MBAM Running Scans on E-Cores Only and causing system to lock during scan

[final]

Hello. I created an account here just to make this post. The title says it all.

I have a newer Intel CPU with the P-cores and E-cores and I need to be able to set CPU affinity on programs in order for my computer to run right.

I try doing it with Third Party apps like Process Lasso, and in Task manager and I get an error when I try to change CPU affinity.

Is there any way I can change the CPU affinity for MBAM so that my scans run 10x faster on the P-cores instead of the E-cores.

I have a 12700K BTW, and it has 8 P-cores that it could run the scan on but instead chooses to haggle the 4 e-cores that already have all my background processes running on.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[Porthos]

7 minutes ago, final said:

Is there any way I can change the CPU affinity for MBAM so that my scans run 10x faster on the P-cores instead of the E-cores.

There are only 2 options. Scheduled scans run at a low priority. 

Manual scans can be changed. But you can not choose core choice either way.

 

Edited February 7, 2023 by Porthos

[SPDIF]

With what OS you work? Windows 11 does choose what is the best cores to use, you can't change this at any way. Windows 10 just takes what is available and does not look further.  So windows 11 is the best OS to work with if you have an modern CPU with E and P-cores.

 

More info on this;

Thread Director will deliver faster performance on Windows 11 systems by optimizing the way that the cores of the CPU are structured by assigning workloads to the most appropriate or available resource at that time. It even takes factors such as temperature, operating conditions, and power setting into consideration. Windows 10 does not use this system at all!

Edited February 9, 2023 by SPDIF
Extra info

[SPDIF]

What makes Windows 11 better than Windows 10 in this regard is that Windows 10 focuses more on the power of certain cores, whereas Windows 11 expands that to efficiency as well. While Windows 10 considers the E-cores as lower performance than P-cores, it doesn’t know how well each core does at a given frequency with a workload, whereas Windows 11 does. Combine that with an instruction prioritization model, and Intel states that under Windows 11, users should expect a lot better consistency in performance when it comes to hybrid CPU designs.

Alder Lake and Raptor Lake has two sets of cores (P-cores and E-cores), but it actually has three levels of performance and efficiency: P-cores, E-Cores, and hyper-threads on P-cores. In order to ensure that the cores are used to their maximum, Intel had to work with Microsoft to implement a new hybrid-aware scheduler, and this one interacts with an on-board micro-controller on the CPU for more information about what is actually going on.

Edited February 9, 2023 by SPDIF

[final]

16 hours ago, SPDIF said:

What makes Windows 11 better than Windows 10 in this regard is that Windows 10 focuses more on the power of certain cores, whereas Windows 11 expands that to efficiency as well. While Windows 10 considers the E-cores as lower performance than P-cores, it doesn’t know how well each core does at a given frequency with a workload, whereas Windows 11 does. Combine that with an instruction prioritization model, and Intel states that under Windows 11, users should expect a lot better consistency in performance when it comes to hybrid CPU designs.

Alder Lake and Raptor Lake has two sets of cores (P-cores and E-cores), but it actually has three levels of performance and efficiency: P-cores, E-Cores, and hyper-threads on P-cores. In order to ensure that the cores are used to their maximum, Intel had to work with Microsoft to implement a new hybrid-aware scheduler, and this one interacts with an on-board micro-controller on the CPU for more information about what is actually going on.

Your right, its still just early in implementation yet. I seem to have an issue where some apps will run on only the efficiency cores instead of the performance cores. It happened a lot more in Windows 10, and not so much with Windows 11, but still some applications including malwarebytes have not been optimized yet. I guess because I use Process Lasso and basically set all the background apps to the E-cores myself, the thread director gets confused and does not understand what is going on. There is no reason why it should put all of the work on the E-cores in this scenario, since I already told it to put my background tasks on those cores. Other apps I don't have this issue. Only with a couple others. And every time they do not let me change the process affinity which is frustrating.

[final]

17 hours ago, SPDIF said:

What makes Windows 11 better than Windows 10 in this regard is that Windows 10 focuses more on the power of certain cores, whereas Windows 11 expands that to efficiency as well. While Windows 10 considers the E-cores as lower performance than P-cores, it doesn’t know how well each core does at a given frequency with a workload, whereas Windows 11 does. Combine that with an instruction prioritization model, and Intel states that under Windows 11, users should expect a lot better consistency in performance when it comes to hybrid CPU designs.

Alder Lake and Raptor Lake has two sets of cores (P-cores and E-cores), but it actually has three levels of performance and efficiency: P-cores, E-Cores, and hyper-threads on P-cores. In order to ensure that the cores are used to their maximum, Intel had to work with Microsoft to implement a new hybrid-aware scheduler, and this one interacts with an on-board micro-controller on the CPU for more information about what is actually going on.

I will also say I know that Windows 10 does not have the Thread Director. It just seems like some of the same issues persist despite having the thread Director.

[SPDIF]

I use an 13700K in my system, i never had any problem with the scan of my system with runs in the background unnoticed. Quite frankly i see no point why you should change that so it scans faster. MWB does what it should do and that is the most important. No AV will use the P-cores, they are programmed to run in the background unnoticed. A gamer for example would not like that while gaming or someone working in an office with 3D software, and they al have to work on a slow computer while the AV scans the system. I prefer not to use the P but the E-cores, no need to use a lots of power for just a simple scan. I the mean time you can continue to work with your computer, without worry.

It's as they say; If it ain't broken, don't fix it! And in this case fixing  it is impossible anyway without reprogramming the thread director, something no one would like in this scenario. The tread director use the P-cores when you don't use the computer i noticed recently, so it's smarter then you think, and i like it this way.

 

Edited February 10, 2023 by SPDIF

[Porthos]

The threat scan, which is the recommended scan, Should not take long enough to worry about it.

 

[SPDIF]

Exactly my point Porthos, indeed a threat scan goes very fast! Best you have an SSD or NVMe drive then you don't have to think about cores anyway.

[AdvancedSetup]

Current scan time for a manual Threat Scan on my system

 

For scheduled scans we added a new feature called Smart Scan that can also help improve performance for some customers.

 

Malwarebytes for Windows 4.5.21 Release Notes
https://support.malwarebytes.com/hc/en-us/articles/13535349106963-Malwarebytes-for-Windows-4-5-21-Release-Notes

 

• Smart Scan: We just changed the game for scheduled scans with Smart Scan! The Smart Scan option now allows a scheduled scan to start only if the computer is in an idle state.
  Limiting scheduled scans to start only idle time will provide a significant performance improvement as the default nightly scheduled scan (that is typically skipped because the device is usually powered off at night)
  will no longer kickoff when the computer is first started and hog resources that are needed for the task at hand.
  • Smart Scan is automatically enabled for the default scheduled scan.

  • Smart Scan is on by default for all new scheduled scans.

 

 

 

 

Edited February 10, 2023 by AdvancedSetup
Updated information

[TomB64]

On 2/8/2023 at 10:36 PM, SPDIF said:

What makes Windows 11 better than Windows 10 in this regard is that Windows 10 focuses more on the power of certain cores, whereas Windows 11 expands that to efficiency as well. While Windows 10 considers the E-cores as lower performance than P-cores, it doesn’t know how well each core does at a given frequency with a workload, whereas Windows 11 does. Combine that with an instruction prioritization model, and Intel states that under Windows 11, users should expect a lot better consistency in performance when it comes to hybrid CPU designs.

Alder Lake and Raptor Lake has two sets of cores (P-cores and E-cores), but it actually has three levels of performance and efficiency: P-cores, E-Cores, and hyper-threads on P-cores. In order to ensure that the cores are used to their maximum, Intel had to work with Microsoft to implement a new hybrid-aware scheduler, and this one interacts with an on-board micro-controller on the CPU for more information about what is actually going on.

LOL! Wow! You have eaten up that MS marketing BS hook, line, and sinker! You actually are believing the new Intel marketing strategy. THe strategy is to APPEAR (smoke and mirrors, the processor, thread counts are not understood to most users) to provide lots of cores, charge MORE money for it because it is BETTER, but truly just give inferior cores that cannot handle any REAL processing tasks. As with other INTEL Boondoggles time will tell if these E-cores (actually subsets of P-Cores that FAILED P-Core standards on the die) really add any benefit, or were just a way to use up silicon in the manufacturing process.

So if you lack enough P-Cores for your process what happens??? If all the P-Cores are busy, what happens? Think about that. You WAIT and wait and wait in a queue or ERROR off. This concept while academically novel, is not practical. You end up with LESS cores and MS tries to do more with less, all to save power for the EU standards. It sacrifices performance for power savings. Ask yourself why do server level CPUs ONLY have P-Cores? Because it is NEEDED for the REAL work.

As to MS ability to actually produce an OS that truly works with this complicated level of functionality is still to be determined. Instead of ALL cores being available it LIMITS processes to certain cores and you WAIT until they are available. Do NOT dare use the available P-Cores because that would consume more power. Getting this nuanced and parsed in an OS is nonsense. Just throw the bare metal hardware at the OS and run it all out (Linux/UNIX approach, it runs at 100% all the time) That is the PROVEN experience record over the last 50 years of my computer experience. Reserving processors or throttling processing NEVER helps in the big picture. Remember MS's GOAL is all about certain metrics that make their OS appear to perform at a certain level. When you know all the background BLOATWARE MS runs under the scheduler or as sub-processes, hidden from you, you figure out why they added these cores, to handle their bloatware which was HOGGING the cores.

As learned in the past, letting an OS take control of the hardware to the performance level is nonsense. It is just another KLUGE of MS's to get certain results they want to tout. As with MANY MS products, TIME will tell if this really works.

Once MS moved to a .net underlying layer for the OS, they defeated most efficiencies with their .net BLOATWARE. 

[TomB64]

On 2/9/2023 at 10:09 PM, AdvancedSetup said:

Current scan time for a manual Threat Scan on my system

 

For scheduled scans we added a new feature called Smart Scan that can also help improve performance for some customers.

 

Malwarebytes for Windows 4.5.21 Release Notes
https://support.malwarebytes.com/hc/en-us/articles/13535349106963-Malwarebytes-for-Windows-4-5-21-Release-Notes

 

• Smart Scan: We just changed the game for scheduled scans with Smart Scan! The Smart Scan option now allows a scheduled scan to start only if the computer is in an idle state.
  Limiting scheduled scans to start only idle time will provide a significant performance improvement as the default nightly scheduled scan (that is typically skipped because the device is usually powered off at night)
  will no longer kickoff when the computer is first started and hog resources that are needed for the task at hand.
  • Smart Scan is automatically enabled for the default scheduled scan.

  • Smart Scan is on by default for all new scheduled scans.

 

 

 

 

This is a false assumption. I NEVER turn off my devices at night. Repeatedly restarting hardware, especially physical hard drives reduces the LIFE of the product. Electrical devices should be started and at slow times, go to a reduced state when not active, but not fully turned off. The surge of a restart is hard on devices. This is an "energy saving" approach, not a professional computer user behavior.

Besides night time is when I am RUNNING overnight housekeeping. Basing assumptions on non-technical consumers of computer technology is never going to work. That level of user should stick to a tablet or other web browser based product. Better yet, MWB developers should code in intelligence to determine the USERS pattern and ADAPT the scanning as proper, instead of ASSUMING one method. it is not that much extra code IF you know how to do it.

Specific to this question/issue, the way MBAM decides "Idle" is incorrect. I am running a system back up utilizing 90% CPU and MBAM THINKS this is a "idle time" so lets SCAN. It sends my laptop into thermal throttling or triggers a power off because of thermal limits. MBAM is using 71 THREADS and adding 65% CPU usage (on a 6 REAL core, 12 hyper thread, Coffee Lake, i7 9850H at 4.4Ghz) usage along with 20 DISK IO links to mess with the Shadow copy being used for the BACKUP process.

How do we control this "feature" or TELL it when to scan? The current "Idle" mode does not work.
 

[Porthos]

2 hours ago, TomB64 said:

How do we control this "feature" or TELL it when to scan?

You could have led with this. Keep in mind a Default threat scan is all that is needed. Also, do NOT enable "scan for rootkits".

Delete the current scan and set up a new scheduled scan and toggle off "smart scan" and choose your desired scan time.

 

 

[AdvancedSetup]

Please do not necro post reply to ancient posts. If you need assistance, please create a new topic.

Thank you