Jump to content
PiersJ

3.5.1.2522 using 21% of CPU

Recommended Posts

Build Information

Malwarebytes version: 3.5.1.2522

Component package version: 1.0.374

Update package version: 1.0.5629

The Issue

Since updating to 3.5.x, I have noticed that after a day or so of uptime, the Malwarebytes Service uses between 15%-25% of CPU. This did not happen prior to the 3.5.x branch.

Resolution

Restarting the system resolves the issue, for a short time.

Reinstalling using the MBAM removal tool did not resolve this issue.

Any software/system changes?

No

Possible cause

1. I have five Chrome tabs permanently open in the background. One of these is rtorrent. 

2. I have mIRC running in the background.

Both of the above were running before the update.

Network

All machines have Malwarebytes 3.5.1 installed and are as follows:

1. Main workstation where this issue occurs, Windows 10 1803

2. Supermicro server, no issue (even with 24 HDDs & 2 SSDs running, as well as an outgoing server)

3. Two old HP "microservers". Old AMD-based machines where Malwarebytes runs well.

 

Screenshot 

This was taken as I am writing this post. Not only does Chrome have 21 tabs open, but a 4K YouTube video is playing less CPU resources are used. 

Conclusion

Thank you for taking the time to read this. I look forward to any suggestions to rectify this problem.

mbam1.jpg

Edited by PiersJ

Share this post


Link to post
Share on other sites

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download Malwarebytes Support Tool
  • Once the file is downloaded, open your Downloads folder/location of the downloaded file
  • Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  • Place a checkmark next to Accept License Agreement and click Next
  • You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
  • Click the Advanced Options link
    welcome mbst.png
  • Click the Gather Logs button
    gatherlogs.png
  • A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
  • Upon completion, click OK
  • A file named mbst-grab-results.zip will be saved to your Desktop
  • Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
     notify me.jpeg  

    Click "Reveal Hidden Contents" below for details on how to attach a file:
    Spoiler

    To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

    _mb_attach.jpg.a0465aaafd6cae688aa38ab16
     

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Share this post


Link to post
Share on other sites

I'm not comfortable providing logs without knowing the exact content and whether or not personal information is included.

Share this post


Link to post
Share on other sites

You can open the zip file and look at what's inside. There's no identifying information other than usernames or filenames, but if you're concerned, you can private message me the logs directly.

As for your issue at hand, can you try disabling Ransomware Protection to see if that helps performance at all? We've identified some issues with that module that we are making fixes for currently.

Share this post


Link to post
Share on other sites
9 hours ago, dcollins said:

You can open the zip file and look at what's inside. There's no identifying information other than usernames or filenames, but if you're concerned, you can private message me the logs directly.

As for your issue at hand, can you try disabling Ransomware Protection to see if that helps performance at all? We've identified some issues with that module that we are making fixes for currently.

I attempted to disable Web Protection, Exploit Protection, Malware Protection, and Ransomware Protection. I have tried disabling in order, as well as disabling all features. The MBAM (or whatever it's supposed to be called) service continued to use up to approximately 25% (21% at time of the initial post).

I have attached the logs. 

mbst-grab-results.zip

Share this post


Link to post
Share on other sites

Thanks @PiersJ. I don't initially see anything jumping out, however it does look like another diagnostic utility failed to run named FRST, which is strange.

Out of curiosity, does this happen consistently, or perhaps only when a scan is running?

Share this post


Link to post
Share on other sites
2 hours ago, dcollins said:

Thanks @PiersJ. I don't initially see anything jumping out, however it does look like another diagnostic utility failed to run named FRST, which is strange.

Out of curiosity, does this happen consistently, or perhaps only when a scan is running?

Thank you for looking at the logs, Devin.

1.  I'm not aware of FRST, although a Google search shows an application for Windows XP up to 8. I even viewed a video of FRST in action - I've never seen it before.

2. This happens whenever the PC is on for more than an hour or so. I checked whilst writing this reply and the process is at 31%, although has now reduced down to 7%. 

Edited by PiersJ

Share this post


Link to post
Share on other sites

Can you please download the following zip file, and the next time you notice a high CPU usage, follow the details below?

  1. Download and extract Procdump.zip
  2. Wait for high CPU usage from mbamservice
  3. Once it happens, right click on 5 - mbamservice_memory.bat and choose Run as administrator
  4. A black window should come up and eventually go away
  5. Zip the .dmp file that can be found in the same folder as the batch file, and attach it in your reply

Share this post


Link to post
Share on other sites

I have the same problem. If I open task manager and stop Malwarebytes Service the service restarts and usage returns back to .5. Same thing if I close Malwarebytesthen restart it. The usage spike seems to occur sometime overnight after my scheduled scan Thanks.

Share this post


Link to post
Share on other sites

@Jackietools I would expect a CPU spike during the scheduled scan, but not to persist after. If you can provide the same memory dump I asked for, that would help.

Share this post


Link to post
Share on other sites

The dump file is 426MB. I don't have a service to upload it to. Can you please provide FTP or other options? I've attached as screenshot showing the file size (I followed the instructions exactly).

dump.png

Share this post


Link to post
Share on other sites
On 7/5/2018 at 8:17 PM, dcollins said:

You can use wetransfer.com to upload the file and generate a download link. Thanks @PiersJ

 

On 7/5/2018 at 8:23 PM, PiersJ said:

Thank you. Here's the link: https://we.tl/NzfQI7MJvE

Is there any update on this?

Share this post


Link to post
Share on other sites

It looks like Ransomware Protection has been attached to something for a long time, which may be what we're seeing. Can you try installing the beta version to see if it helps at all, since it has some improvements to Ransomware Protection? You can do this by going to Settings -> Application, and scrolling down until you see the Beta Opt In option. Turn on the option, then scroll up and click "Install Application Updates". Once the update completes, use your computer as normal.

Share this post


Link to post
Share on other sites
On 7/9/2018 at 3:27 PM, dcollins said:

It looks like Ransomware Protection has been attached to something for a long time, which may be what we're seeing. Can you try installing the beta version to see if it helps at all, since it has some improvements to Ransomware Protection? You can do this by going to Settings -> Application, and scrolling down until you see the Beta Opt In option. Turn on the option, then scroll up and click "Install Application Updates". Once the update completes, use your computer as normal.

The warning is concerning, but I understand why it exists. I do have backups of most files, but I'd rather not backup the four drives on this workstation just for a beta update. The notice also states that no support will be given for beta client users.

How stable is the existing beta?

When is the expected release into the current branch?

Finally, which process has the ransomware module been attached to? 

Thank you for your help so far.

Share this post


Link to post
Share on other sites

The beta was actually promoted to the release last Monday, you can install by going to Settings -> Applications and click Install Application Updates.

Share this post


Link to post
Share on other sites
On 7/16/2018 at 3:38 PM, dcollins said:

The beta was actually promoted to the release last Monday, you can install by going to Settings -> Applications and click Install Application Updates.

My version, even after a reset, still shows no update (it's on 3.5.1.2522). 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.