MBAM + Visual Studio 2017 output logging = massive lag

[MFHSchoonbrood]

Hi guys,

I notice lag when closing my application in visual studio, further investigation resulted in logging info to the output window of visual studio to be the culprit.

Attached you will find a simple visual studio 2017 project, that contains a winmain that will send 100 messages to the debuggers output window, and then measure the time this took.
If you run this with ransomware protection ON, than it takes 500ms (on my system), and if you run it with ransomware protection OFF, it only takes 6ms!!!

Since I spend most of my day in visual studio, I can now no longer use the ransomware protection, as it creates major annoying lag moments.

Please investigate what is going wrong here with the ransomware detection!

Kind regards,
Michael

PS:
Used software is Visual Studio Enterprise on Windows 10 with Malwarebytes Premium v3.5.1.

PPS:
Here is the winmain.cpp code, in case you rather create your own project:

#include <windows.h>
#include <stdio.h>
#include "mmsystem.h"
#pragma comment( lib, "winmm.lib" )


int WINAPI WinMain(	HINSTANCE hinstance, HINSTANCE hprevinstance, LPSTR lpcmdline, int ncmdshow)
{
	// Start the timer
	timeBeginPeriod( 1 );
	unsigned long startTime = timeGetTime();

	// Send a lot of messages to the output window of visual studio
	char outputMsg[255] = "\0";
	int testSize        = 1000;
	for (int msg = 0; msg < testSize; ++msg)
	{
		sprintf_s( outputMsg, 255, "Dummy output msg %4d\n", msg+1 );
		// Compile a msg
		OutputDebugString( outputMsg );
	}

	// End the timer
	unsigned long endTime = timeGetTime();
	timeEndPeriod( 1 );

	// Show result
	char result[255] = "\0";
	sprintf_s( result, 255, "Sending %d messages to VS output took %d ms", testSize, endTime-startTime );
	::MessageBoxA( NULL, result, "MBAM output test result", MB_OK );

	// Done
	return 0;
}

 

mbam_test.rar

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
• Click the Gather Logs button
  
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
     
  
  Click "Reveal Hidden Contents" below for details on how to attach a file:
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[MFHSchoonbrood]

Dear bot, please have on of your developers look at this

[dcollins]

Thanks. This is an issue we were finally able to confirm recently and are working on a solution. Unfortunately there is no workaround at this time other than disabling Ransomware Protection.

[MFHSchoonbrood]

Hopefully having it fully reproducible will help in fixing it.

Good luck with the hunt

[GuyJackson]

Hi

It's not limited to VS 2017. This is what happens on VS 2015:

The below segment of C# code takes 60949 ms to run with MalwareBytes ON. With Malwarebytes OFF, it takes 345 ms.

DateTime dtThen = DateTime.Now;
for (int i = 0; i < 1000; i++)
{
	Debug.WriteLine("Iteration {0}", i);
}
DateTime dtNow = DateTime.Now;
Debug.WriteLine("Total time taken: {0}", (dtNow - dtThen).TotalMilliseconds);

It appears to be anytime Visual Studio and the attached debugged application communicate, either via output window writing or call stack/exception/variable inspection.

We use Malwarebytes Endpoint Protection, so the developers don't have the option of turning off just ransomware protection, they can only stop the whole MBAMService.

Please let us know if there is a workaround other than disabling the service entirely, or if/when the problem will be resolved?

Thanks,

Guy