Had BSOD from "Bad_Pool_Header", Uninstalled Malwarebytes, Now what?

Christopher Aubert

Honorable
Oct 7, 2013
119
0
10,690
I had been getting the blue screen with the issue being "Bad_Pool_Header", and after a few quick google searches, I figured it was probably Malwarebytes. So I uninstalled it, and it worked. No more BSOD. Except I still kinda want Malwarebytes. Should I just abandon it? (I still have my premium key that's only been used for 1 month or so) Or could I install it and possibly have BSOD? Has anyone had this problem, and what did you do after you uninstalled Malwarebytes/other semi-free antivirus.

What should I do at this point,? Malwarebytes was my current antivirus software.
 
Solution
You see, Malwarebytes itself does not cause BSODs. It's always driver related. According to the second report above, I think you should update/reinstall the network driver in case you get the same BSOD again. Let us know how it goes. Good luck.

Christopher Aubert

Honorable
Oct 7, 2013
119
0
10,690

Ok. So I reinstalled Malwarebytes and installed WhoCrashed, and just today, the computer crashed again with the same error, Bad_Pool_Header. I went to WhoCrashed, it gave me two different results for the same crash, which is a bit odd.
The first one was this (in chronological order):

On Sat 9/10/2016 10:42:30 AM GMT your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: mwac.sys (mwac+0x6135)
Bugcheck code: 0x19 (0x20, 0xFFFFE001E225C850, 0xFFFFE001E225C870, 0x402000E)
Error: BAD_POOL_HEADER
file path: C:\WINDOWS\system32\drivers\mwac.sys
product: Malwarebytes Web Access Control
company: Malwarebytes Corporation
description: Malwarebytes Web Access Control
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mwac.sys (Malwarebytes Web Access Control, Malwarebytes Corporation).
Google query: Malwarebytes Corporation BAD_POOL_HEADER

The second one was this:

On Sat 9/10/2016 10:42:30 AM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\091016-6031-01.dmp
This was probably caused by the following module: tcpip.sys (tcpip+0x7CB1D)
Bugcheck code: 0x19 (0x20, 0xFFFFE001E225C850, 0xFFFFE001E225C870, 0x402000E)
Error: BAD_POOL_HEADER
file path: C:\WINDOWS\system32\drivers\tcpip.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: TCP/IP Driver
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. This problem might also be caused because of overheating (thermal issue).
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

Now the first one is obviously Malwarebytes, but the second one is... something else. It should be noted that I looked at the previous crashes, and they were also the Microsoft one (also, the Malwarebytes didn't show up once throughout all the previous crashes I could see, so this first time thing is odd...), so what is that? Is there some faulty drivers that Microsoft has installed or something? It also says how it could be a driver that couldn't be identified at this time.

Lastly, I searched the "Malwarebytes Corporation BAD_POOL_HEADER" and went through the clean removal process for Malwarebytes and reinstalled with the latest version, hope that might fix something, but doubt it will. I will check for Windows updates and such to see if there's something that will fix this.
Let me know if there's anything that you can tell me!
Thanks!
 

notlim981

Distinguished
You see, Malwarebytes itself does not cause BSODs. It's always driver related. According to the second report above, I think you should update/reinstall the network driver in case you get the same BSOD again. Let us know how it goes. Good luck.
 
Solution

Christopher Aubert

Honorable
Oct 7, 2013
119
0
10,690

Where would I find the network driver, and how would I know which one it would be? If I go to my Device Manager, then go to Network Adapters, there are three options: http://puu.sh/r6Bgi/a7b16ec9ba.png
I right-clicked on each one and clicked Update Driver Software, and all of them said that Windows had determined that the right stuff was installed, so where else would I find them?

The driver that could potentially be a problem is a Mediatek driver for a TP-Link USB WiFi adapter, as that is the only driver that gives the adapter connections to 5GHz WiFi networks. It should also be noted that I have uninstalled then reinstalled it before, and it didn't seem to fix the crashing issue, but... well you never know I guess. There's a default driver that is installed when it's connected to the PC that lets it connect to 2.4 GHz networks, but another driver has to be downloaded for 5GHz networks. I uninstalled both and reinstalled them. If the crashes keep continuing, I will switch to a power-over-ethernet that is slower, but if the crashes cease, then I will know the problem.

Again, let me know any info I need. (Just so you know, the computer crashed about 30 minutes before submitting this reply, with same info as the previous post in WhoCrashed)
Thanks!
 

SMC Global

Prominent
Mar 10, 2017
1
0
510
I installed Malwarebytes 3.0 Premium from the 2.0 version and only get the BSOD's when the software is activated. When I deactivate the software the BSOD vanishes without a trace. My recommendation is to NOT uninstall the software, just simply to 'exit' it or deactivate it. Microsoft are aware of this issue but are in no hurry to fix this anomaly urgently.

 

Christopher Aubert

Honorable
Oct 7, 2013
119
0
10,690

I fixed the problem by getting rid of my current WiFi adapter and it's network drivers, and instead just getting a new one. All the crashing problems went away. It's clear at this point the problem was the network drivers, not Malwarebytes.
 

randomlag

Prominent
Apr 4, 2017
1
0
510
Yup, it's Malwarebytes for SURE. This bug has been around for several years now. On TWO completely different systems now.

Turn turn OFF real-time monitoring and it won't crash. So that's what I do and let it run a scan once a day at night.

The crash always happened in a BROWSER activity (the 'real-time' malware software), so that's why sometimes tcpip gets involved but mostly bad pool.

FYI completely different drivers from before. So yes, it's driver related, but more in how Malwarebytes is hooking into the code. There's a BUG there.

I gave up debugging for the company since I'm not paid a dime and it has caused me hours and hours of extra work.
 

rothenbj

Commendable
Mar 22, 2016
1
0
1,510


I've suffered the same problem and it's driving me crazy. I did as you said when the crashes started happening again and I ran fine just running a Malwarebytes scan occasionally until today.

There was a Win10 update that I installed and the BSODs started. I couldn't do anything before the system crashed. Like you, having lived thru the MBAM issues, that was my first suspicions. I was finally able to get into the startup before I crashed again and Malwarebytes was in the startup. I disabled it and thought I was good but I crashed soon thereafter.

Coming in again, I looked at the processes running on boot and Malewarebytes services so I killed them and suddenly no crashes. I'm really tempted to just remove the program, although I have a lifetime license, and run the MBAM clean program that removes all traces.