MBAMService causing hanging

[Rainier]

As of updating to database version 2017.10.23.06 I have at least six Toshiba laptops that are experiencing hangs stopping the laptop completely including the mouse. This lasts for about a minute when the laptop tries to "catch up" with mouse moves and typing from during the hang. This working period lasts for a few minutes when the hang returns. This pattern continues thus making work almost impossible. Through troubleshooting I determined the problem to be the MBAMService. Disabling this service allowed the laptops to work normally. For simplicity I have uninstalled Malwarebytes on all these laptops until I can find a fix. I also discovered today that with MBAMService still running, disconnecting from the network also resolved the problem suggesting that MBAMService was trying to communicate with something causing the slowdowns.

I have tried uninstalling and reinstalling with newer database but the problem returns. Has anyone else seen this issue and/or know of a fix?

Thanks in advance!

[djacobson]

Hi @Rainier, what's the Anti-Malware version number? Are you willing to grab an FRST log set from that machine?

[Rainier]

Hi Dyllon. We're running Malwarebytes Anti-Malware 1.80.2.1012. I'll try to grab the FRST log from a machine.

[Rainier]

Hi Dyllon. I have the FRST and the Addition logs attached. Thanks.

Addition.txt

FRST.txt

[djacobson]

Hi Rainer, let's start by setting up mutual exclusions between your MB, Cylance and SEP. Use this KB for our process locations - https://support.malwarebytes.com/docs/DOC-1236

Then add Cylance's and SEP's processes to MB. Special note on SEP, it should be setup with child process, Sonar and scan locations disabled for MB. Here’s a video I made a while back to follow – http://screencast.com/t/KN5dU7wPVZ11

[djacobson]

We may also need to change some configuration around the massive amount of drive shares you have. MBAM's realtime engine struggles with applications that run from, and write to drive shares. If the exclusions do not help, this will be our next step.

[Rainier]

The issue seems to have disappeared on its own. We have added the exclusions anyway as this may help the program run better. We noticed a few other issues about the same time that also have resolved on their own leading me to wonder if some device may be adding chatter to our network, possibly a switch issue.

Thank you for your suggestions. I'll update if we figure out the actual cause.

[djacobson]

Thanks @Rainier, if you notice new behavior or a return of the issue, just repost here and we'll pick up where we left off.

[itlifesaver]

On 11/21/2017 at 3:25 PM, Rainier said:

The issue seems to have disappeared on its own. We have added the exclusions anyway as this may help the program run better. We noticed a few other issues about the same time that also have resolved on their own leading me to wonder if some device may be adding chatter to our network, possibly a switch issue.

Thank you for your suggestions. I'll update if we figure out the actual cause.

@Rainier does your environment have Ubiquiti switches? Switchvox Phones?

[Rainier]

No, we have 3 COM and HP. No Switchvox phones, we have Avaya but not VoIP, only digital and only connected to the network for voicemail to email.

[itlifesaver]

Thanks. We have several clients experiencing the same issue you describe and Malwarebytes support has been unable to provide a resolution. It started around Dec 16th, and exiting or disabling MBAM resolves the mouse/keyboard delays completely. We've been unable to find a cause, beyond a recent MBAM definitions update (since PCs with outdated definitions are not effected). Adding the exceptions to Windows Defender hasn't resolved the issue.

[djacobson]

@itlifesaver, can I have you try disabling prefetch on one of the machines and see how it behaves?

[Rainier]

None of the machines are experiencing the issue any more so I have nothing to test with anymore. Unfortunately I never determined what the cause was, it disappeared on its own.

Sorry!

[itlifesaver]

6 minutes ago, djacobson said:

@itlifesaver, can I have you try disabling prefetch on one of the machines and see how it behaves?

I can try, sure. Which one, or both? http://www.tomshardware.com/reviews/ssd-performance-tweak,2911-5.html

Also worth noting, very few of the PCs being effected have SSDs.

Edited December 19, 2017 by itlifesaver

[djacobson]

I want to see if it is related to an older conflict with prefetch, while it is typical to disable prefetch for machines with SSD's, the conflict isn't related to SSD's, it is with prefetch functionality itself. Superfetch is not part of it.

[itlifesaver]

19 hours ago, djacobson said:

I want to see if it is related to an older conflict with prefetch, while it is typical to disable prefetch for machines with SSD's, the conflict isn't related to SSD's, it is with prefetch functionality itself. Superfetch is not part of it.

Trying it on a PC of the most chronic complainers now, will report back after they have some time to use the PC.

[itlifesaver]

Disabling Prefetch in the registry and rebooting did not resolve the issue.

[djacobson]

Does it happen reliably enough to record? @itlifesaver

[itlifesaver]

7 minutes ago, djacobson said:

Does it happen reliably enough to record? @itlifesaver

Sure does. See here:

https://youtu.be/db7tacSoJVc

[djacobson]

@itlifesaver we'll need to record in a different type of way 

Procmon Log
I’d like to have you run a tool called Process Monitor, ProcMon for short, that will capture all of the events that happens during the issue. Please follow these steps:

1. Download ProcMon from this link: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
2. Extract ProcMon to your desktop
3. Turn off all other programs except Malwarebytes, leave it running in the tray - this part is important, do your best to end all other processes
4. Double-click procmon to run it
5. Once ProcMon begins running, reproduce your issue with the laggy mouse/keyboard action
6. When you get the error, go to ProcMon and click File → Capture Events (this should be checked by default, we want to uncheck it to stop the capture)
7. Afterwards, still in ProcMon, click File → Save, leave the “Events” as default but you can change where the log goes at the bottom. Save the ProcMon log in default or somewhere you are familiar with, like your desktop.
8. Try to attach the ProcMon log

The ProcMon log may be quite large, especially if unneeded processes are not stopped as outlined in step 3, let me know if it does not allow you to attach it and we’ll use a work around. This will hopefully give us a lot more insight into what is happening during the laggy mouse/keyboard.

Edited December 20, 2017 by djacobson

[itlifesaver]

Just uploaded to case # 00047591

Freezing happened nearly instantly after opening ProcMon on the logs I submitted.

Edited December 20, 2017 by itlifesaver

[djacobson]

I can see teamviewer (if you are using it to connect to it, that's fine) is still running, quickbooks, windows phone sync tool, something called meditech and eclinical works, flash player, onedrive, outlook, word, and adobe acrobat. I am serious that everything else must be turned off.

[itlifesaver]

So exactly how am I supposed to tell the user to go about his work and wait 10-15 minutes for the issue to show up? Just move the mouse around all day ?? This is a business and it's effecting a hundred PCs, not some kid who plays games on his PC.

[djacobson]

This machine has roaming profiles, is this an RDS client? \\vsi.local\private\users\hcopeland\Desktop and C:\Windows\CSC\v2.0.6\namespace\vsi.local\private\users\hcopeland

[djacobson]

In having the other processes turned off, we can also determine if it is something else they are running that is part of it, because if it can't be replicated with the other software off, that's a big clue that the conflict lies elsewhere. I understand this is a business, that is what those of us in the B2B side are here to help with, but I don't expect the instructions to be blatantly disregarded. From your description of the issue, its widespread enough to choose another machine to test on if the process is going to interfere with that particular end users day.