MBAMService.exe I/O to C:\ProgramData

[rickmb]

I'm running Malwarebytes Premium 4.2.0.82 update package 1.0.29281 component package 1.0.1025.

In Resource Monitor I see MBAMService.exe reading just about everything in C:\ProgramData and this goes on for an extended period of time.  There is no scan active, so what the heck is Malwarebytes doing?

 

[exile360]

Greetings,

Are any other processes showing a lot of activity in C:\ProgramData, or is it just Malwarebytes?  I ask because I suspect it may be the Ransomware Protection component analyzing some on disk activity (reads/writes/deletes etc.) from one or more other applications.  It is also possible that it is due to one of the recently introduced AI/Machine Learning/cloud components which will download updates from time to time to check for new/unknown threats and malicious activities; it writes and reads these databases and modules from a sub-folder of C:\ProgramData so that also might be a factor.  You also mentioned that no scan is active and I assume that also includes scheduled scans that run in the background, correct?  You can check based on the time that your scheduled scans are set to run to determine if this is the case.

Please let us know what you find and if there are any further issues.

Thanks

[rickmb]

On 8/31/2020 at 11:49 PM, exile360 said:

Please let us know what you find and if there are any further issues.

I have no scheduled scans.  I deleted the default one.  

The MBAMService.exe activity is all reads no writes and it looks like it is scanning everything (all folders) in C:\ProgramData.  The only other processes showing disk activity in the same timeframe are normal stuff done by System and Registry. 

I will try to provide a screenshot next time I see this happening.  There is certainly no application or background process writing to every folder in C:\ProgramData that MWB ransomware protection might want to analyze.

 

 

[exile360]

Thanks, please provide a set of logs for analysis:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply