vbarytskyy

@johnlondon Thank you very much for a quick reply. I had one last follow up question, was this dump grabbed while "Malwarebytes Service" was using high CPU?

For those of you having random usage (while no scan is running) and seeing 15%+ CPU usage from "Malwarebytes Service", I would like to apologize about the issues you are seeing. I am actively working to get to the bottom of these issues. We'll need to get a dump of the "Malwarebytes Service" while its in high usage state and no scan is running (since running scan will cause expected CPU usage): When you notice that "Malwarebytes Service" is in high usage state (30-40% CPU), open Task Manager (as admin, if on domain user) Find "Malwarebytes Service" in the list and confirm high usage is happening (if used another tool to notice initial usage) Right-click on "Malwarebytes Service" and select "Create dump file" Wait a few minutes, it can take up to 10min to create the dump When dump is done creating, it'll give the location it was stored, please notate this location (will be %temp% most of the time) Go to the location given, copy the dump file to an easy to find location In addition, gather the following: Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop In a domain environment, the zip file may get moved to the admin's Desktop. If the zip file is not seen on the Desktop of the logged in user, check user profile of the admin Grab the dump from initial set of instructions + "mbst-grab-results.zip" and place them in one single zip, then send to us. Feel free to use your own cloud storage solution to share the dump+diag zip or upload it to wetransfer.com and provide me with the link.

@nigel1952 Is it possible that this user has an extension in Adobe Reader (or whatever software is being used)? Typically issues like this originate from a bad extension that may be trying to do something with the file. If you can get us a sample logs, I can definitely take a look. From the machine having this issue, do the following: Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop In a domain environment, the zip file may get moved to the admin's Desktop. If the zip file is not seen on the Desktop of the logged in user, check user profile of the admin Thank you

@IT_1152 We'll need to get a dump of the "Malwarebytes Service" while its in high usage state: When you notice that "Malwarebytes Service" is in high usage state (30-40% CPU), open Task Manager (as admin, if on domain user) Find "Malwarebytes Service" in the list and confirm high usage is happening (if used another tool to notice initial usage) Right-click on "Malwarebytes Service" and select "Create dump file" Wait a few minutes, it can take up to 10min to create the dump When dump is done creating, it'll give the location it was stored, please notate this location (will be %temp% most of the time) Go to the location given, zip the file and send it to us. Feel free to use your own cloud storage solution to share the dump with me or upload it to wetransfer.com and provide me with the link.

Hello @johnlondon, I am very sorry to hear about the issues you are having. Would you be able to get us some additional data from machines experiencing this issue? We'll need to get a dump of the "Malwarebytes Service" while its in high usage state: When you notice that "Malwarebytes Service" is in high usage state (30-40% CPU), open Task Manager (as admin, if on domain user) Find "Malwarebytes Service" in the list and confirm high usage is happening (if used another tool to notice initial usage) Right-click on "Malwarebytes Service" and select "Create dump file" Wait a few minutes, it can take up to 10min to create the dump When dump is done creating, it'll give the location it was stored, please notate this location (will be %temp% most of the time) Go to the location given, zip the file and send it to us. Feel free to use your own cloud storage solution to share the dump or upload it to wetransfer.com and provide me with the link. Thank you

Hello @anyWARE-Mainz We have plans to roll out SSO sometime this month (August). As far as 2FA, that feature is planned for September or October release dates. Both SSO and 2FA is our priority due to reasons you mentioned as well as generally being a highly requested feature(s). Thank you

@heldveld Thank you for those logs. Looks like we'll need a little more logging turned on in order to capture the issue happening. Could you please do the following for me: Open Powershell as administrator (search for Powershell, right-click and select to run as administrator) In admin powershell, run the following command: Set-Location -Path 'C:\Program Files\Malwarebytes Endpoint Agent\' While still in admin powershell, run a second command: (Get-Content "MBCloudEA.exe.Config") | Foreach-Object {$_.replace('<threshold value="INFO" />', '<threshold value="DEBUG" />')} | Set-Content "MBCloudEA.exe.Config" Reboot the machine and login to the computer user account having the problem. Wait 2-3min for machine to load. Get logs again (the same way you got them the first time) > send them to me Thank you,

@lindenlauf Could you PM me your Malwarebytes Cloud email address, I will take a look into this issue from the back end. Thank you

Hello @heldveld, Could you get us some logs to look over? Check this support article for help with getting logs: https://support.malwarebytes.com/docs/DOC-1818 Thank you

@Jim90, @Cleatus , @MetalSpork , @IT_Guy I PM'd all 4 of you. I apologize for the late reply on our end, we'll definitely prioritize this issue. Please get me the information requested in the PM and we'll get to the bottom of this. Thank you

Hello, I created a new topic as the old one was related to an issue in 2017. Could both of you PM me a zipped export of Application and System Event Viewer logs as we are trying to track this issue down. Also--Please PM me the endpoint FQDN name(s) that is/are experiencing this issue (doesn't have to be all of them, just a sample) and account email so we can try to pull more logs remotely. Thank you

Hello @roy300c, Try turning off "Ransomware Protection". In your Malwarebytes Cloud console, go to Settings > Policies > "select your policy" > Hit the "Settings" tab under "Windows" and find "Ransomware Protection". Note that this will turn off protection for all machines in that policy. If you would like to just turn off protection temporarily, you can stop the "Malwarebytes Service", just be sure to resume it so you can remain protected. Go to a Run dialog (Click "Windows" + R) Type in services.msc (if a domain user, make sure to open as administrator) Find "Malwarebytes Service" or "MBAMService" Right click and stop the service Perform installation of your software and be sure to resume the service. Also--We will be starting to roll out an update tonight that'll have some great improvements in our ransomware technology, it should help mitigate software installation issues.

@Jim90 Could you get us a dump file when you notice the issue happening? So when you notice high usage, do the following: Open Task Manager (as local admin) Go to Processes If "Show processes from all users" button is there, please click it as that'll elevate permissions of Task Manager Find "MBAMSERVICE.exe" in the list > Right-click > "Create Dump File" This process can take up to 5min When a dump is created, location of the file will be given, please notate it Usually in %temp% Find the file > zip and PM me personally with the dump file The dump file may be too large to upload here, use a service like www.wetransfer.com to upload the file and generate a link (to generate a link on WeTransfer, click the "3 dots") Thank you

@Budd Could you get us some logs to look over? NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so: Click "Reveal Hidden Contents" below for details on how to attach a file: Reveal hidden contents One of our experts will be able to assist you shortly. Thank you

@whatmeworry? If you are running Windows Vista/7, please install the following .NET version: https://www.microsoft.com/en-us/download/details.aspx?id=42642 After installing .NET 4.5 from that link, Support Tool should open correctly. If you are running Windows XP, please PM me and I will get you the right update to .NET to help run the Malwarebytes Support Tool Thank you