Jump to content

ARW Performance Issue


Recommended Posts

I'm having a similar issue.  I'm running Win 7 Pro 64 bit with ASMedia and Intel usb hubs.  When Ransomeware is enabled and I try running anything that plugs into a usb port and extensively uses the usb bus, Win procexp shows mbamservice.exe running at about 5% cpu usage.  That includes my Sentinel usb dongle and usb microscope.  Disabling Ransomeware clears the problem.

Jim

Link to post
Share on other sites

Additional info on my previous comment -

The delay I'm experiencing occurs in accessing hard drives.  A file save in the program that uses the dongle goes from 15 seconds to 5 minutes.  The microscope experiences significant delays in starting, saving pictures, and closing. 

Jim

Link to post
Share on other sites

23 minutes ago, Jim48 said:

Disabling Ransomeware clears the problem.

Just to add, The ransomware component is a reactive protection which means it only is triggered after the ransomware starts to encrypt. The other parts of MB are proactive and should stop ransomware from downloading and executing. So having it off do not diminish you protection much at all.

But yes, The ens goal is to fix the issue in the first place.

Link to post
Share on other sites

@ Porthos -

You're apparently misinformed.  The Ransomeware entity, by my example and the original post. runs without being triggered by any encryption event.  In my case, it runs when a device is attached to the usb bus.  Please refrain from explaining the operation to us plebes if you're not a developer and don't actually know when it's activated.

Your opinion on the value of the Ransomeware protection, if basic protection is enabled, is probably correct, but I doubt MB would applaud that view.  I'm really pissed that MB doesn't seem concerned enough about this issue to respond.

Thanks,

Jim

Link to post
Share on other sites

9 hours ago, Jim48 said:

The Ransomeware entity, by my example and the original post. runs without being triggered by any encryption event.  In my case, it runs when a device is attached to the usb bus.  Please refrain from explaining the operation to us plebes if you're not a developer and don't actually know when it's activated.

It analyzes all filesystem and memory events, however it only reacts/detects events triggered by live ransomware (i.e. ransomware that has already infiltrated your system and is running in memory attempting to encrypt your data); that's what Porthos meant.  In this way it is the least proactive/least preventative protection component in Malwarebytes, as all other protection components react earlier in the attack chain/kill chain to stop threats before they are able to enter memory and/or enter the system.  This means that disabling Ransomware Protection diminishes your overall system protection the least compared to the other more proactive protection components.

As for the Developers, they are investigating the performance issues reported with Ransomware Protection, and while I am confident that they will resolve it eventually, you should also know that there have been numerous various performance issues with many applications, operating systems and activities which have been tracked to the Ransomware Protection component, and while the vast majority have been fixed, it has been a frequent occurrence that new issues with the module are reported.  It is for this reason that I have been advising affected users to disable the module until it is fixed for their issue/situation, and also why I have been running with Ransomware Protection disabled pretty much since it was first integrated into Malwarebytes Premium and continue to keep it disabled to this day and I still have not had a single infection of any kind (including ransomware) infiltrate any of my systems in over 15 years, largely thanks to the protection provided by Malwarebytes (I am also a former Malwarebytes employee and worked for them for nearly 7 years in QA and Product Management).

I will be sure to report this issue to the Product team so that the Developers can investigate a fix.  If you encounter any further issues please let us know.

Thanks

Link to post
Share on other sites

  • Staff

Hi @Jim48,

Thank you for the report. We apologise for the issue you're experiencing.

To assist our efforts in addressing the issue, please do the following:

  • Open Malwarebytes, click Settings and enable the Event Log Data setting.
  • Reproduce the issue you're experiencing.
  • Gather logs with the Malwarebytes Support Tool and attach the generated file to a post: https://support.malwarebytes.com/docs/DOC-2396
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.