Mbabtray.exe process using 30+GB of I/O bandwidth per day

[WorryFreePC]

We're on Comcast and for months have been approaching our 1TB per month limit.

I've thought it was live media streaming.   Indeed that's a big piece, but yesterday I found an even bigger piece.

Malwarebytes process mbamtray was sitting doing huge I/O, mostly upload.   I have Google Mesh and I can see that my computer is using 30GB to 50GB per day of data up/down.

I used the cleanup tool to remove Malwarebytes.  Immediately, my bandwidth dropped by 98%.  I waited a day, then reinstalled Malwarebytes and now bandwidth is as it should be.

Paul Gallo

 

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

It may help to disable telemetry collection in Malwarebytes just to reduce future data usage.  To do so, open Malwarebytes and navigate to Settings>Application and toggle the setting under Usage and Threat Statistics to Off.  That will prevent Malwarebytes from uploading telemetry data about program usage and detections to the Malwarebytes telemetry servers which should greatly reduce the amount of bandwidth consumed by the program.

Also please bear in mind that there will still be some usage due to the cloud components in Malwarebytes and other protection features that rely on the Malwarebytes threat network and of course database and program updates also require bandwidth so it won't be possible to eliminate all data usage, but disabling that option should help.

[BASports]

I'm in a rural area with no option other than satellite internet. As it happens I have the max bandwidth download package Viasat has, 150GB a month.

So, in the past few months, using GlassWire to track bandwidth usage, I notice more and more and more bandwidth being eaten up, even though I generally

don't come near the 150 gigs since I don't usually stream things.

Today, 18 days into the month, I happen to notice that Malwarebytes (of which I pay for premium service) has already used 37.1 GB of bandwidth - MORE even than Chrome has used!

This is insane! At that rate, I would use up 1/2 of total max bandwidth each month just for this one app!

Searching for an answer, I see the post I'm referencing that Malwarebytes telemetry collection being on can just eat up that precious bandwidth - which almost ran out last month for me.

So, I have toggled that off, and hope this solves the issue of appropriating my bandwidth without my knowldege.

Well, DUH!  How about, Malwarebytes, making that CRYSTAL CLEAR to people who don't toggle that off and think they're doing your company and its community a service

by allowing such data to be collected.  

That fact that nowhere does it tell you bandwidth will be sucked from you like a vampire is bad...period.

 

[Porthos]

20 minutes ago, BASports said:

I'm referencing that Malwarebytes telemetry collection being on

There are also the hourly (default) database update checks and databases released many times in a 24hr period) and a cloud component as well, Without those Malwarebytes would not be effective.

 

[BASports]

I appreciate your response.

I have had Malwarebytes Premium for a number of years, maybe 6-7. I don't exasctly recall.  And I've had this metered 150GB/month set up all that time.

But I never had this sort of excessive bandwidth usage by Malwarebyes...until recently.  So, what has changed?

Are you saying only someone with unlimited bandwidth can use it because of some sort of different protocol now being followed?  This is a big deal to me given if I run out of bandwidth,

I can't effectively run my online business. 

Tethering off my T-Mobile cellular is a bad joke.  Speedtest shows I get a 35-40 Mbps cell connection but T-Mobile is very cute and even tells you in their fine, fine print that if you tether to a desktop PC, your max connectivity will be at....500 Kbps.  80 times slower than their cellular speed.  That is truly world-class throtlling.

If even with toggling off this telemetry collection, I continue to have Malwarebytes literally gobbling up my bandwidth I will definely have to find a less painful way to block malware, eh?

[exile360]

Please let us know how you get on with telemetry collection disabled, but if it doesn't help then please try disabling the anomalous threat detection component under Settings>Protection as its cloud component may be the culprit for the increase in data usage.  Either way I will be reporting your feedback and experiences to the Malwarebytes Product team for review and consideration as that usage does seem awfully high regardless of what it's doing.

Thank you for bringing this to our attention.

[BASports]

Thanks for your reply.  While I hold a PhD, it's not in computer science. Can you be more specific in what the anomalous (which implies out-of-the-ordinary or atypical) threat detetection component is under SETTINGS? I see nothing that would fall in that category.  Under the two broad categories there that might be applicable, REAL TIME PROTECTION & POTENTIAL THREAT PROTECTION I see nothing relevant to this.  Maybe a screenshot of where in SETTINGS this is? Thanks.

[exile360]

You'll find it located under the Scan Options section described as Use signature-less anomaly detection for increased protection.  It uses advanced heuristics, AI algorithms and Machine Learning along with real-time cloud analysis to detect new and unknown threats.  It's a relatively new feature that has been around for about a year if I recall correctly.  It's very powerful but could certainly account for a large amount of the usage you're seeing due to the cloud aspects of this component, and though it is listed under Scan Options, it is actually used in both real-time protection as well as scans so it is always active and in-use by default.

[BASports]

Thanks for taking the time to clarify that. 

I'll turn that function off and see what happens.

[BASports]

Just for anyone's edification...after turning off the aforementioned functions, this is what happened, with my 150 GB / month satellite internet metered bandwidth connection:

 

BEFORE - Malwarebytes was using about 2 GB a day of bandwidth

 

NOW - With today almost over, it has used 89 MB!

 

About 22 times LESS bandwidth used.

[Porthos]

 

51 minutes ago, BASports said:

About 22 times LESS bandwidth used.

If you turned off the "Use signature-less anomaly detection for increased protection" be aware you are less protected.

[exile360]

5 hours ago, BASports said:

Just for anyone's edification...after turning off the aforementioned functions, this is what happened, with my 150 GB / month satellite internet metered bandwidth connection:

 

BEFORE - Malwarebytes was using about 2 GB a day of bandwidth

 

NOW - With today almost over, it has used 89 MB!

 

About 22 times LESS bandwidth used.

Thank you for the update.  I will include this information in my report to the Product team.