8 replies to this topic

[Leafs4Life]

Bacckground
========
I dumped all my cache then got the most recent updates for MBAM (free v1.36). I then opened MBAM and when I tried to run a full system scan, the computer crashed and restarted. I logged back in and received a "serious error" message which stated a driver or device problem. I noted that it included a minidump file (text included below). I had that file reviewed and it appears to be related to MBAM.

Current operating system is XP SP3, Avast (free), SAS (free), SpywareBlaster (free) and IE8. The last MBAM full scan I actually ran was just before Microsoft Patch Tuesday and there were no issues. I also use it to scan incoming files as I receive them, so the most recent MBAM scan of an individual file was earlier today, again, no problem. It may be related to the most recent updated definitions. I have since been able to run a full scan with no issues.

Here is the text from the Minidump file that I was advised to post here for your follow-up. If you need to see the file itself, please advise and I will attach it. Thanks in advance.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e2fbd008, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: ee6a7e8a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------

Could not read faulting driver name
Probably caused by : mbamswissarmy.sys ( mbamswissarmy+1e8a )

READ_ADDRESS: e2fbd008

FAULTING_IP:
mbamswissarmy+1e8a
ee6a7e8a 8b7e28 mov edi,dword ptr [esi+28h]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: mbam.exe

LAST_CONTROL_TRANSFER: from ee6a7022 to ee6a7e8a

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
eed8dbb8 ee6a7022 00002c63 00000000 00100002 mbamswissarmy+0x1e8a
eed8dbd8 ee6a7340 e2323388 e1c28840 e1c28840 mbamswissarmy+0x1022
eed8dbec ee6a6a82 e1c28840 eed8dc1c 00000000 mbamswissarmy+0x1340
eed8dc10 ee6ace4b 82017e68 82017ed8 e1c28840 mbamswissarmy+0xa82
eed8dc34 804e37f7 82335040 00000043 806f02d0 mbamswissarmy+0x6e4b
eed8dc44 80567f81 82017ed8 81fb6e50 82017e68 nt!IopfCallDriver+0x31
eed8dc58 8057aa9f 82335040 82017e68 81fb6e50 nt!IopSynchronousServiceTail+0x70
eed8dd00 8058efe3 000001d0 00000000 00000000 nt!IopXxxControlFile+0x611
eed8dd34 804de7ec 000001d0 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
eed8dd34 7c90e514 000001d0 00000000 00000000 nt!KiFastCallEntry+0xf8
0012e064 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
mbamswissarmy+1e8a
ee6a7e8a 8b7e28 mov edi,dword ptr [esi+28h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mbamswissarmy+1e8a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mbamswissarmy

IMAGE_NAME: mbamswissarmy.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4883d5e3

FAILURE_BUCKET_ID: 0x50_mbamswissarmy+1e8a

BUCKET_ID: 0x50_mbamswissarmy+1e8a

Followup: MachineOwner
---------

[Swandog46]

Yes, we need to see the minidump please.

[Leafs4Life]

Tried to attach but received the error message "Upload failed. You are not allowed to upload this type of file."

I have sent a PM to one of the administrators asking how to proceed.

[exile360]

If you right click on the dump file and highlight "Send to" and select Compressed (zipped) Folder you should be able to attach the .zip file to your post .

[Leafs4Life]

Thanks. Here you go.

[Leafs4Life]

Please delete post #5. I goofed and attached the incorrect dump file. Sorry for any confusion.

The correct minidump file is now attached.

Attached Files

•  Mini041909_01.zip   15.35K   52 downloads

[Swandog46]

Thank you for your help. You say you cannot duplicate this error?

[Leafs4Life]

Two additional things that I neglected to mention in my original post. I had ran a full SAS scan before the MBAM scan. It was completed with no problems detected and I closed SAS before starting MBAM. I didn't think that it would be part of the issue which is why I didn't mention it. Also the Database Version when the error appeared was 2011 - 4/19/2009 (if that is of any help). After the initial problem, the error did not re-occur. I was able to run a full scan.

I have since downloaded Database Version 2015 - 4/20/2009 but have yet to run a scan. I'll repeat the precise steps I took yesterday, including the SAS scan. If the problem crops up again, I'll post a fresh minidump file.

Thanks

[Leafs4Life]

Sorry, just finished the exact steps I took yesterday and could not reproduce the event. If it does occur again, I'll post in this thread. If there is something else you wish me to check, let me know. I'll log in tomorrow to see if there are any messages. Thanks.