MBARW causes USB port interruption every 1:55 minutes

[AJSchmidt]

I use this Windows 10 computer to listen to music that plays out to a USB audio device.  Whenever MBARW is enabled, the music gets interrupted for about 2-seconds approximately every 1 minute 55 seconds.  That same music streams out to another computer over the LAN via AirPlay, and is never interrupted.  In the same way, typing out characters on my USB keyboard also gets interrupted during those outages.  Configuring MBARW to exclude some folders or even the entire C: drive has no effect on the problem.

Is there any way to get MBARW to stop interrupting the USB communications?

Thank you.

[1PW]

Hello @AJSchmidt and

The Malwarebytes' developers/staffers/helpers must have good data for a quality fault analysis.  Please run the following Malwarebytes written data gathering support tool, on the system in question, restarted in the NORMAL boot mode:

1. Download the trusted arwlogs.exe and save to an Administrator desktop of the system in question.
2. Right-click the arwlogs.exe icon and select Run as administrator.
3. If a Windows User Account Control (UAC) alerts/prompts for arwlogs.exe, select the "Yes" button.
4. If a Windows SmartScreen warning alerts/prompts for arwlogs.exe, select "More info" then select the "Run anyway" button.
5. The details that appear within the Command window that opens should be mostly ignored.
6. When "Press any key to continue . . . " appears at the bottom of the Command window, type an Enter key to close the window.
7. A zipped archive (yyyy-mm-dd-{COMPUTERNAME}.zip) should have been generated to the Administrator desktop.
8. Attach the above zipped archive to your next reply to this topic.
   

Although more data may be required, after the requested data is posted, the Malwarebytes' staffers can commence their analysis.  Thank you always for your assistance.

[AJSchmidt]

Okay, the Logs Grabber files are attached.  I also included copies of the MBAMService.log and MBARwind.arw files that the utility failed to grab, plus a copy of the Command window display for both runs of the Log Grabber -which I ran a 2nd time after it had trouble with MBAE and MBAR being enabled.

Thanks for having a look.

 

2017-04-11-M64 (Command Window Display for both runs).txt

2017-04-11-M64 (1.with MBAE, MBAR running).zip

2017-04-11-M64 (2.after setting MBAE, MBAR to Stop Protection).zip

2017-04-11-M64 MBAMSERVICE.LOG

2017-04-11-M64 mbarwind.zip

[dcollins]

Sorry for the delay, can you grab FRST logs and tell us what audio device you're using (model number). This will help us try to replicate your scenario

1. Download FRST and save it to your desktop
   1. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
2. Double-click to run and when the tool opens click Yes to the disclaimer
3. Press Scan button
4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   1. Attach both of these logs to your post by clicking on the "Drag files here to attach, or choose files..." or simply drag the files to the attachment area

[AJSchmidt]

Attached are the FRST results.

 

FRST.txt

Addition.txt

[dcollins]

What program are you using to play music when you have this issue and do you have the model number of the device you're having issues with? I've been unable to replicate this so far

[AJSchmidt]

I did some more testing and found that this audio interruption problem only occurs when my system is playing music through a particular chain of audio devices. If I play the audio directly to the Realtek WASPI sound device on the motherboard, then MBAR does not cause any problems.  

The audio device chain that is affected by MBAR is this:
1) JRiver Media Center plays music to the audio device: "Hi-Fi Cable Input (VB-Audio Hi-Fi Cable) WASPI".
2) TuneBlade Audio Capture Line-In Device: "Hi-Fi Cable Output (VB-Audio Hi-Fi Cable) WASPI".
3) TuneAero Audio Output Device:  "Speakers (iFi USB Audio)"

JRiver Media Center is software that plays digital music files on the computer.  https://jriver.com/

Hi-Fi Cable is a virtual sound card driver that allows a computer to host multiple audio devices.  http://vb-audio.pagesperso-orange.fr/Cable/index.htm See:  HiFiCableAsioBridgeSetup_v1007.zip

TuneBlade is a software program that pulls the audio feed from the Hi-Fi Cable and transmits it out to TuneAero receivers on the local area network.   http://www.breakfreeaudio.com/

TuneAero receivers are software programs running on LAN-connected computers that receive the TuneBlade audio stream and play it to a connected audio device, such as the iFi USB Speakers.  http://www.breakfreeaudio.com/  

When using this system to stream music out over the LAN to multiple computers, none of the remote computers are affected by MBAR; only the local computer sees its USB speakers interrupted by MBAR for 2-seconds about every 1-minute, 55-seconds.

This is a pretty strange little bug, I know -but that's what's happening with MBAR.

 

[dcollins]

I was unable to reproduce this issue using the setup you described. Have you tried this setup with Malwarebytes 3 yet? If not, would you be willing to? You should get a 14 day trial if you don't want to pay for the product at this time.

[AJSchmidt]

I went ahead and installed Malwarebytes 3.0 Premium v3.0.6.1469-10103 to give your suggestion a try.  However, the Real-Time features were all deactivated and bore a "Premium Only" suffix -so no ability to test the Web, Exploit, Malware or Ransomware protections.  How can I activate the 14-day trial features?

Prior to attempting this test, I had been running the freeware versions of Malwarebytes Anti-Malware (MBAM), Anti-Exploit (MBAE), and Anti-Ransomware (MBARW); which were all forced to uninstall by the Malwarebytes 3.0 Premium installer. The program that's running right now is titled "Malwarebytes Free 3.0.6", and about the only good news that I can report for you is that it is definitely not interrupting the USB audio stream.

 

[dcollins]

Can you run mb-check from the following link and upload the mb-checkResult.txt file on your desktop? I should be able to get your trial re-activated from the information in there

https://downloads.malwarebytes.com/file/mb_check

[AJSchmidt]

I clicked on your provided link in Firefox, and it popped up a new web page which was blank except for the words: "Invalid request.". 

I also tried copy/pasting that https://downloads.malwarebytes.com/file/mb_check link into Internet Explorer and it responded with "HTTP 404 Not Found".

And finally, the Edge browser's response to that link was "Invalid request."

 

[dcollins]

Sorry...

https://downloads.malwarebytes.com/file/mb3_check

 

[AJSchmidt]

That worked.

 

MB-CheckResult.txt

[dcollins]

Your trial should now be available. If you go to Settings -> My Account it should cause your Activate Trial button to show up

[AJSchmidt]

Yes, the 14-day Trial license is now Activated. Unfortunately, the Malwarebytes Premium Ransomware Protection module causes that same USB audio interruption as before.  Also, whenever I click the Ransomware Protection On/Off control to On, there is an immediate cutoff of the USB audio that lasts about 4 seconds. Switching that control to Off does not cause an interruption. 

 

[dcollins]

Thanks for the information, I'll try my best to replicate. Does it happen even if you aren't casting audio to something with TuneBlade? Or how many devices do you usually cast to?

[AJSchmidt]

Using JRiver to play directly to either the computer's motherboard sound card or to a USB audio device is not affected by the Ransomware module.

The problem comes when playing audio to the VB-Audio Hi-Fi Cable (WASPI, DirectSound, or Kernel Streaming modes) virtual sound card.

I have a clarification for my previous Post #7 above, in which Step 2) should be:  TuneBlade Audio Capture, Audio Capture Mode - Specific Endpoint: "Hi-Fi Cable Output (VB-Audio Hi-Fi Cable) WASPI".

That is the configuration that allows the computer to use its motherboard sound card to play all of the Windows system and application sound events, while allowing JRiver to play music out to the VB-Audio-TuneBlade system. In my setup, there are a total of 2 computers that use TuneAero to receive the TuneBlade cast.

 

 

[dcollins]

In your first post, you said the issue was with USB audio, but in this most recent post, you said the issue is not with USB audio. Can you clarify where the audio issue happens please?

[AJSchmidt]

To hopefully clarify: Post #1 was a general summary of the problem with not many details. My Post #17 was intended to say that playing music through the VB-Audio-TuneBlade-TuneAero system to the USB audio device is interrupted by MBARW, while playing music *directly* to that same USB audio device is never interrupted by MBARW.  So, I suspect that something in the VB-Audio-TuneBlade-TuneAero system is being affected by MBARW. 

And a new thought: Since that 2nd computer on the LAN that's receiving the music cast is never interrupted during those moments when MBARW affects the main computer -the problem may be that MBARW is affecting the TuneAero (receiver) software on that main computer.

 

[AJSchmidt]

New Information:  The title of this entire Topic should probably be:
MBARW causes TuneAero Audio Interruption every 1:55 minutes.

After our last posts, I began to question my assumptions about the USB ports being involved in this problem.  I could not reliably reproduce the USB keyboard interruptions that I mentioned in Post #1, and believe that may have been caused by coincidental high CPU usage. The breakthrough came when I changed Step 3 in Post #7 to:  3) TuneAero Audio Output Device:  "Speakers (Realtek HD Audio)"  -which is the motherboard sound card (default system audio device) speakers, which do not rely on any USB ports.

With music now playing through TuneAero into the computer speakers, as soon as I enabled the Ransomware Protection the music was interrupted repeatedly approx. every 1:55 minutes.  So, I was wrong about this being a USB-related problem; and now it looks instead like the Ransomware Protection activity is affecting the TuneAero software running on that same computer, no matter what kind of audio device it's playing.

 

[dcollins]

Thanks for the update, I've still been unable to replicate this so I'm going to try and find a machine that has the same audio device. Can you open up device manager and get the Hardware ID for the sound card you're experiencing this on?

[AJSchmidt]

The computer is a Dell Vostro 410 from about 2007, with a Realtek High Definition Audio chip.  Its Hardware ID is:

HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10280278&REV_1000

Device Manager also lists a set of 4 other sound devices, all with the description "NVIDIA High Definition Audio", and all with the same  Hardware ID: 

HDAUDIO\FUNC_01&VEN_10DE&DEV_0014&SUBSYS_10DE0101&REV_1001

I tried disabling the NVIDIA devices, but that didn't stop the MBARW interruptions.

 

 

 

 

[dcollins]

Thanks, I'm still in the process of trying to replicate this but it's proving to be more difficult than anticipated.