Jump to content

MBAMSERVICE Killing Disks


Recommended Posts

We are running the MalwareBytes Enterprise and when I came in today a few of my users were complaining about their systems being slow to the point of being unusable. I went and checked it out and started by checking Task Manager. CPU Usage was very low <5% and the RAM usage was also low <25%. Because at this point the users were complaining about slow start up (their applications not windows as i found out later) so my first assumption was a quick registry clean and reboot and good to go. Nope. This lead me to check the resource monitor (I tried opening this before but with indexing on it would not open (disk usage too high as i found)). Once it finally loaded up I opened the Disk Monitoring Section and low and behold the Disk Usage was Pinned at 100% with about 20-30 MBAMSERVICE.exe all going nuts. One was reporting just over 1,700,000 Total B/Sec and that was Just ONE of the 20-30 mbamservice.exe that were listed. 

Checked a couple of the other users that were reporting slow computers and exact same thing. Triple Checked this on my workstation and confirmed that indeed there were MANY

mbamservice.exe's running all at once and they all had fairly high disk usage. 

The people running SSD's seem to be fine but the desktops that have HDD are really slowing down.

Any insight as to why mbamservice.exe would go into runaway train mode like that would be great.

Side note: Our settings are to have a Full Scan once a Week on Saturday night, Then a Quick Scan is scheduled every day at 10PM. All of this slow business has happened this morning around 9AM

Side Side Note: not sure if it is related but when we went to check on our MalwareBytes install the Management Application was not responding and we had to restart it.

Network Info: 40-50 Machines, Half win 10 half Win 7. Only problems reported by people on Win 7 (Keeping in mind these are the people running HDD's as well).

The people on Windows 7 with an SSD had no troubles. All windows 10 machines that were in use had SSD's installed. Cannot confirm that a windows 10 with a HDD had this issue as we don't have any.

Malwarebytes Managment Console is running on a dedicated VM (only windows and Malwarebytes on there) it has  Processor: Single Core HyperThreaded 2.5Ghz Dedicated. Memory: 8GB Hard Drive: Expandable Hard Drive LAN: Single Dedicated Gigabit Lan Port.

 

Really hoping someone has insight into this problem. I have given all the info I can think of, if you need more please ask.

Link to post
Share on other sites

  • Root Admin

Hi @JStinsman

Sorry for the delay. Can you please run the following scan to get some logs from one of the affected computers.

Please create an mbam-check log:

  • Download mbam-check.exe from here and save it to your desktop
  • Double-click on mbam-check.exe to run it, it should then open a log file
  • Please do not copy and paste the entire contents of the log into your next post, instead please attach the log CheckResults.txt file which should now be located on your desktop to your next post


We'll see if that gives us any specific information for this. If not then we may need to run some other logs. If there is concern about possible private data being shared then it might be best to open a ticket on the help desk to have someone support you via email.

https://www.malwarebytes.org/support/business/#techhelp

Thank you

Ron

 

Link to post
Share on other sites

This happened to us yesterday and i made a post about it in the wrong forums >_< here is the post :

****************************************************************************************************************************************************************************************************************

We are running the MalwareBytes Enterprise and when I came in today a few of my users were complaining about their systems being slow to the point of being unusable. I went and checked it out and started by checking Task Manager. CPU Usage was very low <5% and the RAM usage was also low <25%. Because at this point the users were complaining about slow start up (their applications not windows as i found out later) so my first assumption was a quick registry clean and reboot and good to go. Nope. This lead me to check the resource monitor (I tried opening this before but with indexing on it would not open (disk usage too high as i found)). Once it finally loaded up I opened the Disk Monitoring Section and low and behold the Disk Usage was Pinned at 100% with about 20-30 MBAMSERVICE.exe all going nuts. One was reporting just over 1,700,000 Total B/Sec and that was Just ONE of the 20-30 mbamservice.exe that were listed. 

Checked a couple of the other users that were reporting slow computers and exact same thing. Triple Checked this on my workstation and confirmed that indeed there were MANY

mbamservice.exe's running all at once and they all had fairly high disk usage. 

The people running SSD's seem to be fine but the desktops that have HDD are really slowing down.

Any insight as to why mbamservice.exe would go into runaway train mode like that would be great.

Side note: Our settings are to have a Full Scan once a Week on Saturday night, Then a Quick Scan is scheduled every day at 10PM. All of this slow business has happened this morning around 9AM

Side Side Note: not sure if it is related but when we went to check on our MalwareBytes install the Management Application was not responding and we had to restart it.

Network Info: 40-50 Machines, Half win 10 half Win 7. Only problems reported by people on Win 7 (Keeping in mind these are the people running HDD's as well).

The people on Windows 7 with an SSD had no troubles. All windows 10 machines that were in use had SSD's installed. Cannot confirm that a windows 10 with a HDD had this issue as we don't have any.

Malwarebytes Managment Console is running on a dedicated VM (only windows and Malwarebytes on there) it has  Processor: Single Core HyperThreaded 2.5Ghz Dedicated. Memory: 8GB Hard Drive: Expandable Hard Drive LAN: Single Dedicated Gigabit Lan Port.

 

Really hoping someone has insight into this problem. I have given all the info I can think of, if you need more please ask.

****************************************************************************************************************************************************************************************************************

we seem to have calmed it down. My best guess at this point is the software gets rather unhappy when the main server goes offline. One computer appeared to be updating its definitions database every second...

Link to post
Share on other sites

Hello there,

So I was told this is the wrong place to post a business problem so I made another post in the business forums here:

https://forums.malwarebytes.org/messenger/52534/?_fromLogin=1
 

I did the mbam-check as you asked and i have attached it to my new post in the business forums. I will attach it here also for your convenience

CheckResults.txt

Edited by JStinsman
ot = to
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.