Malwarebytes 3.3.1.2183 MS Word 2010 opens up slowly Windows 10 pro

[softoutlet]

brand new installed windows 10 pro 64bit and office 2010 pro on a Dell system with 16GB ram 6 core e5-1650 cpu, 512gb ssd samsung, running malwarebytes 3.3.1.2183 with symantec endpoint v14.1 mp1.  

Issue:  when opening just Word 2010 it takes near 15 seconds while we see the word starting..splash screen.  Excel, powerpoint, publisher open up in 3 seconds.    removing malwarebytes and word 2010 opens up in 3 seconds.      No other programs have this issue.  performed uninstall of office and reinstall.  same issue with malwarebytes installed.  

We have this across 5 computers with malwarebytes on it.   word 2010 takes too long to open.    what steps can we perform to remedy the issue?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings and welcome

Just to test, would you please try disabling Ransomware Protection but leave the rest of the protection components in Malwarebytes running to see if that eliminates the issue?  Please let us know how it goes.

Thanks

[softoutlet]

We disabled ransomeware protection and no difference.  opened word in 15 seconds like before.   went one step further, disabled all features of malwarebytes and same thing still opened 15 seconds.   removing malwarebytes,  opens in 3 seconds.  

This is running on a Dell T5810 e5-1650 v3 with 16GB ecc ram,  samsung ssd 860 512gb drive, 710gt video card, symantec av 14 with mp1, intel management v11.7.  

latest updates applied via check windows updates.

Also to note, upon reboot for about a good minute or so we can open word 2010 fast, but after that its 15 seconds watching the Word splash screen "Starting ..."  does the "..."  9 times and then opens up.

removing malwarebytes,  opens word 2010 in less than 3 seconds.  

I'm open to testing further because I want to believe this is a good product to have, but the latency in opening apps is lowering production for us, this is just 5 computers at one site.

Edited March 4, 2018 by softoutlet

[exile360]

I was hoping that would work as I've been seeing a similar impact on performance on my own system and usually disabling ransomware protection eliminates the issue, however I'm running Windows 7 and don't have Norton so I guess the differences in our environments is why it didn't work for you.  You might also try the beta (which I have installed currently) which may be found here.  Perhaps that will help improve performance.  It's worth a try at least.  It contains a lot of bugfixes.

You might also run the following from a command prompt after disabling ransomware protection just to verify that it's actually fully unloaded when you turn it off:

sc query ESProtectionDriver

If you find that it is still active (i.e. the STATE is listed as RUNNING) then you should try disabling it by opening an administrative command prompt and entering the following command:

net stop ESProtectionDriver

If you found that it was still running and you subsequently disabled it via the above command, go ahead and attempt launching some of your affected applications again to test their performance.

[softoutlet]

Tried the above steps and still no difference, takes 15 seconds to open Word with State Stop for ESProtectionDriver.  although i don't think turning ransomeware off does anything inside malwarebytes app, stopping the service did.

Went inside malwarebytes app, switched off ransomware protection.    opened cmd, ran SC query ESProtection Driver....status still showed Running..  

>SERVICE_NAME: esprotectiondriver         TYPE               : 1  KERNEL_DRIVER         STATE              : 4  RUNNING                                 (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)        

than I ran Net Stop ESProtectionDriver.  and now the  State is Stopped.  opened word, waited 15 seconds.  no difference unfortunately.

On Windows 7 ultimate 32 bit with Word 2010   their are no issues, word opens up in 2-3 seconds .  super fast on windows 7.   I'm still hopeful for a solution...

 

[exile360]

OK, please try the same with Malware Protection then verify that the following isn't running:

MBAMProtection using the same method as above (it should tell you that it either isn't running or isn't installed as a service, but you may verify that this is the right driver by turning it back on and using the sc query MBAMProtection command again).

If that does not help, turn Malware Protection back on then disable Exploit Protection; this is the one that ESProtection belongs to; I was mistaken about its purpose in my above post so then use the following command after disabling Exploit Protection:

sc query ESProtection

If that does not help, turn off Web Protection and verify that MBAMWebProtection is not running via the same method.

[softoutlet]

Here is what I tried.  removed Symantec AV 14 MP1.   Remove Malwarebytes.  rebooted.   logged in, opened word in 2 seconds.

Installed Malwarebytes, activated full version.  rebooted.   opened word in 3 seconds.

Installed symantec antivirus AV 14 MP1 antivirus feature only(no firewall, no network threat etc) plain vanilla.  rebooted.  opened Word 2010 in 15 seconds......

Uninstalled malwarebytes, opened Word in 2010 in 3 seconds.     tried both version 3.3.x and 3.4.x beta.  they both do the same thing. 

 

[exile360]

OK, good, so you've definitely narrowed down the issue to a performance conflict between Malwarebytes and Symantec.  Based on that information, have you tried entering extensive exclusions in both applications for one another?  If not it's definitely worth a try.  First, I'd recommend excluding all of Symantec's folders from Malwarebytes via Settings>Exclusions>Add Exclusion>Exclude a File or Folder>Next>Select Folder... and browsing to Symantec's folder in Program Files (as well as Program Files (x86) if it has both, assuming this is an x64 system), then checking C:\ProgramData to see if Symantec has any folders there, and excluding them as well if they exist.  Then check the 3 directories under C:\Users\<your user name>\AppData for any Symantec/Norton folders and excluding them as well if they exist.  And lastly, check for any Symantec/Norton drivers and services which might be stored under C:\Windows, C:\Windows\System32, C:\Windows\System32\drivers as well as C:\Windows\SysWOW64 and excluding them via the Select Files... option in Malwarebytes for exclusions.

Then you'll want to exclude Malwarebytes' folders, files and processes as extensively as possible from any and all components of Symantec that you can via its options.  The complete list of Malwarebytes entries can be found here.

Please give that a try if you haven't already to see if it helps and let us know how it goes.

Thanks

[softoutlet]

Went ahead and excluded all of the above for both antivirus and malware.  rebooted.  waited 30 minutes and results are still 15 seconds for opening up word 2010.   

could it be possible that all of the code released from microsoft patches such as spectre, etc create an issue between security apps such as symantec and malwarebytes co-existing?  

[exile360]

Yes, it's certainly possible.  There's no telling what the changes in the underlying code for thread and process handling that have been made to address those vulnerabilities might do to the performance of various applications, including anti-malware and antivirus (along with everything else; something that is still being investigated by software developers as well as Intel, AMD and Microsoft themselves).

That said, I am still hopeful that we can find some kind of solution here because that kind of lag/delay in launching your Office applications could have serious impacts on productivity if you close/open them frequently.

[Jekko]

Hi @softoutlet - I've tried replicating your issue with:

Windows 10x64
MBAM 3.3.1.2183
Symantec Endpoint 14.1 MP1
Microsoft Word 2010

I don't see your issue, Word is still opening in about 3 seconds.  Could you do the following?

First, get the diagnostic logs from this post: 

Then, download following tool and follow these steps: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

1. Have MBAM and Symantec Endpoint installed.
2. Run procmon.
3. Open Microsoft Word.
4. Save the log from procmon.
5. Attach the diagnostic logs and procmon logs here.

 

[softoutlet]

word 2010 opens in 15 seconds with mbam and symantec av together.   removing mbam it opens in 3 seconds.  does this across 5 machines. installed 3.3.4 and same thing.  

could using process monitor locate the issue ?

[nikhils]

What happens if you have Symantec and MB 3.4.4  and you turn off Anti Exploit layer in MB 3.4.4.

If possible can you please give that a go and let us know if that makes launching Word any faster ?

Thank you

[Firefox]

I see this lag as well... I am on Office 2016, MB3 v3.4.4, SEP v14.0.2332.0100

If I exit out of MB3 completely MS Word, or MS Excel (or any office product) will open rather quickly.

With MB3 turned on it takes longer to open... it loads the plugins, then stays at Processing way too long and then eventually loads...

 

[Max-H]

Well, I have office 2016 an from the moment I click the Excel shortcut, within 4 seconds I have a fresh sheet open. (not in cache memory). And 2nd time 2 seconds (Excel still in cache memory)

[nikhils]

@Firefox with MB 3.4.4 installed and with all protection layers turned on, can you please get us a set of logs?

@softoutlet can you please follow the forum post below and send us the logs.

Also wanted you guys to try something. What happens if you turn off AE in MB 3.4.4. Does this help in any way to make the office programs more responsive ?

We are trying to replicate this issue in house too. Logs will help.

Thank you.

 

Edited March 8, 2018 by nikhils

[Firefox]

@nikhils I will get you a set of logs as soon as I can...

Things have changed a little now... I had to uninstall Office 2016 in order to install Office 365 on this workstation (preparing for a rollout).  If I see the same slow down, I will try your suggestions and also get you a set of logs.

[nikhils]

Thank you for the update @Firefox

[Firefox]

56 minutes ago, nikhils said:

Thank you for the update @Firefox

I tried testing with disabling each module one at a time, all have the same results... with slow down... the only way to speed up opening office products is with MB3 not running.  With MB3 exited, the apps open much quicker... it does not stay on processing very long at all...

I have sent you a PM with my logs (with all modules on)  BTW I have mb3 files excluded from my SEP.

[nikhils]

Thank you @Firefox

I will go ahead and log the defect. Hopefully we can get to the root cause of the issue.

Thank you.

[softoutlet]

@firefox what type of machine are you running  make\model ?

[Firefox]

19 minutes ago, softoutlet said:

@firefox what type of machine are you running  make\model ?

that info is located in my sig.... (which needs a little updating.... I will get on that)

[softoutlet]

@Firefox.  so its a Dell T7910 ?   Did you recently update your BIOS to version A25  ?    A25 included the following fixes.  

Fixes & Enhancements. BIOS A25

1. Updated Chipset support
2. Updated the handling of pre-boot authentication information by firmware
3. Updated the handling of 3rd party Option ROM loading
4. Updated SPI flash command configuration settings
5. Fixed potential POST issue with joystick attached
6. Updated PS2 keyboard detection timing
7. Updated to Intel ME Firmware addressing security advisory INTEL-SA-00086
8. Updated to the latest CPU microcode to address CVE-2017-5715 and associated Intel Reboot issue

 

 

However  this seems to be the issue as to why both MB and Symantec AV  slows down opening word, excel..   Re-installing Bios version A20(yes can be reverted). fixes the slowing down of app opening including word, excel etc.   Tried this on 5.  T5810 stations and now all apps open fast!    hope this helps.

Edited March 9, 2018 by softoutlet

[Firefox]

1 hour ago, softoutlet said:

@Firefox.  so its a Dell T7910 ?   Did you recently update your BIOS to version A25  ?    A25 included the following fixes.

Interesting find, my T7810 is currently on A24 Bios so I have not updated to A25 (which has the fix for Meltdown and Spectre I presume (I think A24 did too))

I see A24 does not exist as a download any longer so they must have pulled it.  I may try and test updating to A25 first and see what it does on my system, then step down to A20 and test. 

Probably wont be till Monday though... time to go home for the weekend.