Slow DNS resolution with potential to completely free system

[AdvancedSetup]

There was not fix for DNS issues or MWAC issues in the latest CU update. I was hoping there would be but was told they were not able to complete it yet. So, hoping the CU7 update will have it. Hang in there please

 

[RickNCN]

I know that the plural of anecdote is not evidence, but this exact issue has been plaguing me for months. I manage a few hundred client pcs and recently, some have been reporting very slow performance, not just DNS but also general program use. As soon as I remove MBAM- boom- like new again. I haven't personally experienced that, but I have experienced the abysmal DNS performance issues.

[cchilderhose]

Yeah I have had to remove it for now until the next CU is ready to test the performance/DNS stuff fixes.  Version 4.0.4 works good but you cannot update it so prefer not to use this one.

[ATCtech]

I'll quickly chime in here to say that since my original post of about 3 weeks ago I too have stopped MBAM from loading at start-up and everything has been fine with connectivity. I have manually started the program, updated and run a full system scan manually once every few days then immediately closed it and carried on as normal. Not exactly what we paid for, hopefully a real fix is coming.

Stay safe everybody!

[cchilderhose]

Does the latest CU update 875 address this issue?  Just wondering.

[exile360]

It may, I know they addressed several issues with Web Protection in the latest update so I would definitely recommend giving it a shot to see if it resolves the issue, and if you do so, please let us know if it is fixed or not.

Thanks

[cchilderhose]

Sounds good as I am installing now and will report back shortly.

[pal1000]

It doesn't fix it, I tried. As this issue can be caused by both malware and web protection, the symptoms vary depending on which of them or if both stop responding when Malwarebytes starts, DNS resolution issues being common theme and most noticeable, but they are just a part of the whole picture.

List of all symptoms I encountered so far, not all of them manifesting simultaneously:

- slow DNS resolution everywhere, probably caused by web protection;

- temporary slow DNS resolution in web browsers that goes away after a few minutes but it's permanent in other programs and returns in web browsers when restarting them and then goes away again, probably caused by malware protection;

- Windows security app takes minutes to display its contents, probably caused by malware protection;

- visual basic scripts executed from Command Prompt take minutes to run even if they have very low complexity, probably caused by either of these problematic protection modules (extra: it is impossible to get MSYS2 packages updates due to permanent connection time outs);

- Malwarebytes UI can no longer be opened after performing exactly 2 protection state switch operations via tray icon of any protection module(s), either same or distinct until Windows is restarted, if at least one of these problematic protection modules is acting up, with last protection state switch operation being unsaved and thus being lost and reverted on next Malwarebytes startup;

- Windows hangs to an empty black screen if currently signed in user logs out, probably caused by either of these problematic protection modules;

- if fast startup is enabled and it's not overridden by SHIFT key, Windows can hang during shutdown after display disconnect step  or next boot to a black screen and frozen mouse cursor, probably caused by either of these problematic protection modules;

- attempting to stop any of these symptoms by quitting Malwarebytes via tray icon or by stopping Malwarebytes Service from Microsoft Management Console Services snap-in results in Malwarebytes Service getting stuck stopping until Windows is restarted and the annoying symptoms not getting better, probably caused by either of these problematic protection modules.

 

[exile360]

Thank you for the additional details, however for any of the above items where you have not confirmed if/which module(s) is/are at fault, if you could verify and please do so it would be most appreciated, particularly since I do not believe Malwarebytes' QA have been able to replicate these issues yet.  I suppose the only way to verify would be to disable all other modules except for the one(s) being tested as the possible cause(s) of the issue in question, then determining if the issue still occurs, then restart the system and re-enable the other modules and then disable the problematic module(s) and test to verify that the issue does not occur with that particular component of protection disabled.

Specifically with regards to fast startup in Windows, I don't know if the issue is specific to just Malwarebytes as many applications and drivers have had problems with fast startup which is one reason we generally recommend users disable it (particularly since it does very little to speed up boot times if the system is installed on an SSD).  Information on how to disable fast startup can be found here as well as here.

[wildman424]

I spent about an hour this morning trying to connect to the internet. It didn't occur to me that Malwarebyes could be the problem.  Is there a known issue with MBAM causing DNS errors and loss of internet connectivity?

Malwarebytes Version: 4.1.0.56

Component Version:    1.0.875

Update Package:           1.0.22398

Will try a few different things and see if what I experienced is related to the issue being discussed here.

In the mean time I wasn't able to get the support tool to provide the logs

 

 

 

[Porthos]

6 minutes ago, wildman424 said:

Is there a known issue with MBAM causing DNS errors and loss of internet connectivity?

Yes for some but not all.

Disabling Web Protection only is the usual fix.

7 minutes ago, wildman424 said:

In the mean time I wasn't able to get the support tool to provide the logs

Are you using any other security programs other than Malwarebytes?

[wildman424]

17 minutes ago, Porthos said:

Yes for some but not all.

Disabling Web Protection only is the usual fix.

Are you using any other security programs other than Malwarebytes?

No, I'm only using Malwarebytes, and Malwarebytes Firewall Control

[AdvancedSetup]

If you've rebooted the computer and Internet access is working in general you should be able to create the logs from the MBST tool

 

[wildman424]

3 hours ago, AdvancedSetup said:

If you've rebooted the computer and Internet access is working in general you should be able to create the logs from the MBST tool

 

I got stuck in a shutdown and restart loop there for a while, not sure what caused that! It didn't crash the system or anything, just randomly logged me out, shutdown and restarted. It did it 2 or 3 times when I was doing a reinstall.

I'm trying again to get those logs for you right now.  I haven't been able to reproduce the issue again, and i have uninstalled and reinstalled and updated 3 or 4 times. Give it a min, see if I can get those logs and I'll shutdown and restart again, now that I have v4.1.0.56  component version 1.0.867 installed again.

This component version 1.0.875 is the current beta correct?

[pal1000]

Update 4/13/2020 22:57

As this issue can be caused by both malware and web protection, the symptoms vary depending on which of them or if both stop responding when Malwarebytes starts, DNS resolution issues being common theme and most noticeable, but they are just a part of the whole picture.

List of all symptoms I encountered so far, not all of them manifesting simultaneously:

- slow DNS resolution everywhere, probably caused by web protection;

- temporary slow DNS resolution in web browsers that goes away after a few minutes but it's permanent in other programs and returns in web browsers when restarting them and then goes away again, probably caused by malware protection;

- Windows security app takes minutes to display its contents, probably caused by malware protection;

- visual basic scripts executed from Command Prompt take minutes to run even if they have very low complexity, probably caused by either of these problematic protection modules (extra: it is impossible to get MSYS2 packages updates due to permanent connection time outs);

- Malwarebytes UI can no longer be opened after performing exactly 2 protection state switch operations via tray icon of any protection module(s), either same or distinct until Windows is restarted, if at least one of these problematic protection modules is acting up, with last protection state switch operation being unsaved and thus being lost and reverted on next Malwarebytes startup;

- Windows hangs to an empty black screen if currently signed in user logs out, probably caused by either of these problematic protection modules;

- if fast startup is enabled and it's not overridden by SHIFT key, Windows can hang on next boot to a black screen, probably caused by malware protection;

- if fast startup is enabled and it's not overridden by SHIFT key, Windows can hang during shutdown after display disconnect step  or next boot to a black screen and frozen mouse cursor, probably caused by either of these problematic protection modules;

- attempting to stop any of these symptoms by quitting Malwarebytes via tray icon or by stopping Malwarebytes Service from Microsoft Management Console Services snap-in results in Malwarebytes Service getting stuck stopping until Windows is restarted and the annoying symptoms not getting better, probably caused by either of these problematic protection modules.

 

[Porthos]

1 hour ago, wildman424 said:

This component version 1.0.875 is the current beta correct?

Yes it is the current BETA.

 

1 hour ago, wildman424 said:

shutdown and restart again

Do not do a shutdown. Do a restart, see below.

 

[wildman424]

Good news, I don't think it was Malwarebytes causing the issues I had this morning. I found some incorrect settings that I believe may have caused it. I will keep an eye on it over the next couple days and report back if it occurs again. I did notice that once I was online, it stayed online until I disabled the adapter using  "function key + F2". Then i had to fight with it to get online again. But I haven't been able to get it to happen again.

I still can not get the support tool to zip the logs. FRST runs fine though.

[cchilderhose]

Has anyone tested the latest CU that came out yesterday/today?  Just wondering as I want to get MBAM back on my system but cannot have this issue all the time.

[ITC23]

I'm unsure of any DNS issues after the latest update, but I did have the MWAC.sys blue screen a handful of times. It has yet to occur again for a handful of days now, but I do not believe I changed anything manually after it occurred.

Currently on the 1.0.889 component package.

[Porthos]

2 minutes ago, ITC23 said:

I'm unsure of any DNS issues after the latest update, but I did have the MWAC.sys blue screen a handful of times. It has yet to occur again for a handful of days now, but I do not believe I changed anything manually after it occurred.

Currently on the 1.0.889 component package.

The workaround is to keep web protection disabled until a working fix is released.

[cchilderhose]

Do we know if the latest beta 924 addresses any of the issues noted in this post or for all the performance issues posted?  I am going to test it out and see.  Will report back in a few days.

[LiquidTension]

Hi @cchilderhose,

We believe this latest beta update will address some of the current Web Protection issues, including some related to performance and third-party compatibility. Please let us know how you get on.

[cchilderhose]

Seems to be good so far and the issues are not present.  I also removed the scheduled scan too so unsure if that has anything to do with it as well since it was suggested.   Will keep an eye on this as a new update just popped up.

[cchilderhose]

Appears there is a 4.1.1 update which just installed.  Waiting on Change Log.

[Porthos]

44 minutes ago, cchilderhose said:

Waiting on Change Log.