PiersJ Posted June 26, 2018 ID:1252703 Share Posted June 26, 2018 (edited) Build Information Malwarebytes version: 3.5.1.2522 Component package version: 1.0.374 Update package version: 1.0.5629 The Issue Since updating to 3.5.x, I have noticed that after a day or so of uptime, the Malwarebytes Service uses between 15%-25% of CPU. This did not happen prior to the 3.5.x branch. Resolution Restarting the system resolves the issue, for a short time. Reinstalling using the MBAM removal tool did not resolve this issue. Any software/system changes? No Possible cause 1. I have five Chrome tabs permanently open in the background. One of these is rtorrent. 2. I have mIRC running in the background. Both of the above were running before the update. Network All machines have Malwarebytes 3.5.1 installed and are as follows: 1. Main workstation where this issue occurs, Windows 10 1803 2. Supermicro server, no issue (even with 24 HDDs & 2 SSDs running, as well as an outgoing server) 3. Two old HP "microservers". Old AMD-based machines where Malwarebytes runs well. Screenshot This was taken as I am writing this post. Not only does Chrome have 21 tabs open, but a 4K YouTube video is playing less CPU resources are used. Conclusion Thank you for taking the time to read this. I look forward to any suggestions to rectify this problem. Edited June 26, 2018 by PiersJ Link to post Share on other sites More sharing options...
Staff Malwarebytes Posted June 26, 2018 Staff ID:1252704 Share Posted June 26, 2018 ***This is an automated reply*** Hi, Thanks for posting in the Malwarebytes 3 Help forum. If you are having technical issues with our Windows product, please do the following: Spoiler If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply: NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download Malwarebytes Support Tool Once the file is downloaded, open your Downloads folder/location of the downloaded file Double-click mb-support-X.X.X.XXXX.exe to run the program You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent. Place a checkmark next to Accept License Agreement and click Next You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!" Click the Advanced Options link Click the Gather Logs button A progress bar will appear and the program will proceed to gather troubleshooting information from your computer Upon completion, click OK A file named mbst-grab-results.zip will be saved to your Desktop Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so: Click "Reveal Hidden Contents" below for details on how to attach a file: Spoiler To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button. One of our experts will be able to assist you shortly. If you are having licensing issues, please do the following: Spoiler For any of these issues: Renewals Refunds (including double billing) Cancellations Update Billing Info Multiple Transactions Consumer Purchases Transaction Receipt Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 Thanks in advance for your patience. -The Malwarebytes Forum Team Link to post Share on other sites More sharing options...
PiersJ Posted June 26, 2018 Author ID:1252707 Share Posted June 26, 2018 I'm not comfortable providing logs without knowing the exact content and whether or not personal information is included. Link to post Share on other sites More sharing options...
dcollins Posted June 26, 2018 ID:1252788 Share Posted June 26, 2018 You can open the zip file and look at what's inside. There's no identifying information other than usernames or filenames, but if you're concerned, you can private message me the logs directly. As for your issue at hand, can you try disabling Ransomware Protection to see if that helps performance at all? We've identified some issues with that module that we are making fixes for currently. Link to post Share on other sites More sharing options...
PiersJ Posted June 27, 2018 Author ID:1252865 Share Posted June 27, 2018 9 hours ago, dcollins said: You can open the zip file and look at what's inside. There's no identifying information other than usernames or filenames, but if you're concerned, you can private message me the logs directly. As for your issue at hand, can you try disabling Ransomware Protection to see if that helps performance at all? We've identified some issues with that module that we are making fixes for currently. I attempted to disable Web Protection, Exploit Protection, Malware Protection, and Ransomware Protection. I have tried disabling in order, as well as disabling all features. The MBAM (or whatever it's supposed to be called) service continued to use up to approximately 25% (21% at time of the initial post). I have attached the logs. mbst-grab-results.zip Link to post Share on other sites More sharing options...
dcollins Posted June 28, 2018 ID:1253154 Share Posted June 28, 2018 Thanks @PiersJ. I don't initially see anything jumping out, however it does look like another diagnostic utility failed to run named FRST, which is strange. Out of curiosity, does this happen consistently, or perhaps only when a scan is running? Link to post Share on other sites More sharing options...
PiersJ Posted June 28, 2018 Author ID:1253185 Share Posted June 28, 2018 (edited) 2 hours ago, dcollins said: Thanks @PiersJ. I don't initially see anything jumping out, however it does look like another diagnostic utility failed to run named FRST, which is strange. Out of curiosity, does this happen consistently, or perhaps only when a scan is running? Thank you for looking at the logs, Devin. 1. I'm not aware of FRST, although a Google search shows an application for Windows XP up to 8. I even viewed a video of FRST in action - I've never seen it before. 2. This happens whenever the PC is on for more than an hour or so. I checked whilst writing this reply and the process is at 31%, although has now reduced down to 7%. Edited June 28, 2018 by PiersJ Link to post Share on other sites More sharing options...
dcollins Posted June 28, 2018 ID:1253268 Share Posted June 28, 2018 Can you please download the following zip file, and the next time you notice a high CPU usage, follow the details below? Download and extract Procdump.zip Wait for high CPU usage from mbamservice Once it happens, right click on 5 - mbamservice_memory.bat and choose Run as administrator A black window should come up and eventually go away Zip the .dmp file that can be found in the same folder as the batch file, and attach it in your reply Link to post Share on other sites More sharing options...
Jackietools Posted June 28, 2018 ID:1253311 Share Posted June 28, 2018 I have the same problem. If I open task manager and stop Malwarebytes Service the service restarts and usage returns back to .5. Same thing if I close Malwarebytesthen restart it. The usage spike seems to occur sometime overnight after my scheduled scan Thanks. Link to post Share on other sites More sharing options...
dcollins Posted June 28, 2018 ID:1253339 Share Posted June 28, 2018 @Jackietools I would expect a CPU spike during the scheduled scan, but not to persist after. If you can provide the same memory dump I asked for, that would help. Link to post Share on other sites More sharing options...
Jackietools Posted June 28, 2018 ID:1253360 Share Posted June 28, 2018 will do. Thanks Link to post Share on other sites More sharing options...
Jackietools Posted July 1, 2018 ID:1253985 Share Posted July 1, 2018 Too big > says only 58MB file is over 100 Link to post Share on other sites More sharing options...
Jackietools Posted July 1, 2018 ID:1253987 Share Posted July 1, 2018 https://drive.google.com/file/d/1sehNa12CnZptikKr0kE7eO4U9f7CApem/view?usp=sharing Hopefully you can get it this way Link to post Share on other sites More sharing options...
PiersJ Posted July 5, 2018 Author ID:1254958 Share Posted July 5, 2018 The dump file is 426MB. I don't have a service to upload it to. Can you please provide FTP or other options? I've attached as screenshot showing the file size (I followed the instructions exactly). Link to post Share on other sites More sharing options...
dcollins Posted July 5, 2018 ID:1254960 Share Posted July 5, 2018 You can use wetransfer.com to upload the file and generate a download link. Thanks @PiersJ Link to post Share on other sites More sharing options...
PiersJ Posted July 5, 2018 Author ID:1254962 Share Posted July 5, 2018 3 minutes ago, dcollins said: You can use wetransfer.com to upload the file and generate a download link. Thanks @PiersJ Thank you. Here's the link: https://we.tl/NzfQI7MJvE Link to post Share on other sites More sharing options...
PiersJ Posted July 9, 2018 Author ID:1255550 Share Posted July 9, 2018 On 7/5/2018 at 8:17 PM, dcollins said: You can use wetransfer.com to upload the file and generate a download link. Thanks @PiersJ On 7/5/2018 at 8:23 PM, PiersJ said: Thank you. Here's the link: https://we.tl/NzfQI7MJvE Is there any update on this? Link to post Share on other sites More sharing options...
Jackietools Posted July 9, 2018 ID:1255577 Share Posted July 9, 2018 Sorry on vacation. Be back on 14th. I will send info then Link to post Share on other sites More sharing options...
dcollins Posted July 9, 2018 ID:1255584 Share Posted July 9, 2018 It looks like Ransomware Protection has been attached to something for a long time, which may be what we're seeing. Can you try installing the beta version to see if it helps at all, since it has some improvements to Ransomware Protection? You can do this by going to Settings -> Application, and scrolling down until you see the Beta Opt In option. Turn on the option, then scroll up and click "Install Application Updates". Once the update completes, use your computer as normal. Link to post Share on other sites More sharing options...
Jackietools Posted July 14, 2018 ID:1256636 Share Posted July 14, 2018 Just updated to beta! Link to post Share on other sites More sharing options...
PiersJ Posted July 14, 2018 Author ID:1256639 Share Posted July 14, 2018 On 7/9/2018 at 3:27 PM, dcollins said: It looks like Ransomware Protection has been attached to something for a long time, which may be what we're seeing. Can you try installing the beta version to see if it helps at all, since it has some improvements to Ransomware Protection? You can do this by going to Settings -> Application, and scrolling down until you see the Beta Opt In option. Turn on the option, then scroll up and click "Install Application Updates". Once the update completes, use your computer as normal. The warning is concerning, but I understand why it exists. I do have backups of most files, but I'd rather not backup the four drives on this workstation just for a beta update. The notice also states that no support will be given for beta client users. How stable is the existing beta? When is the expected release into the current branch? Finally, which process has the ransomware module been attached to? Thank you for your help so far. Link to post Share on other sites More sharing options...
Jackietools Posted July 15, 2018 ID:1256725 Share Posted July 15, 2018 I cannot answer these questions. You would have to ask the moderator. I am just following advice. Link to post Share on other sites More sharing options...
dcollins Posted July 16, 2018 ID:1256896 Share Posted July 16, 2018 The beta was actually promoted to the release last Monday, you can install by going to Settings -> Applications and click Install Application Updates. Link to post Share on other sites More sharing options...
PiersJ Posted July 17, 2018 Author ID:1257105 Share Posted July 17, 2018 On 7/16/2018 at 3:38 PM, dcollins said: The beta was actually promoted to the release last Monday, you can install by going to Settings -> Applications and click Install Application Updates. My version, even after a reset, still shows no update (it's on 3.5.1.2522). Link to post Share on other sites More sharing options...
Jackietools Posted July 17, 2018 ID:1257111 Share Posted July 17, 2018 Same here Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now