Scan stalls at 100% CPU with v 1.75.0.1300 Win XP

[Wphil]

I have used the free version of MBAM for many years for occasional confidence scans.

 

Just now I can't get a full scan to complete without at some point it going to 100% CPU and having to be ended.

 

I do have an old window XP PC but it satisfies the requirements.  Pentium M 1.6GHz 2GB RAM

 

I wondered if there was a conflict with Bitdefender which I have not been using for long so I tried disabling Bitdefender but this made no difference.  I have performed manual scans with MBAM in the past with various security products installed and had no issues.  I have looked at the FAQs and I note sections for various security products but Bitdefender is not one of them.

 

I generally only run quick scans so I do not know how long this problem has existed, does it happen since updating to v1.75 for instance (whenever that was).

 

I have run a quick scan okay and noticed the CPU in the 90s% for the first few minutes and then becoming more variable, mostly running in the 70s% (I'm guessing this might have something to do with file size or type) but never sticking at 100% and stalling although it does touch 100% occasionally.

 

Phil

[Firefox]

Hello and

FYI, full scans are really not needed, a quick scan is all that should be performed and will catch all the infections just fine. Also another reason for a spike in the program could be that with the latest version of Malwarebytes, it now scans zip files as well. This will cause longer scan times and could explain the spike you are seeing.

Not sure what version of Bit Defender you are using... but if you want to try and exclude Malwarebytes from it so possible conflicts could be avoided here are some instructions for Bitdefender....

Bitdefender Total Security 2013

Please review the following screen shots and set those in Bitdefender 2013. Then reboot the computer and let us know if that corrects the issue for you. (provided by AdvancedSetup)

Thanks

[Wphil]

Thanks, I tried that but after about 30 minutes it still ended up locked at 100% CPU.  I watched it for the first 10 mins and at startup it went to 100% for a few seconds before I even invoked a scan.  The it ran it very high CPU for a few minutes, now and again hitting 100% for a while and then recovering, then fluctuation, large .exe files seemed to cause high CPU.  The three times it has locked up I have not noticed anything special about the files it was on, the first two were .dll from Sony, the last time I didn't note.

 

I have another Win XP PC with a 3GHz dual core processor it it ran a full scan OK with much lower CPU loads.

 

I think I have to accept that my low performance CPU just can't cope with Malwarebytes loading and it just seems I might get away with a quick scan; so far it has not locked up on a quick scan but I can see it might just be a case of probabilities and will at some point.

 

It's a shame as Malwarebytes has been very useful over the years and is useful insurance as Win XP support expires and until I retire this PC in favour of something else.

[daledoc1]

Hi, Wphil:
 
Until Firefox returns...
 
Sorry the mutual exclusions didn't help.
It does sound like an older system with less than robust specs.
BUT, there may still be a way to resolve your issue.

I wouldn't necessarily throw in the towel just yet.
 
Let's get a bit of basic system info to help the staff/experts.
Please run the following scanners and post back here with the logs attached to your next reply.
They will help to determine the cause and a possible solution.
 
Thanks,
 
daledoc1
------------------------

DDS-MBAMCHECK-FRST

STEP 1
Please run the DDS scanner and send back both logs as attachments to your next reply.

Download DDS from one of the locations below and save it to your Desktop:
dds.scr
dds.com

Temporarily disable any script blocker if your Anti-Virus/Anti-Malware has it.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr or dds.com to run the tool.
Click the Run button if prompted with an Open File - Security Warning dialog box.
A black DOS console should open and run for a moment.

• When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt

• Save both reports to your desktop
• Please include both of the following logs in your next reply as an attachment: DDS.txt and Attach.txt
• You can ignore the note about zipping the Attach.txt file and just post it or attach it.

 

STEP 2
Please run mbam-check and send back the log as an attachment to your next reply.

• Download mbam-check.exe from HERE and save it to your desktop
• Double-click on mbam-check.exe to run it, it should then open a log file
• Please do not copy and paste the entire contents of the log into your next post; instead please attach to your next reply the CheckResults.txt log file which should now be located on your desktop.

 

STEP 3
Please run the FRST tool and send back both logs as attachments to your next reply.

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. The one that runs will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your next reply.

[Wphil]

DDS would not run to completion.  It ran, then settled at 0% CPU for some time and after over 10 mins locked up at 100% CPU needing the PC to be powered down.

 

I didn't realise I should have AV s/w disabled for 2 and 3 and of course FRST fell foul of bitdefender.  Eventually cleaned up the mess and re ran.

 

Um, sorry I can't find how to attach files....what am I missing.

 

Phil

[daledoc1]

Hi:

 

To attach the logs:

1. "More Reply Options" button (lower right)
2. "Browse" button (near paperclip, lower left)
3. Navigate to the log file file & select it
4. "Open" button
5. "Attach This File" button
6. Repeat for the other files

Thanks!

 

daledoc1

[Wphil]

Oh!  I was expecting it along the top of this window.

 

Attached now.

 

I had a bit of a look, you can see the machine has had a hard life!  Also I've recently dug myself out of the problems with Microsoft Update causing 100% CPU and got all updates in place.

 

Is there an alternative to DDS I could try?

 

Phil

FRST.txt

Addition.txt

CheckResults.txt

[AdvancedSetup]

I would recommend the following.
 
 
STEP 1
Please uninstall ALL versions of Java from Control Panel, Add/Remove and then run the following other STEPS
 
 
STEP 2
Please download JavaRa-1.16 and save it to your computer.

• Double click to open the zip file and then select all and choose Copy.
• Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
• Quit all browsers and other running applications.
• Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location and post it in your next reply.

STEP 3
Please run a Full Disk Check on your system drive.  If needed here are some links on how to run a Disk Check.

On Windows XP the disk check log is in the Event Logs under Application with a heading source of  Winlogon

How to Run a Chkdsk Function on Windows XP

How to view and manage event logs in Event Viewer in Windows XP
 
 
Then copy the event entry from the Event Logs and post back the results here.
 

STEP 4
Please Run TFC by OldTimer to clear temporary files:

• Download TFC from here and save it to your desktop.
• http://oldtimer.geekstogo.com/TFC.exe
• Close any open programs and Internet browsers.
• Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
• Please be patient as clearing out temp files may take a while.
• Once it completes you may be prompted to restart your computer, please do so.
• Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 

STEP 5

Follow the directions here and do a clean removal and reinstall of MBAM

MBAM Clean Removal Process
 

 

STEP 6

Please run a Quick Scan with Malwarebytes

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.
Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.
Make sure that everything is checked, and click Remove Selected.
 

 

Thanks

[Wphil]

Thanks.  Finally go around to doing all of that.

 

JavaRa.exe failed the first time but ran okay when re-run.

 

mbam-clean gave a number of errors before completing - 

 

vbAccelerator SGrid II Control:  Run time error '0'

 

MalwareBytes Anti-Malware: Run time error '440'

 

Then three error '383'

 

Log files attached as requested.

 

 

JavaRa.log

chkdsk log.txt

mbam-log-2014-03-10 (22-19-10).txt

[Wphil]

I've now tried running a full scan again and it locked up at 100% CPU after 34 minutes.  The last file displayed was 1Kb with extension KID.

 

As I said at the beginning, I don't think the CPU can take the load mbam needs.

 

Phil

[AdvancedSetup]

Hi Phil

 

There should not be any errors.  Please review the following post on how to check on those errors and fix them.

 

Runtime error 0, 440, and 339 automation errors

 

Then uninstall it again and reinstall until a removal and reinstall works without any errors.

[Wphil]

Uninstall and reinstall performed, prepared to sort the errors but none were reported this time.  Presumably a number of reboots and some settling time has overcome the problems, I don't think it was finger trouble.  New quick scan log attached, no problems found.

 

daledoc1, AdvancedSetup

 

Any reactions on all those log files I've posted?

 

Or am I just left with as clean a system as possible with no detected threats and should avoid a full scan, a quick scan being sufficient in any case?

 

Phil

mbam-log-2014-03-11 (13-15-34).txt

[AdvancedSetup]

These errors are not self correcting.

 

vbAccelerator SGrid II Control:  Run time error '0'

 

MalwareBytes Anti-Malware: Run time error '440'

 

The issue is that with these errors there are certain features of the program that will not work correctly.

 

Beyond this though - assuming the program is working as expected and you're concerned about a possible infection then I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.

Thanks

[Wphil]

Okay I understand what you say but I have repeated the clean and install process twice now with no errors.

 

I have inspected the permissions on all the registry entries related to those errors and they are correct as per your link above (11th March 12-15am) which seem to be the same as being fixed by the batch file in section A 15 of the FAQ.

 

I have rerun mbam-check-2.0.0.1000 and attached the CheckResults log file.  I assume that the entries in the log file for those keys would allow you to see if they are set correctly.

 

I cannot explain what action has corrected those errors but since I now get no errors surely I can deduce that MBAM is now fully functional?

 

There has been no negative feedback relating to any of the log files I have submitted so I presume no issues are indicated?

 

I have no suspicion/symptoms of any malware I just run manual scans as insurance over other protection.

 

My question relates to a full scan stalling at 100% CPU.  My conclusion in the absence of any other advice is that my CPU is not up to the task.  Although my CPU satisfies the MBAM minimum requirements perhaps they were set a long time ago and MBAM has become more demanding since then or perhaps what MBAM is having to process is now more demanding.

 

Since I have been advised that only a quick scan is necessary and so far I have not experienced any problems with quick scans I would seem to be able to continue to use MBAM despite my low performance CPU.

 

If the above is correct then the only concern is not being able to explain what I did to correct the errors.

 

Phil

 

CheckResults.txt

[AdvancedSetup]

Why the program would stall is not known.  It would take many other scans to check on the system and see if we can find and correct the issue, but again that would need to be carried out in the other forum I've listed above.  It could be either file or registry corruption that is causing it or something else but without going through the other scans there is no way to know.