Malwarebytes - BypassIO support

[HylianSteel]

I came across a thread on Reddit about checking if your 3rd party antivirus supports BypassIO, a new I/O path that is apparently part of DirectStorage. Someone else already commented on this about Malwarebytes.
 

Quote

Here's mine. If someone like myself uses Malwarebytes, you'll get these results. Kinda bums me out.

BypassIo on "c:\" is not currently supported

Status: 506 (At least one minifilter does not support bypass IO)

Driver: MBAMFarflt

Reason: The specified minifilter does not support bypass IO.

Storage Type: NVMe

Storage Driver: Not BypassIo Compatible

I checked and had the same results. Is BypassIO compatibility on the feature roadmap for new versions of Malwarebytes?

[AdvancedSetup]

Hello @HylianSteel

At the moment we do not support this feature but the development team hopes to support it in the near future

Thank you

 

[yamaci17]

My NVME drive works perfectly fine. It is perfectly recognized by Windows as a working and fully functioning storage device. I also perfectly use it, install games on it, watch movies on it.

BypassIO is a crucial and integral part of DirectStorage. A new Windows API that allows games to use NVME devices more efficiently in various ways and forms. And you've openly admitted that your software does not support BypassIO. 

The device is UNRECOGNIZED as a proper DirectStorage device.

Since Malwarebytes clearly lacks the ability to work with BypassIO, it is very NATURAL that it stops my NVME drive as recognized as a proper DirectStorage device.

This is not a help request, or a request at all. This is just me informing you about the potential problems that will arise when DirectStorage is fully explored by game developers. It is completely up to you. You can ignore and think that it is a problem special to me and my PC needs fixing. What can I say?

Context:

C is my NVME drive. It is shown as "unknown" when MBAM is active. It is shown as "optimized" when MBAM is disabled. D and E are my hard drives, which normally they show as "not NVME". They're not part of this discussion and information.

 

Here, driver named MBAMFarflt causes the system to be not compatible with BypassIO and by extension, with DirectStorage.

Edited June 21, 2022 by yamaci17

[Porthos]

20 minutes ago, yamaci17 said:

Here, driver named MBAMFarflt causes the system to be not compatible with BypassIO and by extension, with DirectStorage.

This is the anti ransomware component of Malwarebytes. Disable just the anti ransomware protection of Malwarebytes and see if your issue is corrected..

 

[AdvancedSetup]

At this time there is no fix. 

We've told you it will be available in the future but that doesn't seem to be good enough for you, so the only other option is to uninstall our program and wait until it does support it, or if needed we can provide a refund for you.

For a refund please open a support ticket.

Consumer Support
https://support.malwarebytes.com/hc/en-us/requests/new

Thank you

 

[yamaci17]

On 6/22/2022 at 12:09 AM, AdvancedSetup said:

At this time there is no fix. 

We've told you it will be available in the future but that doesn't seem to be good enough for you, so the only other option is to uninstall our program and wait until it does support it, or if needed we can provide a refund for you.

For a refund please open a support ticket.

Consumer Support
https://support.malwarebytes.com/hc/en-us/requests/new

Thank you

 

It is good enough for me. I never said it wasn't. I just wanted to update the topic and wanted some updates from software devs about their progress on the feature.  That was all my intention. The problem becomes more apparent day by day, I just wanted to learn how soon we should expect the feature to arrive. 

 

as of 27 june 2022

Edited June 27, 2022 by yamaci17

[ogger151]

On 6/21/2022 at 5:09 PM, AdvancedSetup said:

At this time there is no fix. 

We've told you it will be available in the future but that doesn't seem to be good enough for you, so the only other option is to uninstall our program and wait until it does support it, or if needed we can provide a refund for you.

For a refund please open a support ticket.

Consumer Support
https://support.malwarebytes.com/hc/en-us/requests/new

Thank you

 

As long as it is updated/fixed when directstorage becomes available then we wait. I don't understand why anyone would be concerned about compatability with a feature that is not even available yet. Nice to know MB is aware and working on it and hopefully can implimiment compatabiliy when directstorage becomes available.

[B3N]

Hi Support,

 

Is there any update on this request or a regedit workaround in the interim.

[Porthos]

2 minutes ago, B3N said:

Is there any update on this request or a regedit workaround in the interim.

No, There is not.

[shankly1985]

Any further update on this feature? The first supported game drops this month 14th October. 

[shankly1985]

Anything? 

[AdvancedSetup]

There has been no update at this point

 

[Gizmofail]

Just adding a bit of info, as the first PC game with DirectStorage will be released on the 24th of January(wich is in 2 days) There is a fix to this, so you do not have to uninstall Malwarebytes.   What I have found out is, the Ransomeware shield layer protection is the culprit, not allowing bypassio to work. 

It'll be interesting so see if they make an update by tuesday 24th to allow that layer to be enabled and support bypassio.  But there's your fix, although temporary, cuz' you disable a layer which is nice to have up at all times. 

 

[ogger151]

1 hour ago, Gizmofail said:

Just adding a bit of info, as the first PC game with DirectStorage will be released on the 24th of January(wich is in 2 days) There is a fix to this, so you do not have to uninstall Malwarebytes.   What I have found out is, the Ransomeware shield layer protection is the culprit, not allowing bypassio to work. 

It'll be interesting so see if they make an update by tuesday 24th to allow that layer to be enabled and support bypassio.  But there's your fix, although temporary, cuz' you disable a layer which is nice to have up at all times. 

 

I can confirm. A simple right click on MB in the tray uncheck Ransomeware apply and run command "fsutil bypassIo state c:\" again and BypassIo is compatable. 

[Porthos]

The above tricks will work but you will be disabling ransomware protection to accomplish this. Not exactly the best thing to do UNLESS you have proper backups of your data on an external drive that stays disconnected between backups.

[ogger151]

39 minutes ago, Porthos said:

The above tricks will work but you will be disabling ransomware protection to accomplish this. Not exactly the best thing to do UNLESS you have proper backups of your data on an external drive that stays disconnected between backups.

I will not be turning mine off. I just wanted to verify the cause of the issue. I do have two Identical gaming computers though. One has only games on it and no data so if I do decide to give it a test it will be on that one. Surely the issue will be resolved shortly anyway. Anyway keep this thread alive and we might get there attention and an update to a fix. Last response was Oct 6, 2022 and it looks the first game with direct storage is coming this month so we shall see! 

[Porthos]

1 minute ago, ogger151 said:

I just wanted to verify the cause of the issue.

That was verified and stated here on the forums a while back.

2 minutes ago, ogger151 said:

Surely the issue will be resolved shortly anyway

No ETA as i am guessing the ransomware driver has to be rewritten. No word if that was considered for Version 5 of Malwarebytes in BETA testing at the moment.

Malwarebytes is not the only 3rd product that has this driver conflict with Bypass IO.

[Gizmofail]

I do agree that, turning off a layer of protection is not a good idea, as I wrote, it's a nice layer to have up at all times. The development team at Malwarebytes have an idea where to look, unless they know/knew that this was the cause of the issue. 

 

Personally, I might not do this either, in this day and age, trusting the internet when gaming, most likely not the best choice.

 

[Porthos]

4 minutes ago, Gizmofail said:

unless they know/knew that this was the cause of the issue

They know already. It is just a case of how many out of millions of customers will want/need to use the new feature.

 

Edited January 22, 2023 by Porthos

[ogger151]

1 hour ago, Porthos said:

That was verified and stated here on the forums a while back.

No ETA as i am guessing the ransomware driver has to be rewritten. No word if that was considered for Version 5 of Malwarebytes in BETA testing at the moment.

Malwarebytes is not the only 3rd product that has this driver conflict with Bypass IO.

If may have been stated a while back but I need to see it for myself as I have other software. And since as you stated MB is not the only 3rd party party product that has this driver conflict I needed to know if something else might be effecting bypass in addition MB. Now I have verified MB is the only thing 3rd party driver affecting my PC. And to verify my Samsung 980 Pro also posses no issue. And I am ready to try this game maybe if it actually gets released on time. I could uninstall MB as defender has its own ransomware protection.

[Porthos]

16 minutes ago, ogger151 said:

I needed to know if something else might be effecting bypass in addition MB.

Some 3rd party AV solutions have not updated their filter drivers to support this, however (Microsoft Defender, meanwhile, fully supports it.) I thought it would be helpful to see which do and do not support BypassIO by compiling a list. The only one I know of that supports it is F-Secure.

So run this command from a command prompt run as administrator:

fsutil bypassIo state c:\

Source

 

Edited January 23, 2023 by Porthos

[AdvancedSetup]

I don't know if this will go to beta or simply be released but we are testing a driver update for this internally so hopefully it won't be much longer

 

[yamaci17]

4 hours ago, Porthos said:

They know already. It is just a case of how many out of millions of customers will want/need to use the new feature.

 

You're absolutely correct; but I'm glad Mbytes is aware of situation and doing stuff to get it working. Sooner or later, this tech will be incorporated into more and more nextgen games. I don't know how many gamers use MBytes though; probably not so much. 

[Spaced]

Problem popped up over a year ago...Still "working on it"  ....yeah, I'll bet you are:(

[Porthos]

Bypasss IO support is included in the current Beta.