Jump to content

[ RESOLVED ] BSOD after upgrade to 2004 and reinstall of Malwarebytes


Go to solution Solved by Maurice Naggar,

Recommended Posts

After upgrading three somewhat different Windows 10 Pro installations to 2004 from 1909 and reinstalling Malwarebytes, I get a blue screen (x7f, p1 = 08 ) on one of the desktops a few minutes after rebooting on every other boot (it is stable following rebooting from the BSOD, but one more boot and lights out). The problem goes away if I take Malwarebytes off, so I'm rather sure it is involved in the crash. For other security software, I also have McAfee LiveSafe on all computers, but the one that crashes has a broader mix of old to new software than the other two, which have been stable following the 2004 upgrade. For a while it looked like an interaction with the Nvidia GeForce driver, which is unique to the problem desktop--before the BSOD started, the Nvidia driver would stop and be automatically restarted several times, and when I upgraded the driver to the latest version (it was one update back), the BSOD started. Prior to this upgrade, the desktop in question had been stable and all hardware diagnostics (Dell) pass currently.

Does anyone have thoughts about the interactions that may lead to this BSOD? I'm not interested in installing a clean copy of Windows given that there is too much software for which getting the licensing information would be a real pain, but if I could find a way to get Malwarebytes to run successfully without a huge effort, it would be worthwhile.

Link to post
Share on other sites

  • Staff

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

  • For use when you are on the forums and need to provide logs for assistance
  • For use when you don't need or want to create a ticket with Malwarebytes
  • For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler
  1. Download Malwarebytes Support Tool
  2. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  3. Place a checkmark next to Accept License Agreement and click Next
  4. Navigate to the Advanced tab
  5. The Advanced menu page contains four categories:
    • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
    • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
    •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
    • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
  6. To provide logs for review click the Gather Logs button
  7. Upon completion, click OK
  8. A file named mbst-grab-results.zip will be saved to your Desktop
  9. Please attach the file in your next reply.
  10. To uninstall all Malwarebytes Products, click the Clean button.
  11. Click the Yes button to proceed. 
  12. Save all your work and click OK when you are ready to reboot.
  13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
  14. Select Yes to install Malwarebytes.
  15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler
 
 
 
 
Spoiler

 

 

01.png

02.png

03.png

04.png

05.png

06.png

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Link to post
Share on other sites

35 minutes ago, EShearin said:

but if I could find a way to get Malwarebytes to run successfully without a huge effort, it would be worthwhile.

Can you please collect and upload as an attachment the diagnostic data using our MBST?

  • Download and run the Malwarebytes Support Tool
  • Accept the EULA and click Advanced tab on the left (not Start Repair)
  • Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
Link to post
Share on other sites

Here is the zip file generated by MBST. At the point of running it, the system was several reboots past the blue screen and with Malwarebytes removed. 
Thanks for any insights or suggestions you have. All of this software was playing well together before the 2004 upgrade, so removal and reinstallation of both McAfee LiveSafe and Malwarebytes may have changed things, especially since the McAfee installation had to be redone after not completing before I moved on to the Malwarebytes reinstallation. 

  Ed

mbst-grab-results.zip

Link to post
Share on other sites

Hello @EShearin   Thanks for the support-tool report.  It shows that Malwarebytes for Windows is not currently installed.  That the resident antivirus is McAfee LiveSafe  Version: 16.0 R29 

My initial questions, Did this system ever have another brand-name of antivirus ?  Like maybe Norton Symantec or AVG or Avast  another ?

By the way, wait for my guidance before you consider any other re-install of Malwarebytes.   We will take some extra measures.

This here is part 1.

  1. We will use the Malwarebytes support tool you already have.
  2. In the Downloads folder, open the mb-support-x.x.x.xxx.exe file.
  3. In the User Account Control pop-up window, click Yes to continue .
  4. In the Malwarebytes Software License Agreement pop-up window, check the box ( mceclip0.png ) next to Accept License Agreement after consenting to the agreement terms.
  5. Click Next to complete the installation. The Malwarebytes Support Tool automatically opens.
  6. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
  7. In the Advanced Options, click Clean.
  8. In the Malwarebytes Cleanup pop-up window, click Yes. A pop-up window indicating the loading of the cleanup appears. Before the next step, make  sure all your work is saved in the background.
  9. In the Malwarebytes Cleanup pop-up window, click OK to restart your computer. Have Lots of patience.  It may take several minutes for the GUI screen to show up.
  10. Once your computer restarts, in the User access control pop-up window, click Yes. A pop-up window appears indicating a Post reboot cleanup.
  11. In the Reinstall Malwarebytes for Windows pop-up window, click   NO
  12. Stop after that point   & let me know.
Link to post
Share on other sites

In answer to your question about another antivirus, until this last upgrade cycle, this system has always had McAfee, which came installed from Dell. I reinstalled McAfee at least once over the years, and also there was an intervention from McAfee support to switch the installation account over to the one I had on several other household computers. All of this was while running Windows 7, which was the original Dell installation in lieu of the optional Windows 8 that I did not want. I upgraded the OS last December to Windows 10 1903 without incident and then to 1909 last spring. The upgrade this month to 2004 didn't go as well with a bug check during the failed installation that the Microsoft feedback indicated is commonly attributed to the antivirus. I then uninstalled both McAfee and Malwarebytes, had an uneventful upgrade to 2004, and put McAfee and Malwarebytes back on. All seemed well until a day later when I noticed that the Nvidia display driver had to be restarted several times, starting interesting 12 hours after I had done a last reboot of the new configuration. After updating the display driver to the latest version several days after the problem appeared, the blue screens started after the second reboot. I rolled back to the 1909 version, ran for several days just using Windows Defender by default, and then after updating the display driver, upgraded to 2004 again. This was uneventful for a couple of days, so I added McAfee in yesterday, which initially resulted in a failed installation (the message indicated that it couldn't start the security service). At the suggestion of the automatic feedback, I reran the McAfee installation with the McAfee Install Helper, which appeared to do some sort of cleanup before making a successful install. That cleanup did create some chronic Schannel errors that I've been getting every since, but which don't seem to be a serious problem, so those can wait for a later date. I then put Malwarebyes on with the resumption of the blue screens after I booted a time or two. Thus, Windows Defender was the default interim antivirus after the rollback and then during this last 2004 burn in period before yesterday.

I've run the clean operation, which went very quickly. In case you want the log that was produced, it is attached. Thanks for your suggestions, and I'll wait for your thoughts before trying another installation of Malwarebytes.

  Ed

mbst-clean-results.txt

Link to post
Share on other sites

Thanks.  I just wonder if the last install of McAfee was thru their very latest version ?   Having the latest McAfee version is very important.

The video driver for Nvidia is one key aspect of this situation.  You must make real sure that the driver is the latest release version.

Please double check with your computer maker to see about the video driver.

At this point, I would like to see that you do a Windows System File Checker run  & lets see about the result.

Open an elevated command prompt window i.e. run Command Prompt as an administrator .

It is best to use the Windows Copy ( CTRL+ C )  and paste  ( CTRL+V )  for the whole line, as-is

To Get the elevated command prompt, press Windows-key + X key  and then selected Command prompt ( Admin )

On that command prompt,  Copy & Paste this command

sfc /scannow

and tap Enter-key to proceed.  I need to know the bottom line results.

Then, next, again with the command-prompt, Copy & Paste this command

 

DISM /Online /Cleanup-Image /ScanHealth

and tap Enter-key to proceed.  I need to know the bottom line results.

I'd like to know these results before we do other steps.

Link to post
Share on other sites

All the McAfee files (helper, installation file) were downloaded yesterday from their website, so something was out of date only if that's what they were pushing out. I've compared the version numbers of the three McAfee installations I have and all components are identical (the other two installations were done on 12/20/20 and updated every few hours). The only oddity is that there is an entry in the About info for the McAfee web advisor on my problem computer, but not on the others. I don't use it in any of the browsers on any of the machines, so it's odd that it would show on the problem one alone. The data for that are also different--rather than build, version, and update date among other entries for each component, the web advisor just has "Affld: 105".  I would agree that the McAfee on this computer has shown more interference problems than the others, but the why of that might be part of the question.

  Ed

Link to post
Share on other sites

Will run the check steps and post in a few minutes. The Nvidia Geforce driver that is installed comes directly from their website and is the latest--460,89 release 12/15/20. The release notes haven't indicated any Windows 10 problems since last summer when 2004 conflicted with much older (3xx.xx series) drivers. Supposedly, that was fixed in August.

In checking version numbers for the other McAfee installations, I did observe the first display driver stop and restart that I've seen on this version. That was with two remote sessions going plus a variety of other windows open, whereas the earlier problems were when the computer was unattended (but not unused--I run BOINC routines in the background so the GPU is constantly getting a heavy workout when the console is unused).

Link to post
Share on other sites

Results for the system scan:

Windows Resource Protection did not find any integrity violations.

For the deployment image:

Deployment Image Servicing and Management tool
Version: 10.0.19041.572

Image Version: 10.0.19041.685

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

 

So nothing appears bad on the scans.

The one display event (4101) I mentioned in the last post is the only instance in the log since the 2004 update and came with the message:

Display driver nvlddmkm stopped responding and has successfully recovered.

  Ed

Link to post
Share on other sites

NOTE:
For the duration, could you suppress any un-needed background tasks that are not a absolute must, like any BOINC.  Review all scheduled tasks, all auto-started tasks so that only the barebones absolute must -haves are on.  Lets do that until we resolve the situation.
How to perform a clean boot in Windows
https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows
.

Next actions.
The results of SFC & DISM checks are good.  Your OS version is 64-bit build 2004.  Lets get and apply the enablement package from Microsoft with the goal to get it situated to be able to have the version 20H2.  I suggest to save the download to your Desktop.
Download and save this .msu file   http://b1.download.windowsupdate.com/c/upgr/2020/12/windows10.0-kb4562830-x64_93a5c65488affb6e73a0a48ad6a58d8bc1713fd7.msu

Once download is fully completed, close the browser.  Go to the Desktop and that file.  Do a RIGHT-click and select OPEN  and let it proceed.
Have patience.   When all done, go to the RUN option ( Windows-key +R key) and enter

winver


Let me know the full Version and build numbers and info.

Edited by Maurice Naggar
Link to post
Share on other sites

That is good news.  It is great that the OS is the latest build.   Next, this tool will do some lookups on versions of selected apps. 

I would like you to run a tool named SecurityCheck to inquire on the current-security-update  status  of some applications.

  • Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
  • and save the tool on the desktop.
  • If Windows's  SmartScreen block that with a message-window, then
  • Click on the MORE INFO spot and over-ride that and allow it to proceed.
  • This tool is safe.   Smartscreen is overly sensitive.
  • Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
  • Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
  • You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt
Link to post
Share on other sites

  • Solution

Thanks for the report. You should consider uninstalling Chrome Remote Desktop Host v.88.0.4324.33 .  That is flagged as a potential spy tool.
The Adobe Shockwave Player 12.3 v.12.3.4.204  should be uninstalled. 
I notice the Nvidia driver was not flagged as out of date, so that is a good thing.
I think we are at a point where we can do a new installation of Malwarebytes for Windows. I'd like you to use the full offline installer to do that  and then do some adjustments.
I'd suggest you save the download to the Desktop for ease of access.
1. Download the offline installer from : https://downloads.malwarebytes.com/file/mb4_offline
2. Now, go to the Desktop.     Right-click on the exe and select Run as Administrator and allow it to go forward.
3. After the Malwarebytes for Windows is done with the setup.
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center 
Click the Security Tab. Scroll down to 
"Windows Security Center"
Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".

all the way to the Left for Off setting.
Close Malwarebytes when done.
Following that, see if you can adjust "trust settings" in the McAfee Livesafe software so that it trusts the Malwarebytes application.  See the tips in this support article https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list
 

 

Link to post
Share on other sites

I uninstalled the two programs you suggested and will give the Malwarebytes reinstall and adjustments a try. Given that this blue screen always occurred on the boot after the installation, it should be quick to see if the problem has been solved. On a probably unrelated note, I tracked the display restarts (hopefully all of them) to a BOINC program that apparently doesn't always play well with the older Nvidia hardware and removed it from the mix of different science applications that I run under that umbrella. Given the frequency of when I've seen that issue, that fix could be the last word for that.

Update to come.

  Ed

Link to post
Share on other sites

I think the problem is likely solved, but it appears it may have been a race condition between McAfee, Malwarebytes, BOINC, and who knows what else that led to the blue screens. All went well through several boots after reinstalling Malwarebytes along with your suggested accommodations in McAfee LiveSafe (the program can only exclude files, so I just did the Malwarebytes driver ones and didn't try for the program or data directories). Feeling adventurous, I added all the services and startups back in and went on a reboot cycle to see if something in that mix would produce the problem again. Right on schedule, it did, so I started pulling things off, figuring that pointed to a startup timing issue (would always occur about 3 minutes after the boot) that led to something tripping over something. BOINC with its possible use of 100% background CPU was the most obvious candidate, but there was an Intel delayed launcher that would start in the same time frame, so I pulled both, cycled boot enough to be sure things were OK, added the Intel launcher back, and cycled several times with no problems. At this moment, I'm not curious enough to add BOINC back to the startup to see if the problem returns--it's easy enough to start it manually after the boot and if I get tired of that, I can always schedule it for several minutes out. The scientist in me doesn't want to take it off a system that can make a useful contribution to various research efforts I value.

The who knows what else bit is definitely there since McAfee, Malwarebytes, and BOINC get along perfectly well on another of my Dell desktops that differs mainly in less other software and the generic Intel display adapter. In another career, I used to write and debug real time communications software (PDP-11 days-simpler software), which gave me some appreciation of how tricky timing issues can be--given that I'm not selling this system combination to someone for their production use, I can live with the thought that some things aren't worth solving.

Thanks so much, Maurice, for your very helpful suggestions and guidance in getting Malwarebytes back into the system! That was the primary aim and it is a complete success.

  Ed

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.