[SOLVED] Windows 2016 server: random crashes/restarts FIX: Uninstalled MBAM

[Sysnative Windows Update]

Not really. That would usually be a driver fault of the application accessing it. That is possible in the case of MBAM.

 

[usasma]

Just FYI - MBAM has a couple of drivers that are very finicky when confronted with other (non-MBAM) drivers.
They tends to crash if the other drivers aren't behaving exactly as they expect.
The last case that I saw was with BitDefender - and it took getting BitDefender to rewrite it's driver(s) in order to fix the MBAM crashes.

Here's the procedure that they recommend for updating MBAM: BSOD from Malwarebytes Premium?

 

[Butters76]

Still no restarts, maybe it was MBAM causing it.

 

[Sysnative Windows Update]

I suspect it.

 

[Butters76]

What do you recommend me to use on a Win SRV 2016 instead of MBAM then?

 

[Sysnative Windows Update]

Windows Defender + uBlock Origin in the browser and a FW.

 

[Butters76]

Windows Defender + uBlock Origin in the browser and a FW.

Thanks, atm its Windows defender and hardware firewall. I'll check out uBlock.

 

[Sysnative Windows Update]

Sounds good.

 

[Butters76]

OK, I notice it now writes like crazy to c:\Windows\temp , goes over 300mb/sec at times. So everything hangs due to I/O que. Windows defender also had 100% cpu usage for a short while.
I think this might be what has happened before when it gets a Critical stop and it restarts.

 

[Sysnative Windows Update]

Something is causing this. You may want to try using ProcMon to find out what's writing to the folder:

How can I find out which program creates a file/folder in my C: drive?

 

[Butters76]

This is strange. Its MSMPENG.EXE writing Windows\temp.
Thats strange, why should Windows defender write hundreds of megabytes/sec to the tempfolder?

 

[Sysnative Windows Update]

From browsing on Google, allegedly excluding C:\Windows\Temp folder from WinDef scan alleviates the issue somewhat, but it looks like to be some kind of glitch.

Windows Defender constantly creates and reads etilqs files in C:\Windows\Temp\

 

[Butters76]

This one is solved, was MBAM. Not restarted since removal.

 

[Sysnative Windows Update]