CU 1.0.508 causing lag in Win 10 Sign-on

[f14tomcat]

Windows 10 Pro 17763.168 (1809) - i7-7700k.

 

This issue occurs only in Pro, not Free.  After boot and display of the Welcome screen, there is a noticeable lag at the Welcome screen.  Startup sound is delayed by at least 2 seconds.  Clicking or pressing enter to get the sign-on box does not appear for several seconds. After entering PW/PIN, there is a lengthy process displayed of "Waiting for Initialize Profile" (not exact words), "Preparing Desktop", etc.  Finally goes to Desktop.  None of this happened prior to 1.0.508, it was all nearly instantaneous.

Setting delay of 15 seconds removes the issue and all was as before this CU.  Setting the service to Auto(delayed start) also removes the issue.  Both are workarounds.  This did not occur on the previous CU.  I did have the Beta prior to all this, and it, too, had the same issues.  I reverted to Public Release and the issues resolved.  But when this CU was installed, the issues returned.  I have done clean installs using the  mb-clean-3.1.0.1035.1 and the mb-support-1.3.1.553.  I have also completely uninstalled it using Revo Uninstaller Pro 4.0.1 and re-installed clean using the latest downloaded today mb3-setup-consumer-3.6.1.2711-1.0.508-1.0.8211, which has the 1.0.508 incorporated.   All to no avail.  There do not appear to be any other side effects, except this startup issue.  Attached is the clean log and mbst-grab-results. 

Thank you for your help.

 

mbst-clean-results.txt

mbst-grab-results.zip

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[AdvancedSetup]

Thank you for the logs and the information @f14tomcat 

I will let our QA team know so they can take a look at your logs too. Hopefully, we can get this resolved soon

Ron

 

[exile360]

Greetings,

If you wouldn't mind doing a bit more troubleshooting, I have a couple of theories I'd like for you to test as I suspect this may be related to some other similar issues we've been seeing with the latest release.

If you would, please try disabling the Ransomware Protection component in Malwarebytes and configure it to startup normally/without a delay and see if just having that component of protection disabled also resolves the issue.

Also, please try reconfiguring User Account Control to its default settings; while I sincerely doubt this is related, I'd just like to eliminate it as a variable since it was one of the few things that stood out in your logs to me, and once you've tested by resetting it to default and restarting, if the issue persists, you may then set UAC back to the way you had it.

Next, please verify that you have the latest drivers for your Killer NIC as we've seen several issues with Killer Network device drivers in the past with Malwarebytes which were resolved by installing the latest driver version from their site which may be found here (according to the logs you have the E2400 which that driver package applies to, among other devices).

[f14tomcat]

Sorry for the delay.  Sunday, and all.

I like to make one change at a time, to avoid the inevitable question "Which one fixed it"?  😉  So first I disabled the Ransomware, re-booted, and the issues disappeared.  All came up normally, quickly, and correctly.  Let it settle for a few minutes, and re-booted again.  Same.  All back to normal.  Enabled Ransomware, re-booted, and all the previous issues came back exactly as before.  Again, waited a few and re-booted.  Same.  Issues were there.   I have not changed anything else.  No change to UAC nor enabling of Restore Points.  Just the Ransomware, which as of now is still enabled, with the issues. 

If you feel I need to do the other steps, please advise, but this seems to point to Ransomware Protection causing the delay.

Regarding the NIC, all current per pic.  It is the latest per WHQL and Dell.  I would prefer not to update it if not necessary.

[f14tomcat]

Follow up.....

I had time, so I did a backup and installed the latest NIC driver from Rivet, and set the UAC to level 2.  With Ransomware enabled, same issues.  Disabled, fixed. 

 

A note that may be helpful.  After the Welcome screen is up, sound played and background pic, if I let it just sit for 20 seconds or so, it pops up the sign-in box, and goes to Desktop much quicker.  Still all the messages as before, and a slight lag, but a bit quicker. 

I have also tested all these scenarios on another virtually identical 1809 OS, under dual-boot, that I use as a test bed.  Only difference is the test bed OS 1809 is under a different MS account.  Same results.

Under both OS's, the display name pops up with delay, then the account picture follows after about 2 seconds.

I'm not an engineer, but it seems that the Winlogon process is having timing trouble getting the profile verified from the MS server, causing delays in the whole process.  All just IMO.

 

[dcollins]

Can you get a procmon boot log of your login? The steps for this are below:

1. Enable Ransomware Protection
2. Download and launch Procmon
3. Accept the EULA
4. Click Options -> Enable Boot Logging -> Ok
5. Restart the computer and then login (it should be slow still)
6. Once the login is complete, open Procmon again and it should ask to save the boot log
7. Save the log somewhere you can find it
8. Find the log, right click it and choose Send to -> Compressed (Zipped) folder
9. Upload the zip file in your response. If the zip file is too large, upload it to wetransfer.com and generate a download link, then share the download link here

Thanks in advance

[f14tomcat]

I'll give it a go............

[f14tomcat]

3 hours ago, dcollins said:

Can you get a procmon boot log of your login? The steps for this are below:

1. Enable Ransomware Protection
2. Download and launch Procmon
3. Accept the EULA
4. Click Options -> Enable Boot Logging -> Ok
5. Restart the computer and then login (it should be slow still)
6. Once the login is complete, open Procmon again and it should ask to save the boot log
7. Save the log somewhere you can find it
8. Find the log, right click it and choose Send to -> Compressed (Zipped) folder
9. Upload the zip file in your response. If the zip file is too large, upload it to wetransfer.com and generate a download link, then share the download link here

Thanks in advance

Hope this is what you expected.  Procmon created 9 zipped log files, not 1.

Wetransfer link: https://we.tl/t-6Xm6cuj0Pu

 

[f14tomcat]

Any news?

[f14tomcat]

That link I gave you has probably expired by now.  Any news?  Next steps? 

[f14tomcat]

Any info at all on progress or status would be appreciated.  Just to know this ticket is still alive. 

Thanks.

( If full system specs would be of any help, they can be found on my profile at Tenforums.com  - https://www.tenforums.com/members/f14tomcat.html

[Firefox]

Lets ping @dcollins and @AdvancedSetup to see if they have any more info to share with you...

[f14tomcat]

Thank you.  Like throwing pebbles at the window.......  😉

[Firefox]

Your welcome, they are tagged here so they should see this post

[AdvancedSetup]

I'm not sure. I've sent an alert to our Quality Control for an update on this. Have not heard back. Very sorry about that.

 

[f14tomcat]

7 hours ago, AdvancedSetup said:

I'm not sure. I've sent an alert to our Quality Control for an update on this. Have not heard back. Very sorry about that.

 

Thanks for the follow up.  I'll sit tight. 

Yesterday, I took the time to do a complete in-place repair install of the OS.  17734.194.  No change is symptoms or results.  Just a few minutes ago, as a sanity check, disabled Ransomware Protection and rebooted.  Fast, quick, no lag, desktop in less than 3 seconds.

[tetonbob]

On 12/12/2018 at 6:30 PM, f14tomcat said:

That link I gave you has probably expired by now.  Any news?  Next steps? 

Our apologies @f14tomcat - we did download the procmon logs.

As for any news on the reported issue we don't have any at this time. We're actively investigating but we've not yet been able to reproduce.

Edited December 19, 2018 by tetonbob
updated information

[boombastik]

to reproduce it u need to have a local account with password activated.

the lag is when u put the password to login.

Without ransomware if u put the password in login screen , the windows start in 2 second with ransomware it take 5-6 seconds, all with ssd.

 

[JBareham]

Was having the problem as discussed at the start of the post, eventually reinstalled a fresh copy Windows which was fine until I installed Malwarebytes, when the problems of slow login using a PIN and then taking several minutes to start-up reoccurred. Disabling the Ransomware protection module has stopped the issues for the moment.

Using latest Windows 1809 (build 195) and a licensed version of Malwarebytes.

[f14tomcat]

Thanks to both for verification and reproducing the exact scenarios.  PIN or Password, Local or MS Account........ same issue.  Right now, I have the 15 second delay set for protection, which allows a quick login, with minimal exposure.

Thanks again.  TC

[Porthos]

3 hours ago, JBareham said:

Using latest Windows 1809 (build 195) and a licensed version of Malwarebytes.

I too have the same version and have no issue.

[boombastik]

14 hours ago, Porthos said:

I too have the same version and have no issue.

Restart your machine and the put your password, u will notice the shutdown.

This problem don't exist when u shutdown your machine with hybrid windows 10 shutdown enabled (fast boot enabled).

[exile360]

Fast startup is known to cause problems with Malwarebytes and many other applications as well as many hardware drivers.  You can find out more at the following links:

here
here

[boombastik]

As i said the problem exist only on restart when the hybrid shutdown no matters. So the statement is off topic.