Extreem high RAM and CPU usage

[Vincent50]

Since a few days is malwarebytes 3.0 taking up to 3GB of RAM and at random times lots of CPU (see attached image and log file). I always wonder what mbam is doing when I uses so much resources. All 4 protection layers are enabled. This high RAM usage goes on for hours and hours.

mbam version: 3.0.6.1469

I have windows 10 (creators update installed but even before that did I sometimes face extreem RAM usage)

MBAMSERVICE.LOG

[exile360]

Hello,

As explained via private messenger, I've requested that one of our Support technicians assist you with this, however in the meantime I think I may be able to at least offer some insight into what appears to be going on.  When the RAM and CPU usage jumps up like that it's most likely due to a scan being kicked off, probably from the scheduler.  That said, a scan shouldn't take hours to complete, only minutes in most cases so it's probable that something else is going on here that's causing Malwarebytes to get hung up when performing scans.  In the meantime, just for now until a Support tech arrives to assist you further, I can only suggest that you access the Scan Schedule tab under Settings and delete any existing scheduled scans to see if that eliminates the spikes for the time being.  Once a tech is able to fully diagnose and hopefully resolve the issue for you, you should then be able to re-schedule your scan(s) without any problems.

[Vincent50]

10 hours ago, exile360 said:

In the meantime, just for now until a Support tech arrives to assist you further, I can only suggest that you access the Scan Schedule tab under Settings and delete any existing scheduled scans to see if that eliminates the spikes

I don't have any scheduled scans . The scans always start at the most unwanted time so I disabled them (for example, right after my pc started). That is also why I am so surprised by the high usage. 

Edited April 21, 2017 by Vincent50

[Porthos]

3 hours ago, Vincent50 said:

The scans always start at the most unwanted time

This can not happen if there are not any scheduled scans. Need to see some logs. Start at step 7 and post all of the logs listed.

 

Edited April 21, 2017 by Porthos

[Vincent50]

18 minutes ago, Porthos said:

This can not happen if there are not any scheduled scans. 

 

@Porthos

I meant that I disabled all scheduled scans because they used to start at unwanted moments. That is why I disabled them.

I attached all log files you requested.

Addition.txt

CheckResults.txt

FRST.txt

MBAMSERVICE.LOG

[Porthos]

Use this MB check instead.

https://downloads.malwarebytes.org/file/mb3_check

[Vincent50]

@Porthos, Checkresult.txt has the same results but I attached the new txt file in this reply.

MB-CheckResult.txt

[Porthos]

11 minutes ago, Vincent50 said:

@Porthos, Checkresult.txt has the same results but I attached the new txt file in this reply.

MB-CheckResult.txt

 

 

 

Actually, it has MORE info.   "controllers_version" : "1.0.75", you are way out of date. It should be 1.0.103

First, let's get a clean install of the newest version.

 

Edited April 21, 2017 by Porthos

[Vincent50]

1 hour ago, Porthos said:

First, let's get a clean install of the newest version.

It seems that that worked. Until now, Malwarebytes only takes 200mb of RAM. next question, why did mbam not update that part by itself? I enabled the option to automatically install the latest updates or notificate me when new updates are available so why was that component so outdated?

And I will keep an eye on Mbam its RAM usage

Edited April 21, 2017 by Vincent50

[Firefox]

21 minutes ago, Vincent50 said:

why did mbam not update that part by itself?

Updates are being rolled out in stages to everyone, eventually you would have been told there was an update...  I have several computers at home, and not all of them get the update at the same time... but since I visit this forum regularly, I know when updates come out, so I basically download the newest version and upgrade all of mine at one time..

[Porthos]

24 minutes ago, Vincent50 said:

why did mbam not update that part by itself?

It metered out over time to not overwhelm the update servers.

[Porthos]

 

I always add these File exclusions to Defender.

C:\Windows\System32\drivers\mbae64.sys
C:\Windows\System32\drivers\mbam.sys
C:\Windows\System32\drivers\MBAMChameleon.sys
C:\Windows\System32\drivers\MBAMSwissArmy.sys
C:\Windows\System32\drivers\mwac.sys
C:\Windows\system32\Drivers\farflt.sys

Add these as a process (you have to copy and paste.)

C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

Also the MB folder in Program Files  and the one in Program Data (it is hidden by default)           

I do this several times a week in my shop. I can do it in my sleep.

Edited April 21, 2017 by Porthos

[Vincent50]

21 minutes ago, Firefox said:

 I know when updates come out, so I basically download the newest version and upgrade all of mine at one time..

 

11 minutes ago, Porthos said:

Add these as a process (you have to copy and paste.).....

Thank you for your help. @Firefox, so when a new updates comes out, you download the new installer and update mbam?

@Porthos, I will add them (with defender you mean windows defender or the exclusions of Mbam?), thank you. Btw, a new problem showed up. When I enabled the exploit protection for MS office, then can't I save word files. Word just crashes. I tried to restart my computer and I disabled the exploit protection and then everything works fine.

Edited April 21, 2017 by Vincent50

[Porthos]

4 minutes ago, Vincent50 said:

When I enabled the exploit protection for MS office, then can't I save word files. Word just crashes.

Known issue and is already fixed in the stand-alone exploit beta and will be integrated soon.

5 minutes ago, Vincent50 said:

I will add them (with defender you mean windows defender

Yes

Also add the Defender folders to MB exclusions.

[Firefox]

10 minutes ago, Vincent50 said:

so when a new updates comes out, you download the new installer and update mbam?

Yes, basically once I know a new version is out, I go and download it and install it over my existing version, that way I always have the latest version.

[AdvancedSetup]

Hello @Vincent50

The logs indicate there are a few issues with your computer. Those issues should be corrected if possible, but our latest installer and updates may be able to correct your current issues. So, before we go the route of cleaning, fixing your computer, can you please download the latest installer and save to your computer. Then run that installer and reboot the computer even though it probably will not ask you to. Then after the restart, open Malwarebytes and click on the Check for Updates link and let it update.

Then let me know if any of the protection modules are having trouble loading or if it's fixed your current issues with the program or not.

https://downloads.malwarebytes.com/file/mb3/

Thank you

Ron

 

[Vincent50]

@AdvancedSetup, Thank you for your reply.

I downloaded the setup and ran it but half way I got the error that the "PoliciesControllerlmpl.dll" could not be installed because of no access. I ignored it and when the installation was finished, I was no longer able to open mbam (see error in screenshot). btw, I always have this when I just install a version over another (yes, the setup had admin rights).

So I did a clean install (again) and like already said, the problems with the high RAM usage seemed over. I only still face the issue that I can't save MS Word files with the anti-exploit on (See my versions in the image below). 

[AdvancedSetup]

Hi Vincent,

Going to be in and out tomorrow so will probably need to help you with this more on Monday. But on Monday what I'd like to do is do a Clean Removal but don't reinstall Malwarebytes yet. After the removal please post the mbam-clean log and a new set of FRST and Addition.txt logs.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.
  

Then I'll review your logs and see what is going on, before we reinstall Malwarebytes.

Thanks

Ron

 

[Vincent50]

@AdvancedSetup, I did a clean removal of mbam3.0 and I attached all logs you requested.

Can you tell me when I can re-install mbam3.0 because I don't trust windows defender as my AV.

Greetings,

Vincent

Addition.txt

FRST.txt

mb-clean-result.txt

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[Vincent50]

@AdvancedSetup I attached the log you requested.

Fixlog.txt

[AdvancedSetup]

Please go ahead and reinstall Malwarebytes 3 now.

Here is the link for the latest installer
https://downloads.malwarebytes.com/file/mb3

 

 

[Vincent50]

@AdvancedSetup 

Anti-malware: working fine, tested with a malware sample

Anti-exploit: Working but it still makes word crash when I try to save documents. This time I got an error when word crashed. I attached a screenshot of that error.

Web protection: When I open iptest.malwarebytes.org I get a popup that the website is blocked but I don't get redirected to the block page ( see second attached image). (I checked for updates for mbam and I restarted my computer but I stillfaces this issue).

Anti-ransomware: can't test it because there is no test sample of it.

The RAM and CPU issues seemed to be fixed.

[Vincent50]

The issue with the web protection is caused by the HTTPS everywhere plugin. When I disable it, the web protection is working fine.

[AdvancedSetup]

The issue with Word is a known issue with Anti-Exploit. This should be fixed in the next program update. For now you'd need to go into the settings and uncheck Word and possibly other Office apps until the update is released.