Jump to content

MBAMService causing hanging


Recommended Posts

As of updating to database version 2017.10.23.06 I have at least six Toshiba laptops that are experiencing hangs stopping the laptop completely including the mouse. This lasts for about a minute when the laptop tries to "catch up" with mouse moves and typing from during the hang. This working period lasts for a few minutes when the hang returns. This pattern continues thus making work almost impossible. Through troubleshooting I determined the problem to be the MBAMService. Disabling this service allowed the laptops to work normally. For simplicity I have uninstalled Malwarebytes on all these laptops until I can find a fix. I also discovered today that with MBAMService still running, disconnecting from the network also resolved the problem suggesting that MBAMService was trying to communicate with something causing the slowdowns.

I have tried uninstalling and reinstalling with newer database but the problem returns. Has anyone else seen this issue and/or know of a fix?

Thanks in advance!

Link to post
Share on other sites

  • 3 weeks later...
  • Staff

Hi Rainer, let's start by setting up mutual exclusions between your MB, Cylance and SEP. Use this KB for our process locations - https://support.malwarebytes.com/docs/DOC-1236

Then add Cylance's and SEP's processes to MB. Special note on SEP, it should be setup with child process, Sonar and scan locations disabled for MB. Here’s a video I made a while back to follow – http://screencast.com/t/KN5dU7wPVZ11

Link to post
Share on other sites

The issue seems to have disappeared on its own. We have added the exclusions anyway as this may help the program run better. We noticed a few other issues about the same time that also have resolved on their own leading me to wonder if some device may be adding chatter to our network, possibly a switch issue.

Thank you for your suggestions. I'll update if we figure out the actual cause.

Link to post
Share on other sites

  • 3 weeks later...
On 11/21/2017 at 3:25 PM, Rainier said:

The issue seems to have disappeared on its own. We have added the exclusions anyway as this may help the program run better. We noticed a few other issues about the same time that also have resolved on their own leading me to wonder if some device may be adding chatter to our network, possibly a switch issue.

Thank you for your suggestions. I'll update if we figure out the actual cause.

@Rainier does your environment have Ubiquiti switches? Switchvox Phones?

Link to post
Share on other sites

Thanks. We have several clients experiencing the same issue you describe and Malwarebytes support has been unable to provide a resolution. It started around Dec 16th, and exiting or disabling MBAM resolves the mouse/keyboard delays completely. We've been unable to find a cause, beyond a recent MBAM definitions update (since PCs with outdated definitions are not effected). Adding the exceptions to Windows Defender hasn't resolved the issue.

Link to post
Share on other sites

6 minutes ago, djacobson said:

@itlifesaver, can I have you try disabling prefetch on one of the machines and see how it behaves?

I can try, sure. Which one, or both? http://www.tomshardware.com/reviews/ssd-performance-tweak,2911-5.html

Also worth noting, very few of the PCs being effected have SSDs.

Edited by itlifesaver
Link to post
Share on other sites

19 hours ago, djacobson said:

I want to see if it is related to an older conflict with prefetch, while it is typical to disable prefetch for machines with SSD's, the conflict isn't related to SSD's, it is with prefetch functionality itself. Superfetch is not part of it.

Trying it on a PC of the most chronic complainers now, will report back after they have some time to use the PC.

Link to post
Share on other sites

  • Staff

@itlifesaver we'll need to record in a different type of way ^_^

Procmon Log
I’d like to have you run a tool called Process Monitor, ProcMon for short, that will capture all of the events that happens during the issue. Please follow these steps:

  1. Download ProcMon from this link: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
  2. Extract ProcMon to your desktop
  3. Turn off all other programs except Malwarebytes, leave it running in the tray - this part is important, do your best to end all other processes
  4. Double-click procmon to run it
  5. Once ProcMon begins running, reproduce your issue with the laggy mouse/keyboard action
  6. When you get the error, go to ProcMon and click File → Capture Events (this should be checked by default, we want to uncheck it to stop the capture)
  7. Afterwards, still in ProcMon, click File → Save, leave the “Events” as default but you can change where the log goes at the bottom. Save the ProcMon log in default or somewhere you are familiar with, like your desktop.
  8. Try to attach the ProcMon log

The ProcMon log may be quite large, especially if unneeded processes are not stopped as outlined in step 3, let me know if it does not allow you to attach it and we’ll use a work around. This will hopefully give us a lot more insight into what is happening during the laggy mouse/keyboard.

Edited by djacobson
Link to post
Share on other sites

  • Staff

In having the other processes turned off, we can also determine if it is something else they are running that is part of it, because if it can't be replicated with the other software off, that's a big clue that the conflict lies elsewhere. I understand this is a business, that is what those of us in the B2B side are here to help with, but I don't expect the instructions to be blatantly disregarded. From your description of the issue, its widespread enough to choose another machine to test on if the process is going to interfere with that particular end users day.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.