System slows to crawl while scanning.

[wtcjam]

Installed & registered 3.0.6 yesterday. Started a scan. System became unresponsive. Uninstalled/reinstalled. Worked BETTER but all apps take 10-20 seconds or more to load. Chrome will never completely load.When I cancel the scan dashboard indicates scan still running. System still very slow and many cases unresponsive.  Was not even able to get to Google in Chrome. Only thing that seemed to help was to uninstall Malware bytes. Started a scn after reinstall and it was still scanning file system after almost 9 hours.

I have used this product for many years. It was my GOTO malware prodect.  If there is no resolution I will have to cancel my subscription and request my money back.

I am running ver 3.0.6.1469; component package 1.0.96; update package 1.0.1678

I will appreciate any suggestings to resolve this issue.                         Thanks, Jack

MBAMSERVICE.zip

[Porthos]

Well we don't know about your system but by design, IFYOU run A MANUAL scan it will use up the remaining CPU power of the system to complete the scan faster. 

7 hours ago, wtcjam said:

Started a scn after reinstall and it was still scanning file system after almost 9 hours.

If you were doing the CUSTOM scan it takes a LONG time. The only scan that should be run is a THREAT scan. Let your AV do the long complete full file scans. 

[wtcjam]

My issues gets more interesting!!

After the third clean install Malware bytes STOPPED bring the system to a virtual stop; everything worked as normal during a scan BUT..... it would not complete the scan.  

Sometimes it hung up scanning the startup items; sometimes scanning scanning the file system. cpu utilization dropped to zero. Waited for hours but it would never advance.

Tried a custom scan.  CPU utilization did go to 48% but the system worked very well. Still would not complete the scan.  The only way I could kill Malwarebytes was to kill the process, the kill the service!

Reconfigured custom scan to NOT scan startup items or registry. It now completed the scan in about 1 1/2 hours with no problems.  This has me perplexed. Any iteas how to resolve these issues, short of returning the product?  

                                                                            Thanks, Jack

[Firefox]

Lets get some logs to see if we can tell what's going on

Let's try this first.... (Please remember to de-activate your Malwarebytes first before un-installing or using the clean removal tool)

1. Please read the following and attach to your next reply the 4 requested logs - Diagnostic Logs (the 4 logs are: mbam logs zipped, FRST.txt, Addition.txt and mb-checkResult.txt)
2. NOTE: More info about the latest Malwarebytes 3.0.6 CU4 HERE; MB 3 User Guide ONLINE; MB 3 User Guide PDF; MB 3 FAQ: Malwarebytes 3.0 - Frequently Asked Questions
   

Please let us know how it goes.

Thank You,

Firefox

[wtcjam]

I have uninstalled/reinstalled Matwarebytes. I ran a custom scan with all items checked, including root check.

The scan got to c:\program files\windowsapps\9e2f88e3.twitter_5.6.1.0_x86__wgeqdkkx372wm\clrcompression.dll and hung. 

I have attached the requested files.

I hope this will be of assistance.  Please let me know.

                                                               Thanks, Jack

 

MB-CheckResult.txt

Addition.txt

FRST.txt

MBAMSERVICE.LOG

[Firefox]

Lets see if @dcollins can review the logs and see if he can tell what's going on...

Thanks

[dcollins]

When your scan hangs, what happens if you close MBAM by clicking the X in the corner and then re-open it by double clicking your desktop icon or right clicking the tray icon and choose Open Malwarebytes? Is it still hung?

[wtcjam]

If I exit Malwarebytes and return it is still scanning on the same file.  The only way I can stop it is to kill the service.  After it hung up and I killed the service I ran another custom scan selecting everything EXCEPT scan startup & registry.  That scan complete an hour & 30 minutes.  CPU utilization went to \just under 50% but did not seem to slow the rest of the system.

 

 

[wtcjam]

Anyone have a chance to look at the logs I sent in?  Any idea why the scan hangs if I scan startup & registry but completes if I exclude those areas?

                                                                                                      Jack

 

[dcollins]

Unfortunately the logs don't point out what's happening. Can you try the following so we can get a more verbose log?

1. Open MB3
2. Under Settings -> Application, turn on the option for 'Event Log Data'
3. Start a scan with Startup & Registry selected
4. Once the process hangs, wait 1-2 minutes
5. Go to Settings -> Application, turn off the option for 'Event Log Data'
6. Navigate to C:\ProgramData\Malwarebytes\MBAMService
   • The ProgramData folder may be hidden. If so, you'll need to turn on the option to show hidden folders/files or type the path manually
7. Right click the logs folder and choose Send to -> Compressed (Zipped) folder
8. Upload the logs.zip file that should be created on your desktop

[wtcjam]

I ran a threat scan. It hung scanning start objects.  Let it set.  I have attached the requested log file.

 

Thanks for investigating,  Jack

logs.zip

[AdvancedSetup]

Hello Jack,

The computer is showing a few different errors. Some may or may not be part of the issue, but let's try a few things to clean things up and see if it helps or not.

 

Please click on the "Search the web and Windows" box.

Then type in CMD.EXE and when it shows on the start menu right click and select "Run as administrator"

 

 

In the command prompt please type the following exactly.

CHKDSK  C:  /R

This will tell Windows to run a full disk check, however you'll get the following, telling you it cannot run because it's in use.

Press the Y key to tell it to run on the next restart of the computer.

 

Quote

Microsoft Windows [Version 10.0.10586]

(c) 2015 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>CHKDSK C: /R
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process.  Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

 

 

 

 

Then restart the computer and let it run.
Then find and copy the disk check entry from the Event Logs and paste back the results here.

How to Read Event Viewer Log for Chkdsk (Check Disk) in Windows 10

 

 

Next, please run the following.

 

Please Run TFC by OldTimer to clear temporary files:

• Download TFC from here and save it to your desktop.
• http://oldtimer.geekstogo.com/TFC.exe
• Close any open programs and Internet browsers.
• Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
• Please be patient as clearing out temp files may take a while.
• Once it completes you may be prompted to restart your computer, please do so.
• Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 

Then restart the computer one more time. Then open Malwarebytes and check for updates. Wait for them to finish loading. Then run a normal Threat Scan and let us know if it's still freezing or not.

Thanks

Ron

 

 

Application errors:
==================
Error: (04/13/2017 10:15:02 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\ThumbsPlus 10\Bin\Thumbs10.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.953_none_89c2555adb023171.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.953_none_42151e83c686086b.manifest.

Error: (04/13/2017 10:09:08 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "C:\Windows\Installer\{EE8BACFF-60B3-4069-8F71-337A2662940A}\recordingmanager.exe".
Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (04/13/2017 10:08:22 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: TcpListenerManager: not accepting connections: failed to listen on at least one transport.

Error: (04/13/2017 10:08:22 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: TcpListenerManager: not listening on IPv4: bind: Only one usage of each socket address (protocol/network address/port) is normally permitted. (10048)

Error: (04/13/2017 10:08:22 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: FeatureLicensing: No valid license installed.

Error: (04/13/2017 10:08:22 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: TcpListenerManager: not accepting connections: failed to listen on at least one transport.

Error: (04/13/2017 10:08:22 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: TcpListenerManager: not listening on IPv4: bind: Only one usage of each socket address (protocol/network address/port) is normally permitted. (10048)

Error: (04/13/2017 10:07:30 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: TcpListenerManager: not accepting connections: failed to listen on at least one transport.

Error: (04/13/2017 10:07:30 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: TcpListenerManager: not listening on IPv4: bind: Only one usage of each socket address (protocol/network address/port) is normally permitted. (10048)

Error: (04/13/2017 10:07:30 AM) (Source: VNC Server) (EventID: 256) (User: )
Description: FeatureLicensing: No valid license installed.


System errors:
=============
Error: (04/13/2017 10:07:29 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (04/13/2017 10:07:29 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the BestSyncSvc service to connect.

Error: (04/13/2017 10:07:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.2 service failed to start due to the following error: 
The system cannot find the file specified.

Error: (04/13/2017 10:07:26 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The HomeGroupListener service terminated with the following service-specific error: 
%%2147944153 = There are no more endpoints available from the endpoint mapper.

Error: (04/13/2017 08:31:41 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (04/13/2017 08:31:39 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Windows Image Acquisition (WIA) service terminated unexpectedly.  It has done this 1 time(s).

Error: (04/13/2017 08:31:07 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the BestSyncSvc service to connect.

Error: (04/13/2017 08:31:07 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Error: (04/13/2017 08:31:07 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.3 service failed to start due to the following error: 
The system cannot find the file specified.

Error: (04/13/2017 08:31:03 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The HomeGroupListener service terminated with the following service-specific error: 
%%2147944153 = There are no more endpoints available from the endpoint mapper.

 

Edited April 18, 2017 by AdvancedSetup

[wtcjam]

Hi.  I think I found my problem. In going through the detail log I found a reference to NetMeter beta. When I went to add/remove programs I found an entry that said 'read errror'.  I deleted the program and now all scans run to completion.  I had previously run chkdsk and it had improved the situation though I did not check the log to see what if anything was found.

I have run sever scans since then and they have all completed.

I greatly appreciate all assistance on this issue.  Will now install activation code and monitor everything.  My only concern is that MalWareBytes may not have a sufficiently robust method of handling and reporting damaged files.

Thank you again. Hopefully there will be no need for addition assistance for a long time.       Jack

 

[AdvancedSetup]

Thanks for the update @wtcjam Jack. Glad things are working better for you now.

Ron