Jump to content
Mbag3rd

Malwarebytes 3.5.1 suddenly slowing down my system!

Recommended Posts

2 hours ago, Mbag3rd said:

All, are there any updates on the original problem I submitted for this thread?  Any word in re: the Dump file I submitted?

I think this:

sounds like it addresses it, or something similar. 

Share this post


Link to post
Share on other sites
2 hours ago, bdg2 said:

How does this utility deal with a single file that is hardlinked from multiple places in the directory tree? 

It sees it only as one single physical file, wherever it is located, taking up only the space of one single file.  The hard links just point to wherever that physical location is, be it inside the WinSxS directory or not.  If the physical file is not under the WinSxS directory, it won't report it there.   I guess whatever space the hard links use under the WinSxS directory might be reported there. 

Share this post


Link to post
Share on other sites
2 hours ago, bdg2 said:

I think this:

sounds like it addresses it, or something similar. 

OK Thanks!  I'll do the update and see what happens. 

Share this post


Link to post
Share on other sites
3 hours ago, Mbag3rd said:

It sees it only as one single physical file, wherever it is located, taking up only the space of one single file.  The hard links just point to wherever that physical location is, be it inside the WinSxS directory or not.  If the physical file is not under the WinSxS directory, it won't report it there.   I guess whatever space the hard links use under the WinSxS directory might be reported there. 

I don't think you understand hard links. The file is equally in the locations of any of the hard links. No single hard link is "the original", the location on the disk they point to is a sequence of allocation block numbers and can't be thought of as being more in one directory than in any other directory.

Share this post


Link to post
Share on other sites

Makes sense.  I suppose that's the difference between a hard link and a shortcut (though I guess it also has to do with the more technical voodoo of filesystems, allocation tables/MFT, disk sectors etc. as well).

Either way, it's not the most elegant solution to the problem.  It would be nice if developers of these shared components would use iterative development methods rather than creating an environment where an application might require an older version of a particular file than another thus necessitating the simultaneous installation of multiple releases/versions of various runtime files/dependencies depending on the version of the compiler used for writing the software (like if any .NET app, old or new, would function perfectly well as long as the most recent .NET version is installed).  That would also eliminate a lot of these vulnerabilities as MS and other creators of these dependencies would then only need to patch a single version rather than having to provide updates/patches for all of those that remain supported.

Share this post


Link to post
Share on other sites
4 hours ago, bdg2 said:

I don't think you understand hard links. The file is equally in the locations of any of the hard links. No single hard link is "the original", the location on the disk they point to is a sequence of allocation block numbers and can't be thought of as being more in one directory than in any other directory.

That really doesn't matter.   The physical files have to be there somewhere, regardless of where they reside or how many hard links point to them. And, however it is happening,  my utility reports a certain amount of space being tallied under the WinSxS directory. I guess if a hard link is present under WinSxS, it's counting that file size in its tally under that directory. And that tally changes regularly as Windows Updates or other installs happen. It's the only thing by which I can  judge how much space is being utilized. But, again, I seriously doubt I'll ever attempt to delete anything under the WinSxS directory.  I think the only way I can reclaim space there is a complete rebuild of my machine (where I only install the latest version of the apps I'm running).  Unfortunately, with the advent of Microsoft "activation services" for their apps, it becomes even more difficult, as they no longer provide those services for some of their older product versions. This, I guess to force you to by the "subscription" version of their products.  Not going to happen in my case.

I think when Windows 7 reaches EOL, my next builds will be Linux in nature...

 

Edited by Mbag3rd

Share this post


Link to post
Share on other sites

I can create a directory and fill

11 hours ago, Mbag3rd said:

That really doesn't matter.   The physical files have to be there somewhere, regardless of where they reside or how many hard links point to them. And, however it is happening,  my utility reports a certain amount of space being tallied under the WinSxS directory. I guess if a hard link is present under WinSxS, it's counting that file size in its tally under that directory. And that tally changes regularly as Windows Updates or other installs happen. It's the only thing by which I can  judge how much space is being utilized. But, again, I seriously doubt I'll ever attempt to delete anything under the WinSxS directory.  I think the only way I can reclaim space there is a complete rebuild of my machine (where I only install the latest version of the apps I'm running).  Unfortunately, with the advent of Microsoft "activation services" for their apps, it becomes even more difficult, as they no longer provide those services for some of their older product versions. This, I guess to force you to by the "subscription" version of their products.  Not going to happen in my case.

I think when Windows 7 reaches EOL, my next builds will be Linux in nature...

 

I can create a directory and fill it with hard links to large files that already exist on my hard drive and most utilities will say I have a huge directory. But it uses ZERO extra space on my hard drive. If I delete this seemingly huge directory I actually gain NO EXTRA SPACE at all on my hard drive. (Well actually I will gain maybe 100KiB that contained the directory entries).

Edited by bdg2

Share this post


Link to post
Share on other sites
2 minutes ago, bdg2 said:

I can create a directory and fill

I can create a directory and fill it with hard links to large files that already exist on my hard drive and most utilities will say I have a huge directory. But it uses ZERO extra space on my hard drive. If I delete this seemingly huge directory I actually gain NO EXTRA SPACE at all on my hard drive. (Well actually I will gain maybe 100KiB that contained the directory entries).

But, at some point, once you delete the last of the hard links (all of them, not just the ones you created), will it free the physical space the files occupy (at least in the directory listings)?  If not, then I think the OS has a garbage collection problem.

I don't think I've had much trouble with hard linked files when it comes to freeing up space.  I'm guessing that most times when hard links are at issue, they are associated with hidden or system files that I can't delete anyway (like those in WinSxS).  I'm only after the "low hanging fruit..."  things that are reasonably safe to delete without any adverse effects on the system... logs,  and the like. But things that utilities like Windows Cleanup seem to overlook.  I suppose if I were to encounter a hard linked file where deleting the link would not free the space (i.e. there might still be another hard link pointing to it), I'd search for that link and delete it as well, until I were able to free the space, if possible.

Share this post


Link to post
Share on other sites

Update:  I regret to advise that the original problem has reoccured. This using the following updates:

Version Info:  Malwarebytes Ver. 3.5.1.2522

Components Pkg v. 1.0.374

Update Pkg:  v 1.0.5486


All other parameters remain the same.

 

Here is the dump file:  Download Dump File Here...

Share this post


Link to post
Share on other sites
1 hour ago, dcollins said:

Thanks @Mbag3rd, can you try disabling Ransomware Protection and seeing if the problem comes back or not? 

OK, will give that a try.

Share this post


Link to post
Share on other sites
13 hours ago, dcollins said:

Thanks @Mbag3rd, can you try disabling Ransomware Protection and seeing if the problem comes back or not? 

Update:  It does appear that disabling ransomware protection has had a positive effect on the issue.  But I will give it more time and let you know.

 

Share this post


Link to post
Share on other sites

You might also check to see if disabling self-protection has any effect on the issue as it's also been known to cause compatibility issues and performance problems under some circumstances.

Share this post


Link to post
Share on other sites

Thanks for the confirmation @Mbag3rd, let me know if anything changes. We have some improvements scheduled for Ransomware Protection that should hopefully be making their way into Malwarebytes soon.

Share this post


Link to post
Share on other sites
11 hours ago, dcollins said:

Thanks for the confirmation @Mbag3rd, let me know if anything changes. We have some improvements scheduled for Ransomware Protection that should hopefully be making their way into Malwarebytes soon.

It would seem that the "Ransomware" component is the primary issue. I have had much better performance since I had it disabled.   It's been much better for at least 1.5 days.


Thank you.

Share this post


Link to post
Share on other sites
On 6/16/2018 at 10:36 AM, dcollins said:

Thanks @Mbag3rd, we should have a fix for this issue in an upcoming release

Any luck yet?  I still have Ransomware disabled, and it has still been stable for more than a week. It's just that the dashboard balks at me for not being "fully protected." ?

Share this post


Link to post
Share on other sites

Not yet unfortunately.  We don't have any ETA on the next release yet, however I have heard that it is expected to be available pretty soon (though how soon exactly I have no idea so it could be days, weeks or even a month or more at this point; it all just depends on how long development and testing take).

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.