High Malwarebytes Service CPU Usage when using Python DASK

[karushistuckered]

I use Malwarebytes 3.0 Premium, and normally have no resource-usage problems with it, works splendidly. Little CPU usage spikes when a program is doing something that catches its attention, but usually it's quiet.

But recently I started playing with Python's DASK library, and noticed on running py.test on DASK's tests/ folder (https://github.com/dask/dask/tree/master/dask/tests) that CPU use spiked and remained high until I CTRL + C'd the DASK test. This behavior didn't seem abnormal, since DASK is a a large-scale parallelism system and so a test of it could very well tax my single home PC's 4-core i7... but then I noticed that MalwareBytes Service, not DASK, was actually using the lion's share of my CPU cycles!

Any idea why this might be the case, and if there's a sub-component of Malwarebytes I could temporarily disable, or some kind of process-specific whitelist I could use, to be able to play with DASK without Malwarebytes losing its temper?

I haven't had much time to dig into this just yet, but my current guess about the cause of this is: maybe MalwareBytes is either A] inspecting each thread DASK creates, and/or B] growing concerned about DASK's activities because DASK might access a much larger number of ports than a standard application (this is just a guess based on my limited experience with Apache spark, which is a system analogous to DASK).

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Depending on what the application is doing, it could be a number of things.  The first area I'd test is the Ransomware Protection component as this module monitors all active threads and processes for ransomware behavior so if a process is generating a lot of disk activity and the like that may appear a bit suspicious to the module causing it to ramp up its CPU usage.

If that bears no fruit then you could try disabling the Exploit Protection component to see if that's the culprit as the process may be doing something unusual in memory causing the anti-ransomware behavior monitoring tech in Malwarebytes to take notice.

If it isn't either of those, then it could be the Web Protection component since it monitors all connections to/from the device to check against Malwarebytes' extensive black list of known malicious websites and servers.

Once you determine which module is causing the issue you may then exclude that process from the component causing it via the Exclusions interface in Malwarebytes under Settings>Exclusions and you can find instructions on how to create an exclusion for each component in this support article and hopefully that will pacify the CPU usage.

If it doesn't then please let us know and we can assist you further in trying to diagnose and eliminate the high resource usage issue.

[karushistuckered]

Exactly the kind of advice I was looking for, exile360! Thanks so much -- will give that a shot in a little bit and see if I can find minimal MWB settings to turn off and restore normal CPU usage when DASK is running.

[exile360]

Excellent, I'm glad I could help

You'll find the option to disable each real-time component in the right-click context menu of the Malwarebytes notification area/tray icon.  Just click on the one you wish to disable and then click Yes if prompted by User Account Control.