Malwarebytes - causing programs to run slowly

[Porthos]

2 minutes ago, pnoelw said:

I wish it was on your bench in your shop!

I said it that way just to say in other words that is a slight risk that Windows would not install a suitable driver and the computer would be without access until you manually reinstall one.

I believe MB is tracking an issue concerning this and a fix will be in an upcoming release.

I am also watching this to be prepared for a call from a client that is having issues as well. So far none have called to this date.

[pnoelw]

Thanks for the quick response, Porthos. So should I sit tight and keep monitoring this thread? How long might be a reasonable time to wait before I press thebutton again?

[Porthos]

6 minutes ago, pnoelw said:

So should I sit tight and keep monitoring this thread?

I would say so.

6 minutes ago, pnoelw said:

How long might be a reasonable time to wait before I press thebutton again?

Only the dev team would know and testing including a new BETA will be probably released first.

[LiquidTension]

Hi @pnoelw,

Is this machine in an IPv6-enabled environment? A known issue currently exists with Malwarebytes Web Protection and IPv6 ICMP.
Could you run the following batch file as Administrator and provide the generated output (saved to the Desktop)?

-----

Regarding the issue with Ransomware Protection - specifically, which programs are impacted by this?
When Ransomware Protection is enabled, is this a consistent occurrence?
We'll need to obtain some additional troubleshooting data.

• Open Malwarebytes.
• Click Settings and enable the Event Log Data setting within the General tab.
• Please download run_procmon.bat using the link below.
  → https://malwarebytes.box.com/s/he92cwwd71sa0w7waiub8wx69ymb5d4i
• Open your Downloads folder.
• Double-click run_procmon.bat. Click Yes if prompted by User Account Control.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A blue window will appear. When prompted to carry out the tasks, please reproduce the issue with Ransomware Protection.
• Once done, click inside the Command Prompt window and press Y on your keyboard followed by Enter.
• Upon completion, a file named procmon-log.zip will be saved to your Desktop. Please attach the file in your next reply.
• Note: If the file is too large, you will be provided instructions to upload the file to a file hosting website (wetransfer.com).

Please rerun the Malwarebytes Support Tool afterwards and respond back with the generated files.

Edited February 4, 2020 by LiquidTension

[pnoelw]

Good afternoon. Thanks for following up.

 

Is this machine in an IPv6-enabled environment? I think so. Ipconfig file attached.

 

Regarding the issue with Ransomware Protection - specifically, which programs are impacted by this? The following are what I have noticed – there may be others.

 

When I switch on a printer, Windows doesn’t pick it up and it may require a few power cycles to get it onboard. Procmon-log at this link. https://we.tl/t-noqAACo9hM The printer is an HP M1120MFP (same result with HP LJ M175nw printer) and in this instance I powered the printer on and it was not picked up by Windows (watching Devices and Printers). Cycled the printer power switch and this time Windows connected.

 

2 of the programmes I regularly use process large data files (3Gig+) and produce multiple data files (1,000 totalling 44G+). These used to run and write data smoothly. They now hesitate for 10 secs or more every 20 seconds or so. SpectrumBuilder is the one writing many files and which hesitates for a few seconds every 15 or so seconds. I have used that in the production of the procmon-log. https://we.tl/t-KFtXZUezBR   In this test it was reading one file from G: and writing multiple files to the D:. It paused a few times in the 2mins I ran it.

 

Latest MB Support Tool log attached.

 

Regards

 

Noel.

mbst-grab-results.zip ipconfig_result.txt

[pnoelw]

1 hour ago, pnoelw said:

They now hesitate for 10 secs or more every 20 seconds or so.

Correction to above. Should read ...for 2 seconds or more every 20 seconds or so.....

Regards

[LiquidTension]

Thank you for the data. Your issue with Firefox and program updates is caused by a known issue with Web Protection in IPv6 environments. We have a defect filed for this.

We have a new Anti-Ransomware build that includes performance improvements. Could you try this out and let us know if you see any improvement with the issues caused by Ransomware Protection.

Details (including a download link) can be found here: https://forums.malwarebytes.com/topic/211708-latest-version-mbarw-beta-v-0918807-build-278-released-feb-5-2020/
Before installing, you will need to temporarily uninstall Malwarebytes version 4 (which can then be reinstalled once Anti-Ransomware standalone is removed).

[pnoelw]

Thanks LiquidTension

What is the easiest/safest way to uninstall and re--install MB Premium?

Regards

[Porthos]

3 minutes ago, pnoelw said:

Thanks LiquidTension

What is the easiest/safest way to uninstall and re--install MB Premium?

Regards

I would deactivate your current install and make note of your product key first and run the Support tool and do a clean and when it offers to reinstall choose NO and close the tool.

[pnoelw]

...and then run the Support Tool again to install after removing the standalone ARW?

[Porthos]

3 minutes ago, pnoelw said:

...and then run the Support Tool again to install after removing the standalone ARW?

No just install Malwarebytes the normal way from the installer.

 

[pnoelw]

Hi LiquidTension and Porthos

Standalone ARW module tested after clean uninstall of MB. Restarted computer after ARW installation.

Both of the RW-related issues persist without any noticeable improvement.

ARW standalone removed and MB re-installed and running with Web and Ransomware Protection modules switched off.

Regards

[LiquidTension]

Thank you for confirming.

Could you add the following path as a folder exclusion in Malwarebytes and check if this mitigates the issue you're experiencing with SpectrumBuilder:
C:\current data\radio\Pskov NDB\PskovNDB 2.0

See here for more information: https://support.malwarebytes.com/hc/en-us/articles/360038479234-Add-to-the-Allow-List-in-Malwarebytes-for-Windows-v4

[pnoelw]

Good evening, LiquidTension

Adding PskovNDB 2.0 folder to the allowed list has resolved the issue between Ransomware protection and the Pskov software.

Obvioulsy the printer/Ransomware protection issue is still there.

Also note that subsequent to this test MB has updated to 4.0.4.49, update 1.0.19002, component 1.0.823. I rebooted and ran the test again. All still OK.

Just checked the web protection after the update. Still an issue so web protection remains switched off.

Regards

[LiquidTension]

Thank you for confirming. Investigation into the Web Protection issue is still on-going, so unfortunately we don't have a fix for this yet.

Regarding the printer issue, could you provide some additional information please:

• How are you connecting the printer to the computer?
• Please run Farbar Recovery Scan Tool and attach the generated files: https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs
• Please export the System and Application event logs: https://social.technet.microsoft.com/wiki/contents/articles/52088.windows-10-how-to-save-a-copy-of-the-event-viewer-application-and-system-logs.aspx

Edited February 11, 2020 by LiquidTension

[pnoelw]

Hi LiquidTension

Printers connected by USB.

Farbar files attached.

System and Application event logs here https://we.tl/t-uzBPsiGO4u

Regards

FRST.txt Addition.txt

[jackswag1]

I am using malware bytes paid latest version but when i started to update my drivers it gives me a warning what is the solution for it.

[Porthos]

6 hours ago, jackswag1 said:

I am using malware bytes paid latest version but when i started to update my drivers it gives me a warning what is the solution for it.

How and with what are you updating your drivers with?

[pnoelw]

Hi there all. I'm the original poster on this topic. Any Further news on a resolution? I'm still running with Web Protection switched off.

Regards

Noel

[Porthos]

 

@pnoelwHave you already upgraded to 4.1.0?

Not saying a fix for your particular issue was part of it.

Edited March 4, 2020 by Porthos

[pnoelw]

Hi Porthos

Yes, I have updated to 4.1 and no it hasn't resolved anything further.

[Porthos]

1 hour ago, pnoelw said:

Hi Porthos

Yes, I have updated to 4.1 and no it hasn't resolved anything further.

Just wanted to make sure.

I have see a couple of others here that seem to think it has something to do with scheduled scans.

Just as a test delete the schedules and restart (not shutdown and turn on) and turn web protection on until the issue happens again. Like I said just a test.

[Cavehomme]

I was hoping to finally update from v3.8.3 but I'll keep it for a while longer. I was experiencing various issues with v4x including sluggishness and WiFi connection issues. 

[pnoelw]

On 3/4/2020 at 9:29 PM, Porthos said:

Just as a test delete the schedules and restart (not shutdown and turn on) and turn web protection on until the issue happens again. Like I said just a test.

Hi Porthos

Apologies for the delay. I've deleted the scheduled scan and done a reboot/retsart with Web Protection turned on again. It hasn't worked. Issues still the same. So WP off again.

Regards

[LightningX]

I'm experiencing the same issues. I'm going to try to remove web protection. Should I make a new thread with a log?