Components Upgrade 1.0.1689 causing possible Memory Leak?

[onebyteyboi]

Ever since the upgrade to Components version 1.0.1689 with the latest 4.5.9.198, my computer seems to have developed a memory leak that I have never had before.

** I am being blocked by the spam filter for some reason, how can it be turned off? as I have 2 paragraphs to post **

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[onebyteyboi]

Is there anyone else having an issue? I don't necessarily need support as yet because I want to try run some diagnostics and tests of my own, but just interested if anyone has noticed anything. The only other software change I had made on my PC around the same time was upgrading Brave browser to the latest version (about 1-2 days beforehand). I had noticed nothing unusual until perhaps 6 hours after installing the components upgrade however. I only realized there was an issue because my Brave browser started crashing with very little tabs open after certain amounts of time. Using Youtube would speed this along. I do not have a lot of ram on the windows 10 machine (only 4GB). I also do not use a swap file which clearly doesnt help.

[Porthos]

3 minutes ago, onebyteyboi said:

my computer seems to have developed a memory leak that I have never had before.

Do not worry about paragraphs for now.

Please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

 

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thanks

[onebyteyboi]

As an aside, is there a tool available to verify the integrity of a Malwarebytes installation? **spam blocker stops me from continuing this comment**

I am also facing a situation similar to this poster:
https://forums.malwarebytes.com/topic/286137-questions-about-certain-log-entries/

Malwarebytes is absolutely spamming fresh MBAMSERVICE.LOG files filled with thousands of these lines. 10MB every 12 minutes, churning up my drive! Could this be a cause of a memory leak?

Regards!

[onebyteyboi]

8 minutes ago, Porthos said:

Please do the following so that we may take a closer look at your installation for troubleshooting:

Thank you for your reply Porthos! At the minute I am not looking for support quite yet, I want to have a tinker first and see what I can find. If this is the incorrect forum for a general enquiry of the forum users please move it to the appropriate section much appreciated. I hope I am not wasting anyones time. I had more to explain but the spam filter is catching me :)

[Porthos]

2 minutes ago, onebyteyboi said:

If this is the incorrect forum for a general enquiry

To be honest,you are in the correct place since you suspect the component update to be an issue.

The requested logs will help us assist you in tracking down the issue.

[onebyteyboi]

On 5/29/2022 at 1:36 PM, Porthos said:

To be honest,you are in the correct place since you suspect the component update to be an issue.

The requested logs will help us assist you in tracking down the issue.

Hi Porthos,

I seem to have found the issue:

When I am using my PC I have a batch script running constantly that looks at services that should not be running and ends them. It uses the "net stop" command as well as the "timeout" command, which actually happen to be executables (they can be found in system32: net.exe, net1.exe, timeout.exe). So anyway this script is very fast, and fires these commands out perhaps 20-30 in 1.5 seconds AKA it is opening these executables and closing them instantly as needed. Once I slowed this script down to only fire every 30 seconds (instead of 3), the  memory leak issue stopped.

Now I believe the issue is with the Log files that Malwarebytes creates. I noticed in: C:\ProgramData\Malwarebytes\MBAMService\LOGS the MBAMSERVICE.LOG file (which is moved to MBAMSERVICE.LOG.bk1, bk2, etc as it hits 10MB in size) was being hammered with new lines that matched the ones in this thread: 

These log files would fill up within 10 minutes. My assumption is that Malwarebytes was trying to attach itself to the net.exe, net1.exe and timeout.exe's but they were closing too fast hence the errors. Once I slowed my script down to only fire every 30 seconds, the errors drastically reduced (or at least were not being written as fast). So in conclusion there is probably a link between the log files and memory leaking. There is probably still leaking but it should no longer affect me because I have reduced the scripts speed by 10x (it generally takes me a good 4 hours before I will be at 90%+ memory usage, with all apps closed).

This is most certainly an edge case so I will leave this matter up to you and the Malwarebytes team whether they want to look into it.

Regards

[lmacri]

8 hours ago, onebyteyboi said:

...Now I believe the issue is with the Log files that Malwarebytes creates. I noticed in: C:\ProgramData\Malwarebytes\MBAMService\LOGS the MBAMSERVICE.LOG file (which is moved to MBAMSERVICE.LOG.bk1, bk2, etc as it hits 10MB in size) was being hammered with new lines that matched the ones in this thread...

These log files would fill up within 10 minutes.....

Hi onebyteboi:

Just FYI, I checked my C:\ProgramData\Malwarebytes\MBAMService\LOGS folder and I currently have 10 MBAMSERVICE.LOG backups (i.e., with a .bk1, .bk2, etc. extension) dating back to 24-Apr-2022 and each is just over 10 MB in size.  It appears to be taking about 3 to 4 days for my MBAMSERVICE.LOG to reach it's max size and create a new backup.

The oldest backup, MBAMSERVICE.LOG.bk10, contains entries dating back to 20-Apr-2022.  I don't know if it's a coincidence but 20-Apr-2022 is the same day I upgraded from Malwarebytes v4.5.7.186-1.0.1645 to Malwarebytes v4.5.8.191-1.0.1666.  Once my current MBAMSERVICE.LOG reaches 10 MB I don't know if it will create a new MBAMSERVICE.LOG.bk11 file (i.e., if these backup files will continue to accumulate) or if the the oldest backup will be deleted to make room for a newer backup.

I've attached my oldest MBAMSERVICE.LOG.bk10 backup file (zipped) that includes log entries dating from 20-Apr-2022 to 24-Apr-2022 as well as diagnostic logs gathered with the Malwarebytes Support Tool.

MBAMSERVICE.LOG.bk10.zip

mbst-grab-results.zip

-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v100.0.2 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited May 31, 2022 by lmacri

[SPDIF]

The logs that are made by Malwarebytes are filled with errors from start to end like this;

 

05/25/22    " 13:37:22.155"    325531    0eec    149c    WARNING    DDSIG    InitializeIGReseed    "reseed.cpp"    430    "[TH=149C] Failed DeleteFile: currentigPath='C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-39.exe' ret=5"
05/25/22    " 13:37:22.172"    325546    0eec    220c    WARNING    ARWExclusionHandler    mb::arwcontrollerimpl::ExclusionsHandler::IsExcluded    "exclusionshandler.cpp"    666    "Path is not signed by MALWAREBYTES (C)!"
05/25/22    " 13:37:22.201"    325578    0eec    149c    WARNING    DDSIG    InitializeIGReseed    "reseed.cpp"    430    "[TH=149C] Failed DeleteFile: currentigPath='C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-40.exe' ret=5"
05/25/22    " 13:37:22.247"    325625    0eec    149c    WARNING    DDSIG    InitializeIGReseed    "reseed.cpp"    430    "[TH=149C] Failed DeleteFile: currentigPath='C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-41.exe' ret=5"
05/25/22    " 13:37:22.294"    325671    0eec    149c    WARNING    DDSIG    InitializeIGReseed    "reseed.cpp"    430    "[TH=149C] Failed DeleteFile: currentigPath='C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-42.exe' ret=5"
05/25/22    " 13:37:22.336"    325703    0eec    2144    WARNING    ArwSDK    kernelLogger::LogK    "arwlib.globals.cpp"    240    "tid: 1650 - [MBAMFarFlt] [farprocess.c:FarPsInsertProcess-237] Error inserting process (Process = FFFF89864E2A32C0, Entry = FFFFBC80C24A9A60)."
05/25/22    " 13:37:22.336"    325703    0eec    2144    WARNING    ArwSDK    kernelLogger::LogK    "arwlib.globals.cpp"    240    "tid: 1650 - [MBAMFarFlt] [farprocess.c:FarPsInsertProcess-237] Error inserting process (Process = FFFF89865128C2C0, Entry = FFFFBC80C24B2430)."
05/25/22    " 13:37:22.343"    325718    0eec    220c    WARNING    ARWExclusionHandler    mb::arwcontrollerimpl::ExclusionsHandler::IsExcluded    "exclusionshandler.cpp"    666    "Path is not signed by MALWAREBYTES (C)!"
05/25/22    " 13:37:22.344"    325718    0eec    236c    WARNING        mb::common::io::NtFileSystemUtils::QueryFileObjectAttributes    "ntfilesystemutils.cpp"    301    "Error getting attributes for 'C:\Program Files\Malwarebytes\Anti-Malware\ig-43.exe', error = 'The system cannot find the file specified. ' (0xc0000034)"
05/25/22    " 13:37:22.369"    325734    0eec    220c    WARNING    ARWExclusionHandler    mb::arwcontrollerimpl::ExclusionsHandler::IsExcluded    "exclusionshandler.cpp"    666    "Path is not signed by MALWAREBYTES (C)!"
05/25/22    " 13:37:22.390"    325765    0eec    220c    WARNING    ARWExclusionHandler    mb::arwcontrollerimpl::ExclusionsHandler::IsExcluded    "exclusionshandler.cpp"    666    "Path is not signed by MALWAREBYTES (C)!"
05/25/22    " 13:37:22.391"    325765    0eec    236c    WARNING        mb::common::io::NtFileSystemUtils::QueryFileObjectAttributes    "ntfilesystemutils.cpp"    301    "Error getting attributes for 'C:\Program Files\Malwarebytes\Anti-Malware\ig-44.exe', error = 'The system cannot find the file specified. ' (0xc0000034)"

[onebyteyboi]

11 hours ago, lmacri said:

Hi onebyteboi:

Hi Imacri,

These logs are normal and yes the 10th is deleted as a new one is created. Either a coincidence or the version you stated was when they were introducted. The fact yours span back to April is a good thing at least. Mine are full of errors because of the behavior of my batch script and I go through them like butter. My assumption is there to be a link between this mass of errors (in my case) and memory leakage. My situation is very edge case and fixable on my end so I am not too bothered if it is deemed low priority.

[onebyteyboi]

1 hour ago, SPDIF said:

The logs that are made by Malwarebytes are filled with errors from start to end like this;

I get a lot of the "Error inserting process", but your other ones look scary! 

[lmacri]

1 hour ago, onebyteyboi said:

Hi Imacri,

These logs are normal and yes the 10th is deleted as a new one is created. Either a coincidence or the version you stated was when they were introducted. The fact yours span back to April is a good thing at least. Mine are full of errors because of the behavior of my batch script and I go through them like butter. My assumption is there to be a link between this mass of errors (in my case) and memory leakage. My situation is very edge case and fixable on my end so I am not too bothered if it is deemed low priority.

Hi onebyteyboi:

Good to know that the number of MBAMSERVICE.LOG backups (i.e., with a .bk1, .bk2, etc. extension) shouldn't increase beyond ten files and eat up my available disk space.  I wonder if logging in MBAMSERVICE.LOG has become more verbose (i.e., if additional types of errors are being logged) since Component Package v1.0.1689 was released on 26-May-2022?

What is your definition of a memory leak?  Do you mean that the amount of RAM consumed by a Mawlarebytes process like MBAMService.exe or mbamtray.exe continues to grow steadily over time after every re-boot, and that additional memory used by one or more of these processes is not released (i.e., returned to the pool of available memory) after a Malwarebytes background task has finished running?

Note that user unknownguy recently reported seeing unusually high network activity in their 15-May-2022 thread Latest Stable Release Send Too Many Requests, which has since been moved to the Windows Malware Removal Help & Support board for one-on-one troubleshooting.  I have no idea if their issue is related in any way to your "memory leak", but it would be helpful if you could post Malwarebytes Support Tool diagnostic logs as previously requested.  These logs can only be viewed by Forum Administrators and users with advanced permissions.
-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v100.0.2 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[onebyteyboi]

2 hours ago, lmacri said:

Hi onebyteyboi:

Hi Imacri,

It is not any process that is growing in memory but the entire amount above and beyond what is tabled in processes. The amount is reset after reboot. I suspect it is possibly the Malwarebytes driver and not one of the .exe processes OR the Malwarebytes software is causing leaks in my aforementioned net.exe, net1.exe, timeout.exe causing them to reserve RAM without releasing it back when they close out (I don't know if this is how RAM works but I have heard something like it before; that a process can be closed but it's RAM reservations can stay?). I will look at this tool you listed.

Regards

[onebyteyboi]

An update on this RE latest version (4.5.10.200):

Latest version seems to have fixed this issue, although I have not kept my computer online for a decent length yet to make sure (I will let you know if anything changes). I am no longer seeing the "kernel" lines in the logfiles anymore.

Regards

[onebyteyboi]

Ok bah humbug, it doesn't look like it's fixed. But that's OK. It might not be possible with my constant opening and closing of processes and the nature of MWB.

 

Regards

[onebyteyboi]

I have decided to ditch my batch script and use Powershell. I no longer have issues. Also, FWIW the memory "leaked" does eventually get reclaimed.