mbae.dll in 3.0.6 causing 10%cpu in iexplore.exe

[Trebor-Cymru]

I'm aware of various problems, such as iexplore,exe crashing, but this one seems to leave a working but very slow and busy laptop.

At the moment I have turned web protection OFF and this has returned to laptop to useable, so I have a fix of sorts.

Process Explorer shows that the thread running mbae.dll is using 9-10% of the processor, in each running instance of iexplore.exe whether this be in the foreground

or background.  It appears to prevent iexplore.exe from closing down completely as well, thus the degradation is cumulative.

I'll happily provide more information.  I'm running Windows 10 Home, fully patched but not creators yet, i3 processor, 8Gbyte memory,

Norton internet security

[Porthos]

16 minutes ago, Trebor-Cymru said:

I'm aware of various problems, such as iexplore,exe crashing, but this one seems to leave a working but very slow and busy laptop.

At the moment I have turned web protection OFF and this has returned to laptop to useable, so I have a fix of sorts.

Process Explorer shows that the thread running mbae.dll is using 9-10% of the processor, in each running instance of iexplore.exe whether this be in the foreground

or background.  It appears to prevent iexplore.exe from closing down completely as well, thus the degradation is cumulative.

I'll happily provide more information.  I'm running Windows 10 Home, fully patched but not creators yet, i3 processor, 8Gbyte memory,

Norton internet security

 

Have you added exclusions for MB in Norton? and Excluded the Norton folders in MB?

C:\Windows\System32\drivers\mbae64.sys
C:\Windows\System32\drivers\mbam.sys
C:\Windows\System32\drivers\MBAMChameleon.sys
C:\Windows\System32\drivers\MBAMSwissArmy.sys
C:\Windows\System32\drivers\mwac.sys
C:\Windows\system32\Drivers\farflt.sys

C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

[Trebor-Cymru]

Thanks Porthos,

Norton is offering me 4 places that handle exclusions, antispam, auto-protect, performance, scan,

auto-protect seems most likely, can you confirm I should be adding these 12 file names there.

Also what Norton folders do you normally exclude in MBAM, only system areas, or appdata stuff as well.

Robert

 

[Porthos]

9 minutes ago, Trebor-Cymru said:

Norton is offering me 4 places that handle exclusions, antispam, auto-protect, performance, scan,

auto-protect seems most likely, can you confirm I should be adding these 12 file names there.

 

 

Heck, Do them in all of them if possible. You can leave out antispam, lol

 

9 minutes ago, Trebor-Cymru said:

Also what Norton folders do you normally exclude in MBAM, only system areas, or appdata stuff as well.

Same, Add them all. Just to be through.

Edited April 29, 2017 by Porthos

[AdvancedSetup]

You may want to try the following as well and see if it provides some improvement. If the issue continues a full clean removal and reinstall may be in order and/or getting us some logs.

 

1. Open a CMD Window as an Administrator on the computer and enter the following commands:

 

• cd %windir%\system32\
• lodctr /R
• cd %windir%\sysWOW64\
• lodctr /R

 

    Note: This should not negatively affect performance on the machine. This command resyncs the counter values.

 

2. Open up Regedit and navigate to the following registry key:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance

 

3. Make sure that the value (if it exists) for the Disable Performance Counters is not 1.  If the entry does exist and the entry is 1, change it to 0 or delete that entry within the key.  ** PLEASE NOTE ** make sure you contact your system administrator before making changes to the registry, and make sure that you back it up before you delete it.

 

Note: After completing the Microsoft instructions, a reboot is required.