place a checkmark next to Accept License Agreement and click Next
  4. Navigate to the Advanced tab
  5. The Advanced menu page contains four categories:
    • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
    • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
    •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
    • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
  6. To provide logs for review click the Gather Logs button
  7. Upon completion, click OK
  8. A file named mbst-grab-results.zip will be saved to your Desktop
  9. Please attach the file in your next reply.
  10. To uninstall all Malwarebytes Products, click the Clean button.
  11. Click the Yes button to proceed. 
  12. Save all your work and click OK when you are ready to reboot.
  13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
  14. Select Yes to install Malwarebytes.
  15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler
 
 
 
 
Spoiler

 

 

01.png

02.png

03.png

04.png

05.png

06.png

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Link to post
Share on other sites

Funny, you did answer your own question; You are using more then one AV on your system... By now you should now that installing more then one AV is an actively bad solution. Yes it always can be fixed temporarily by adding excludes is both MWB and G-data. Until someone do an big update and hence your problem starts over again... There is only one good solution for this type of problems... Or you choose to use G-data without windows AV and MWB, or you use MWB together with windows AV; The only good solution that works flawlessly together!

Reads this topic from Kaspersky AV why it is an bad idea, this counts for ALL other AV on the market;  https://www.kaspersky.com/resource-center/preemptive-safety/running-more-than-one-antivirus-program

Link to post
Share on other sites

Uninstall G-data and let MWB do its job for some days, or uninstall MWB and do the same for G-data; No problems anymore? There you have it, problem is fixed!

As i said Windows, G-data and MWB constantly updates the program with can change the way the AV work. Sooner or later you will face the same problem again.

Link to post
Share on other sites

  • Staff

Thanks, the logs still show G DATA installed, though that might be because you reinstalled it already.  I also noticed that Malwarebytes is installed on S:\ rather than the default C:\; while this shouldn't make a difference, it might in this case so please try the following to see if it makes any difference:

  1. Run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here and allow it to install to the default location then test to see if it still crashes or not

If the issue still persists, configure Windows to create a full memory dump on system crash. Instructions on how to do so can be found here if needed.  Once that is done, replicate the crash then upload the file to WeTransfer.com, selecting the option to send the file as a link and post the link here for analysis.

Please let us know how it goes.

Thanks

Link to post
Share on other sites

Blue screen crash happened again, although the Stop Code was different (critical process died). Also, I noticed that the crash seems to happen at random time (i.e. sometimes it happens after an hour of scanning, and sometimes after three hours). 

Now, by "full memory dump" you mean "complete memory dump"? Also, by "replicating the crash" I assume you mean to start the scan again to get another crash? Then, where can I find this crash dump file? 

Link to post
Share on other sites

  • Staff

Yes, a complete memory dump (it should be created automatically when the system crashes) as detailed in the link I provided above, which also explains that it is created in the root of C:\Windows and will be named MEMORY.DMP by default; you may need to copy the file to your desktop in order to ZIP it an upload it to WeTransfer since permissions in the Windows folder are restricted.

Link to post
Share on other sites

Any other way to send the dump file? Compressed in RAR, it has 4,5 GB.

13 hours ago, exile360 said:

By the way, does this issue occur with the default scan as well, or does it only happen during a full scan?

Honestly, I don't know. Apart from custom scan, I only scanned drive E, and it didn't crash.

Link to post
Share on other sites

  • Staff

Great, thanks.  If you would, please try the default Threat scan to see if it crashes when doing so.  To do so, open Malwarebytes and click on the Scan button on the bottom of the main dashboard.

I would also suggest running check disk on the drive(s) where you believe the crash occurs, assuming you can narrow it down to a specific drive.  I'd recommend trying to scan each drive individually to see if the crash still occurs similar to when you scanned drive E to try and determine if the issue occurs due to scanning a specific disk or not.  To do so, you can right-click on the drive you want to scan and then select Scan with Malwarebytes from Windows Explorer.  Do this for drive S and drive D and if both of those scans complete without issues, try the same for drive C and let us know if it crashes when scanning any of those drives in particular.

Thanks

Link to post
Share on other sites

  • Staff

To check the drives for errors using Check Disk, open Computer in Explorer and right-click on the drive you want to check and select Properties, then select the Tools tab and click the Check button under Error checking as illustrated below:

check.png.e794211b044d0629039aa2e4f2bb5afe.png

You'll then see a pop-up window where you should click on Scan drive and the drive will be checked for errors and will notify you once it completes.  You'll be able to view the details of the report by clicking the Show Details link as shown below:

details.png.f39bd1fbf98501e3f4d67436df89045a.png

Windows should then launch Event Viewer to show the details of the disk check and whether or not any errors were found and fixed.  If the drive can't be scanned or fixed with Windows running, you will be prompted to have check disk run the next time the system starts.  Allow it to do so and restart the system and wait for it to check the drive after which the system will restart automatically and start normally.

Link to post
Share on other sites

I managed to pinpoint that the crash happens only during the custom scan of whole PC, but with the rootkits option enabled. When I disabled the rootkit scan, there was no crash. I also scanned each drive separately, and everything was fine. Another peculiarity was that the custom scan of all drives with rootkits disabled lasts 18 minutes. However, with the rootkit option enabled it lasts over 5 hours, and eventually crashes (even though the rootkit scan itself lasts only for a few seconds). To me it doesn't make much sense, but I'd be glad to hear some enlightenment.

Link to post
Share on other sites

14 minutes ago, XCUT said:

but I'd be glad to hear some enlightenment.

I would try just a threat scan with rootkit enabled. Doing a full scan of ANY type is unneeded.

Malwarebytes is not designed to function like normal AV scanners and uses a new kind of scan engine that relies mostly on heuristics detection techniques rather than traditional threat signatures.  Malwarebytes is also designed to look in all the locations where malware is known to install itself/hide, so a full or custom scan shouldn't be necessary, especially on any sort of frequent basis (like daily), especially since the default Threat Scan/Quick Scan checks all loading points/startup locations, the registry, all running processes and threads in memory, along with all system folders, program folders and data folders as well as any installed browsers, caches and temp locations.  This also means that if a threat were active from a non-standard location, because Malwarebytes checks all threads and processes in memory, it should still be detected.  The only threat it *might* miss would be a dormant/inactive threat that is not actively running/installed on a secondary drive, however if the threat were executed then Malwarebytes should detect it.  Additionally, whenever a new location is discovered to be used by malware the Malwarebytes Research team adds that location dynamically to the outgoing database updates so the locations that are checked by the default Threat/Quick Scan in Malwarebytes can be changed on the fly by Research without requiring any engine or program version updates/upgrades.

Link to post
Share on other sites

I wouldn't like to sound impolite, but this one is a copy-paste text I've seen on Malwarebytes forums before. Maybe I'm being obtuse, but I still don't understand why the custom scan with rootkits scan option enabled crashes my PC and takes hours to do the scanning.

By the way, by "threat scan" do you mean the default scan that is available that the main menu of Malwarebytes? If so, I did this scan (with rootkit option) - no crash, and lasted only several minutes.

Link to post
Share on other sites

1 minute ago, XCUT said:

but this one is a copy-paste text I've seen on Malwarebytes forums before.

It bears repeating.

1 minute ago, XCUT said:

but I still don't understand why the custom scan with rootkits scan option enabled crashes my PC and takes hours to do the scanning.

It is a long and very intensive scan and extremely stresses the computer especially the CPU. The more files and the size of drive including type of drive the worse it is.

Here is another canned speech to think about.

Malwarebytes does not target script files during a scan.. That means MB will not target; JS, HTML, VBS, .CLASS, SWF, BAT, CMD, PDF, PHP, etc.

It also does not target documents such as; PDF, DOC, DOCx, XLS, XLSx, PPT, PPS, ODF, etc.

It also does not target media files;  MP3, WMV, JPG, GIF, etc.

Malwarebytes will detect files like these on execution only with the anti-exploit module of the paid program.

Link to post
Share on other sites

  • Staff
1 hour ago, XCUT said:

I managed to pinpoint that the crash happens only during the custom scan of whole PC, but with the rootkits option enabled. When I disabled the rootkit scan, there was no crash. I also scanned each drive separately, and everything was fine. Another peculiarity was that the custom scan of all drives with rootkits disabled lasts 18 minutes. However, with the rootkit option enabled it lasts over 5 hours, and eventually crashes (even though the rootkit scan itself lasts only for a few seconds). To me it doesn't make much sense, but I'd be glad to hear some enlightenment.

Thanks, that definitely helps to narrow down the issue.  When rootkit scanning is enabled, in addition to the items that are analyzed during the rootkit specific portion of the scan at the beginning, rootkit scanning also modifies the way many other files are scanned throughout the rest of the scan.  That's why it's having an impact on your scan times when scanning other drives and likely also why the crash is occurring (though obviously it shouldn't be crashing).

I'll be sure to note this additional info for the Developers.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.