High CPU Usage During Windows Update Searches?

[lmacri]

Erix's release notes in the thread Malwarebytes 4.4 Beta for the 4.4.10.144-1.0.1496 BETA (rel. 28-Oct-2021) state in part:

Quote

 Some Issues now addressed:

•  High CPU usage during WU searches

Assuming that "WU" means Windows Update, is this high CPU usage a known bug in stable releases like the current v4.4.9.142-1.0.1486, and if so is there a thread in this Malwarebytes for Windows Support Forum board where this issue is being discussed?

For the past month or so I've noticed unusually high CPU usage whenever Windows Update updates my virus definitions for Microsoft Defender.  I thought the bearings in my fan might be starting to fail because the fan is so noisy during these daily Microsoft Defender virus definition update checks, but after reading Erix's release notes for the latest BETA test version I'm beginning to wonder now if my Malwarebytes Premium real-time protection is interfering with Windows Update and contributing to the high CPU usage.

Just an aside, but the only other time this loud fan noise seems to occur is when Malwarebytes runs my daily Threat Scan.
-----------
64-bit Win 10 Pro v21H1 build 19043.1288 * Firefox v93.0.0 * Microsoft Defender v4.18.2109.6-1.1.18700.4 * Malwarebytes Premium v4.4.9.142-1.0.1486 * HWMonitor Free Portable v1.44
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

Edited October 31, 2021 by lmacri

[AdvancedSetup]

I'm not sure but obviously, we're going to need some new fresh logs @lmacri to start to take a look. I'm not personally seeing this issue myself but perhaps others are.

 

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[lmacri]

Hi AdvancedSetup:

I've attached the requested mbst-grab-results.zip file, but I'm not expecting anyone from Malwarebytes to help me diagnose the cause of high CPU temps on my Dell Inspiron - at least for now.

Right now I'd just like to know if there's a thread somewhere in this forum discussing a known conflict between Windows Update and Malwarebytes where I can find more information.  Erix's 28-Oct-2021 release notes <here> for the 4.4.10.144-1.0.1496 BETA suggest that there's a known conflict with Windows Update, but if a fix is imminent I'm not going to waste too much time diagnosing the intermittent high (excessive?) CPU activity by my Malwarebytes Service that I can see in Task Manager unless it continues after the stable edition of Malwarebytes v4.4.10 is released.

Based on comments by other Inspiron 5584 users in the Dell forum I actually suspect that the problem is with a faulty cooling fan, and not excessive CPU activity by my Malwarebytes Service, per se. I can use HWiNFO or HWMonitor to monitor my CPU core temps but unfortunately none of the diagnostic utilities I've tried so far can measure fan speeds on my Dell laptop (a known issue according to HWiNFO developer Martin Malik's reply to my thread HWiNFO64 v7.12 - How to Monitor Fan Speeds).  I know how to use the proprietary Dell Power Manager app to adjust my fan speed, if necessary, but I haven't figured out how to actually monitor my fan speed in real time.

Just an FYI that I've created mutual scan exclusions for Windows Defender (but not Windows Update) in my Malwarebytes scan exclusions, and vice versa.  Windows Defender is currently my primary real-time protection (i.e., Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center is OFF).

mbst-grab-results.zip
-----------
64-bit Win 10 Pro v21H1 build 19043.1288 * Firefox v93.0.0 * Microsoft Defender v4.18.2109.6-1.1.18700.4 * Malwarebytes Premium v4.4.9.142-1.0.1486 * HWMonitor Free Portable v1.44
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

[AdvancedSetup]

I'm not aware of any ongoing topic concerning this @lmacri

 

I would highly recommend that you uninstall the following

Bonjour
 

 

It looks like you've uninstalled CCleaner but you still have at least one task trying to run it

The log also shows a possible issue with VSS (Volume Shadow Copy Service) you may want to double-check and see if it needs a fix

 

 

Please download and run the following  Volume Shadow Copy Service (VSS), Diagnostic Tool, from Acronis

Acronis VSS Doctor

Free tool for diagnosing and repairing Volume Shadow Copy Service issues. Download link on the bottom of the page.
Download - Acronis VSS Doctor

In many cases, it can correct the issues on its own. If not, then it will give details on what may be causing the issues. Please save the report in text format and post back that log on your next reply.

You can also try the tool from Macrium Reflect if the Acronis tool did not work.

Macrium Reflect Volume Shadow Copy Service (VSS) Repair Tool

• VSSfix 32bit - download
• VSSfix 64bit - download

Once you've run the repair tool you need to restart your computer.
Then check your Event Logs to see if the error was corrected. You can post new logs from FRST which will also show the Event Log entries 

 

 

 

[lmacri]

On 11/1/2021 at 2:33 PM, AdvancedSetup said:

I'm not aware of any ongoing topic concerning this...

Hi AdvancedSetup:

Thanks for the feedback.  I'll check the release notes for Malwarebytes v4.4.10 once the stable version is released, and if there's still any mention of "WU searches" or Windows Update like the BETA release notes <here> I'll do a bit more testing to see if I can figure out what's triggering my intermittent high CPU activity.

I did notice a few application and system errors related to Malwarebytes in the FRST Additions.txt log, so I'll keep an eye on those and see if they persist after Malwarebytes v4.4.10 is released.

Quote

I would highly recommend that you uninstall the following
Bonjour

Is there any specific reason why you suggested I uninstall Bonjour? I always have the Start Type of my Bonjour service set to DISABLED and can't see mDNSResponder.exe running in Task Manager or Process Explorer.  If I uninstall Bonjour I believe it will just reinstall the next time I update iTunes for Windows (I use the installed edition of iTunes, not the app from the Microsoft Store) so I normally leave Bonjour installed (but disabled) just in case I ever purchase an Apple device that requires this service for syncing to iTunes.
 

Quote

It looks like you've uninstalled CCleaner but you still have at least one task trying to run it

I've never had the "standard" CCleaner installed on my computer but I do keep an up-to-date copy of CCleaner Portable on a removable USB stick.  It looks like the CCleanerSkipUAC task is pointing to the executable on my USB stick at D:\Portable\CCleaner\CCleaner64.exe and is related to the setting at Options | Advanced | Skip User Account Control Warning , which is normally DISABLED in my CCleaner settings.  The task hasn't run since 10-Mar-2021 and disabling it didn't appear to affect the launch of CCleaner Portable v5.86.9258 so I went ahead and deleted that CCleanerSkipUAC task as you suggested.

 

Quote

The log also shows a possible issue with VSS (Volume Shadow Copy Service) you may want to double-check and see if it needs a fix ...

Acronis VSS Doctor v1.1.53 didn't find any problems with my VSS (i.e., no "Fixable Issues" button displayed).  It did flag low free disk space on my small (<12 GB) recovery partitions, but that's not a concern since there's lots of free disk space on my C: drive where my Windows restore points are saved. See the attached .txt log.

All the VSS event log errors in my FRST Additions.txt file are similar to the error below (i.e., they say that VSS was interrupted by a system shutdown) and all have a time stamp of ~ 10:30 PM when I normally shut down my laptop, so I'm not particularly worried about those events as long as Windows System Restore continues to create the occasional system restore point.  I also use Macrium Reflect Free to create full disk images of my hard drive just in case I ever have to perform an emergency recovery, so I'll just monitor these VSS errors in Event Viewer for now and will try the Macrium Reflect VSS Repair tool you recommended if other types of VSS errors are logged in the Event Viewer.

Quote

Error: (10/30/2021 10:34:26 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance.  hr = 0x8007045b, A system shutdown is in progress.

AcronisVSSDoctorReport_2021-11-02-07-58-40.txt

-----------
64-bit Win 10 Pro v21H1 build 19043.1288 * Firefox v94.0.0 * Microsoft Defender v.4.18.2110.6-1.1.18700.4 * Malwarebytes Premium v4.4.9.142-1.0.1486 * HWMonitor Free Portable v1.44
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

Edited November 3, 2021 by lmacri

[AdvancedSetup]

Thanks for the information and feedback @lmacri

Yes, it's nearly impossible to keep a clean Event Log on Windows 10 these days. The system has become much more complex than previous versions of Windows.

Some of the errors from Malwarebytes should hopefully be fixed in the next update. If you've not done a Clean Removal and reinstall of Malwarebytes before or in a long time you may want to do that once the new update is out. I'm sure you know how already so I won't post that here, but if you do want information let me know.

Cheers

 

[lmacri]

The stable version of Malwarebytes v4.4.10.144-1.0.1499 was released to the general public today and Erix's 04-Nov-2021 release notes <here> still include the following ...

Quote

Some Issues now addressed:

• High CPU usage during WU searches

I haven't installed the latest v4.4.10 patch yet, but can anyone at Malwarebytes provide more information about this bug and how it manifested itself in Malwarebytes v4.4.9?  For example, did CPU activity for the Malwarebytes Service increase significantly during manual and/or automatic Windows Updates on all Win 10 machines due to a conflict with the Windows Update Agent at C:\Windows\System32\wuaueng.dll, did the bug actually prevent the Windows Update service wuauserv from launching on occasion and logging a DistributedCOM error in Event Viewer, etc., and how was this bug was first detected?
-----------
64-bit Win 10 Pro v21H1 build 19043.1288 * Firefox v94.0.1 * Microsoft Defender v.4.18.2110.6-1.1.18700.4 * Malwarebytes Premium v4.4.9.142-1.0.1486
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[Erix]

Hello Imacri,

Please allow me to take a stab at addressing your question.

Our previous version 4.4.9 was executing a "scan" on top of the Windows Updates Search that the OS performs (roughly twice a day automatically). We found during its Beta phase that such architecture was adding (under certain circumstances) to the CPU burden so we backed this functionality out with 4.4.10 opting for a better design that rather works around it and averts adding to the CPU burden altogether. This bug (as far as we know) does not prevent the Windows Update Service from executing nor it conflicts with it. We are still investigating the circumstances but the new functionality rules out the problem in any case.

Hopefully this makes sense. We appreciate your contributions and want to make sure to always take them in close consideration.

Thank you so much for helping us keep building a better product for you.

Regards,

-Erix

[lmacri]

On 11/4/2021 at 4:37 PM, Erix said:

...Our previous version 4.4.9 was executing a "scan" on top of the Windows Updates Search that the OS performs (roughly twice a day automatically). We found during its Beta phase that such architecture was adding (under certain circumstances) to the CPU burden so we backed this functionality out with 4.4.10 opting for a better design that rather works around it and averts adding to the CPU burden altogether. This bug (as far as we know) does not prevent the Windows Update Service from executing nor it conflicts with it. We are still investigating the circumstances but the new functionality rules out the problem in any case....

Hi Erix:

Thank you for your response.  Sorry for the late reply but I updated to Malwarebytes Premium 4.4.10.144-1.0.1499 on 05-Nov-2021 and wanted to monitor my system for a week or so to see if there was any change in CPU consumption by my Malwarebytes Service (the short answer is no).  Just note that Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center is always OFF in my Malwarebytes settings and MS Defender is my primary antivirus. I've also attached a new set of mbst-grab-results.zip logs I collected today if anyone's interested.

mbst-grab-results.zip

So far I can't see any noticeable change in CPU usage. I still see high CPU activity by the Malwarebytes Service when Windows Update is searching for and installing my Windows Defender virus definitions every morning, but that could just be a coincidence.  I shut down my computer every night and when I power up in the morning one of the first things that Windows does is to check for MS Defender virus definition updates, so it's possible that several pending background tasks (e.g., Windows Update checks, Malwarebytes update checks or missed Threats Scans, etc.) are all trying to run simultaneously.

That said, the system resources used by the Malwarebytes Service still seem unusually high at times throughout the day [e.g., CPU activity >25 %, CPU temp ramps to 90 deg C quickly and triggers my high speed fan (which is very noisy on my Inspiron 5584), high power usage in Task Manager].  If anything, the high CPU usage is even more noticeable with Malwarebytes v4.4.10 because my daily Threat Scans (scheduled to run at 6:00 PM) are now taking 5 to 6 min to run to completion and the noise from my high speed fan during these scans is quite loud.  I might try a clean reinstall of Malwarebytes v4.4.10 to see if that helps, but if there's no change I might reduce the frequency of my scheduled Malwarbytes update checks and Threat Scans.  I noticed that MSimm1, who also shuts their computer down at night, has disabled their scheduled Threat Scans because of the high system resource usage by Malwarebytes at boot-up (see their 04-Nov-2021 thread Not Fully Protected Because No Scheduled Scan) so I'm not the only user that's concerned about the impact of Malwarebytes on system performance.
__________________________________________________

Here's a few images I captured during my November 2021 Patch Tuesday update by Windows Update, which took several minutes to run to completion since I have a slow internet connection. In general, power usage by Service Host: Windows Update was usually Low (and would briefly jump to Moderate) during the search and download of updates, and I could see short periods where the Malwarebytes Service would jump to High or Very High. I believe this image was captured while KB5007186 (2021-11 Cumulative Update for Win 10 v21H1, OS Build 19043.1348) was downloading.

During the installation of KB5007186 by the WMI Worker I again saw short periods of High or Very High activity by the Malwarebytes Service ...

... but Malwarebytes activity was generally Low or Very Low during most of the installation.

-----------
64-bit Win 10 Pro v21H1 build 19043.1348 * Firefox v94.0.1 * Microsoft Defender v.4.18.2110.6-1.1.18700.4 * Malwarebytes Premium v4.4.10.144-1.0.1499
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited November 14, 2021 by lmacri
Corrected KB number of Nov 2021 update

[AdvancedSetup]

Thank you @lmacri

Overall you run a reasonably clean installation of Windows compared to most system logs I review, however you do have a few errors, but some may be transitory in nature and nothing to worry about. Please review though and if needed or on reboot the error comes back again then take action. If the error does not come back after a reboot then one can assume it was just a temporary issue. Run EVENTVWR to see the Event Logs.

 

Also, you can click on Start  / Search and type in reliability and run that. It will show  you a list of current issues and a history of them.

You may also want to run a System File Check just to make sure it comes back with no issues.

From and elevated admin command prompt you can run

SFC  /SCANNOW 

A good clean run should produce something like the following

If there were errors though then you should get a similar return as shown. If not then let me know.

 

 

 

[lmacri]

Hi AdvancedSetup:

I did have a BugCheck (Event ID 1001) that caused a re-boot on 03-Nov-2021 but haven't had any unexpected re-boots since. I analyzed the mini-dump file with NirSoft's free BlueScreenView utility.  BSV isn't as accurate as the Windows Debugger WinDbg since it only shows the suspected driver / module that was loaded in the crash stack at the time of the crash, but it's still useful for interpreting Bug Check Codes, and it indicated the problem was caused by ntoskrnl.exe (KMODE_EXCEPTION_NOT_HANDLED) - see attached BSV output for three minidumps created since Jan 2020.

I ran System File Checker (sfc /scannow) a few days later on 09-Nov-2021 and SFC reported it found "corrupted files and successfully repaired them", but for some reason the attached extract of my CBS.log (using the command findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\SFCdetails.txt) didn't mention the name of the specific files(s) that were repaired. Subsequent DISM and SFC scans were clean (see image below).

Dating back to 27-Oct-2021 my Win 10 Reliability Monitor shows three application failures related to Malwarebytes (Malwarebytes Service stopped working 29-Oct-2021, Malwarebytes stopped working 31-Oct-2021, Malwarebytes Tray Application stopped working 10-Nov-2021) and one related to MS Outlook (Microsoft Outlook stopped responding and was closed 13-Nov-2021).  As far as I know the Malwarebytes problems were transient and my Malwarebytes real-time protection wasn't interrupted for any significant length of time.

BlueScreenView v1_55 Win 10 v21H1 ntoskrnl_exe KMODE_EXCEPTION_NOT_HANDLED 03 Nov 2021.txt

SFC Scannow CBS Log Extract After Repair 09 Nov 2021.txt

-----------
64-bit Win 10 Pro v21H1 build 19043.1348 * Firefox v94.0.1 * Microsoft Defender v.4.18.2110.6-1.1.18700.4 * Malwarebytes Premium v4.4.10.144-1.0.1499 * BlueScreenView Portable v1.55
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[AdvancedSetup]

All good. Thanks for the feedback. Just making sure all was well. 👍