Malwarebytes 3.3.1.2183 MS Word 2010 opens up slowly Windows 10 pro

[Firefox]

Well I decide to try out the BIOS update/downgrade.

First update from A24 to A25 Bios... saw no improvement with Office apps opening quickly (with MB3 enabled)

Downgraded to A20 Bios and I did see an improvement with opening office apps MB3 enabled.  However turning off MB3 off completely really speeds up the opening of documents.

So the best performance is with MB3 not running. (although A20 Bios did show a noticeable improvement)

NOTE: I do have a Precision T5600 with Bios A15, Win10 64bit, 16GB Ram, SSD HD, 12 Cores, Office 2016, SEP 14.0.2332.0100, MB3 3.4.4

This computer has no issues with slowness opening Office Apps (basically running same programs/config)

Edited March 10, 2018 by Firefox
Added Note

[softoutlet]

@FireFox.  BIOS A24 had issues and was immediately pulled from Dells downloads.   latest AV Symantec version is 14.0.3876. MP1.  when installing both latest AV and MB versions speeds are near identical with bios A20.   but with bios A25 either the MB or AV needs to be OFF or uninstalled for speeds to show improvement.   therefore downgrading it to A20 seems to be another solution at the moment.  

[Firefox]

@softoutlet Yes thanks for that info... I was aware A24 was pulled, I still had it installed on mine (for testing out, and because I had no real noticeable issues except for this slow down (which I could not pinpoint it till now)).  I am on A20 for now and will update my Symantec, and test things out.

That being said, staying on A20 will make us vulnerable to Meltdown and Spectre.  The reason they are rolling out new Bios updates is to fix that bug on the chipsets.

6 in one hand, half a dozen in the other...

[Immersion]

I've also started experiencing this issue on my work laptop a Dell Latitude E5250 with BIOS A19 installed.

I'm using Microsoft Office 2016 which is taking a long time to open & is also causing delays in the actual application itself.

I'm running Malwarebytes version: 3.4.4.2398, exiting Malwarebytes stops these issues.

As a test I removed all other antivirus & just ran Malwarebytes but the issue is still there. 

[Firefox]

@Immersion if you don't mind can you provide the logs below so the team can review them and perhaps it could help them isolate the issue so they can fix it.

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues....
 

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop
   Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
3. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
4. Press the "Scan" button
5. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   
   • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
     
6. NEXT: Create and obtain an mb-check log
7. Download MB-Check and save to your desktop
8. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK"
9. This will produce one log file on your desktop: mb-check-results.zip
   
   • This file will include the FRST logs generated from the previous set of instructions
   • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area
     
   
   
   

 

[Immersion]

@Firefox Please find the zip file attached as requested.

mb-check-results.zip

[Firefox]

4 hours ago, Immersion said:

@Firefox Please find the zip file attached as requested.

mb-check-results.zip

Thanks for those logs, lets wait for @Jekko and @nikhils to grab them and review them.

In the meantime, not that this will fix your issue, but it can be part of some issues..

I see you are running MB in compatibility mode. Please remove those settings. Then restart your computer.

1. Go to the folder C:\Program Files\Malwarebytes\Anti-Malware\
2. Find the file mbam.exe and right click on it and choose Properties
3. In the window that pops up click on Compatibility Tab
4. Remove any changes there that don't match my picture below and click OK
   

Edited March 11, 2018 by Firefox
added compatibility notes

[nikhils]

Hello @Immersion

Thank you for the logs. We are tracking this issue internally.

One quick question. What happens when you turn off Anti Exploit setting within Malwarebytes.

Does Office open any faster with AE turned off?

Thank you.

[Immersion]

2 hours ago, nikhils said:

Hello @Immersion

Thank you for the logs. We are tracking this issue internally.

One quick question. What happens when you turn off Anti Exploit setting within Malwarebytes.

Does Office open any faster with AE turned off?

Thank you.

 Hi @nikhils

When AE is disabled it makes no noticeable difference for me.

[Firefox]

@Immersion just curious, what is the make and model of this computer?  Is it a Dell by any chance? What BIOS version do you have installed?

[Immersion]

Hi @Firefox

It's a Dell Latitude E5250 with BIOS A19 installed (most recent from Dell website)

It was released on the 27th feb to patch the spectre & meltdown issues:

"Updated to the latest CPU microcode to address CVE-2017-5715 and associated Intel Reboot issue" 

[Firefox]

There are a couple of us that installed that latest BIOS from dell that patch the spectre & meltdown issues.  I know they reported there would be a performance hit.  I as well as others have tested with installing an older BIOS and that really helped with the speed issues.  Its up to you if you would like to test that out. 

For my computer, A24 Bios was released and then pulled.  A new one A25 went out, I installed it and I still had a big performance hit on everything on my computer.  A20 seems to work best at the moment.

That being said, if I exit out of Malwarebytes completely and with the latest BIOS A25, there is no performance hit at all.

[Jekko]

On 3/7/2018 at 10:21 PM, softoutlet said:

could using process monitor locate the issue ?

@softoutlet - Process Monitor will record what is happening on your computer at the time, and what I hope to see is what processes are running at the time of word 2010 being opened.  This way I can see if there is a conflict with another program at the time.

Also, we still want to get diagnostic logs from you. We have not received your logs.

 

[boombastik]

the slow execution of office and eventviewer is because of selfprotection.

If u disable it the office starts in half time.

Edited March 14, 2018 by boombastik

[smipx013]

Hi there,

 

I am having the same issue.  I was getting annoyed with Office 2010 (Word in particular) taking 8 seconds or so to launch.  One day I happened to remove Malwarebytes 3.5.1.2522-1.0.365-1.0.5110 and word launched in less than 1 second.

My machine is not a Dell its an intel Mobo (DQ77CP) with the latest patches and latest BIOS but I was also having the same issue on my old Gigabyte mobo running an AMD Athlon 2 processor before I upgraded to this intel i5 board.

I also have the issue when running with Avast Free and also when running with Panda Dome Free and BD Free (all on this mobo and avast on the Gigabyte mobo.  The reason I stumbled across this is because BD free makes you uninstall MBAM prior to its installation. Of course - I installed MBAM right after as it will be fine.

so.....   2 different Mobo's; 3 different AV's and all have the Office 2010 Word 7-10 seconds to load issue.  I tried all sorts of things to speed up the loading of Word 2010 (things like clearing caches, a new normal.Dotx, removing network shares and many many many other tweaks to narrow it down. It did not even occur to me to remove MBAM as I have been using it for donkey's years - I was so annoyed when I came across the cause as I have probably spent days and days trying to speed up the launch of Word 2010 over the last 12 months.

 

I have all the modules enabled and also the Rootkit scan option enabled. If I disable the self-protection module it drops to about 2 seconds. If I uninstall MBAM it drops to less than 1 second to load Word 2010.

I am happy to send logs etc to support to help troubleshoot if they reach out to me.

 

Cheers,

Paul

 

Edited May 25, 2018 by smipx013

[exile360]

Greetings Paul,

Yes, it sounds like you've encountered a known issue with Ransomware Protection or the issue mentioned with Self-Protection as mentioned above.  If you disable just that component in Malwarebytes does the issue go away (try each one individually to determine which it is, with the other enabled to rule it out)?

As for logs, they could certainly prove useful for the Devs.  If you wish you may do the following:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced Options on the main page (not Get Started)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

It could also be useful to get a memory dump from both MBAMService.exe and WINWORD.EXE to provide further details:

• Press CTRL+SHIFT+ESC on your keyboard to launch Task Manager and make sure the Processes tab is selected then click on Show processes from all users
• Attempt to launch Word then proceed with the next step for each process while it is still trying to load but before it has completed (you might have to repeat it if you don't have time for both while it's still launching; reboot the system and try again if it launches too quickly the second time as caching may affect it)
• Click on the Image Name column header twice to sort the processes alphabetically then scroll down the list until you find MBAMService.exe then right-click on it and select Create Dump File then do the same for WINWORD.EXE
• Navigate to the temp folder where they were created (you'll see it in a pop-up dialog after the dump is created) and move them to your desktop or some other convenient location where you can easily find them
• Select both files then right-click on one and hover your mouse over Send to and select Compressed (zipped) folder then attach the resulting ZIP file to your next reply, or if it is too large, go ahead and upload it to a filesharing service such as wetransfer.com and provide us with the download link

Edited May 25, 2018 by exile360

[smipx013]

Hi,

 

I will gather the logs for sure.  I would prefer my logs not to be on a public forum though so is there a way I can upload them to a support ticket instead? (I guess I might have to create a ticket for that). 

btw. It's the disabling of the self-protection module that speeds it all up for me (even if the anti-ransomware is left enabled). 

 

Cheers,

Paul

 

[exile360]

Yep, you can create a support ticket instead if you prefer the logs be kept private  

Just inform them of what the issue is and why you're providing the data, including the workaround (disabling Self-Protection) that way they're sure to provide the info to the Dev team.

The option to create a support ticket can be found on this page.

 

[Seventies]

I found the same problems with Office and also found that disabling self-protection is the solution.

Launching a new Word document: MB closed 2 seconds, MB running, but without self-protection 3 seconds, with self-protection, about 8 to 10 seconds.

I enclose in addition the memory dump files (with self-protection) : https://www.dropbox.com/s/ydmypg9eabbj2h4/Dump Files.zip?dl=0

mbst-grab-results.zip

[smipx013]

Hi,

 

I logged a ticket with support Reference 2325701.

They are fully aware of the defect apparently but could give no commitment if it would be fixed (or any likely time frame) so for anyone suffering this inconvenience - sorry to be the bearer of bad news :-(

Cheers,

Paul

[Seventies]

9 minutes ago, smipx013 said:

Hi,

 

I logged a ticket with support Reference 2325701.

They are fully aware of the defect apparently but could give no commitment if it would be fixed (or any likely time frame) so for anyone suffering this inconvenience - sorry to be the bearer of bad news :-(

Cheers,

Paul

Thanks for the feedback. I think the more a problem is reported, the faster it is corrected.