Jump to content
MusicCityTiger

Micro-stuttering bad on Win10 after latest MBW EPS update?

Recommended Posts

After the latest Malwarebytes EPS agent update, all of my Win10 Pro workstations and laptop users are having slowness & constant micro-stuttering / freezing while working.  Affecting typing in Word/Excel, surfing web with ANY browser, scrolling pages, etc...   Anyone else seeing this issue?  It's driving my customer's users crazy and I know it is MWB, because when I stopped the Malwarebytes Service and Endpoint Agent Service on a test machine,  the problem goes away completely and everything speeds back up with no stuttering or freezing anymore.

 

Thanks, 

ZEN Solutions LLC

Share this post


Link to post
Share on other sites

Greetings,

To test which component may be at fault, could you use a system affected by this and disable just one protection component at a time to see if a single one is responsible?  My suspicion is that it is most likely Ransomware Protection as it tends to be the most resource intensive since it monitors virtually all process and disk activity to watch for ransomware behavior, but it could possibly be one of the others.  This should help you/your users/customers as well since disabling a single module until this is resolved or a better workaround is found is certainly preferable to disabling Malwarebytes completely.

Please let us know how the testing goes if you are able to complete it as I am sure this information would help the Malwarebytes team to troubleshoot and fix the issue.

Thanks

Share this post


Link to post
Share on other sites

I  will try that, but if it is the ransomware module as your suspect, then that makes MWB a no-go with this customer as ransomware is their chief concern, and if I have to disable the ransomware module I may as well replace MWB with something else.

Share this post


Link to post
Share on other sites

I definitely understand where your customer is coming from, however it might help if I explain a bit of detail about how the Ransomware Protection in Malwarebytes works.  It's basically a secondary layer of defense designed to stop a ransomware attack once the system has already been infected by it through monitoring in real-time for ransomware behavior.  The vast majority of the time ransomware gets in via some other means, most often exploits on infected websites or in infected ads on otherwise safe websites (known as malvertisements) or through malicious email attachments which themselves are specially crafted documents containing exploits for the office/document applications used to open them like your PDF reader or Word document viewer (MS Word etc.) and the other modules in Malwarebytes such as Exploit Protection, Web Protection and the primary Malware Protection layer will most often stop an attack during those early phases before any actual ransomware is able to load onto the system to attempt to encrypt any files (the behavior that Ransomware Protection watches for and guards against).

The diagram found on this page will give you a good idea of how the various layers in Malwarebytes function throughout the various stages of the attack chain to stop attacks at every step of an infection attempt, with Ransomware Protection coming into play late in the chain after the execution phase of malware.  While it is certainly not ideal to disable any component of protection, this one is not the most proactive of defensive layers in Malwarebytes (those would be Exploit Protection and Web Protection, followed closely by the signature-less heuristics/anomaly detection aspects of the Malware Protection module which also uses traditional threat signatures to detect known threats).

Share this post


Link to post
Share on other sites

To chime in on what exile360 said, finding out which realtime engine is responsible for the behavior you are seeing helps narrow down the troubleshooting process. We don't want you to have this portion of the realtime disabled indefinitely.

Share this post


Link to post
Share on other sites

Glad to have found this thread. I have had the same issue for some time now.  I would like to troubleshoot.  Next I experience the problem, I will disable component by component and re-test.  Thank you.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.