Exploit Protection Slows down any output redirection

[HarryWho]

 I was having many "Exploit payload process blocked" whenever I ran console commands with output redirection, like "dir | findstr Malwarebytes"
So I downloaded and installed Malwarebytes 5.0 to make it go away.

Now whenever I run a command with output redirection, it's very sllooooowwww unless I turn off exploit protection
So now I leave exploit protection turned off.

Here are some illustrations of the slowdown.

         WINDOWS 11

OS Name    Microsoft Windows 11 Pro, Version    10.0.22635 Build 22635

Malwarebytes version 5.0.15.93
Update package version 1.0.78168
Component package version 1.0.1105

-------exploit protection disabled------------
dir > nul
------------Elapsed Time :  00:00:00.071

-------exploit protection enabled------------
dir > nul
------------Elapsed Time :  00:00:02.117

-----------------------------------------------------------------------------------

-------exploit protection disabled------------
for /f %C in ( ' echo hello ' ) do set string=%C
set string=hello
------------Elapsed Time :  00:00:00.103

-------exploit protection enabled------------
for /f %C in ( ' echo hello ' ) do set string=%C
set string=hello
------------Elapsed Time :  00:00:04.179

-----------------------------------------------------------------------------------

Here "lastfile.bat" finds the newest file in a directory and put the file name into the clip, into a variable "NEWESTFILE" and displays the name... and it uses several cammands with output redirection.

-------exploit protection disabled------------
lastfile.bat
%NEWESTFILE% ** = Badass2.jxl is in the clip
12/07/23  04:38 PM           139,816 Badass2.jxl
------------Elapsed Time :  00:00:00.531

-------exploit protection enabled------------
lastfile.bat
%NEWESTFILE% ** = Badass2.jxl is in the clip
12/07/23  04:38 PM           139,816 Badass2.jxl
------------Elapsed Time :  00:00:10.696

-----------------------------------------------------------------------------------
-----------------------------------------------------------------------------------

Oddly enough, I have the same problem on an older windows 10 machine, using Malwarebytes 4.6

        WINDOWS 10

OS Name    Microsoft Windows 10 Pro, Version    10.0.19045 Build 19045

Malwarebytes version 4.6.7.301
Update package version 1.0.78162
Component package version 1.0.2222

-----------------------------------------------------------------------------------

-------exploit protection enabled------------
C:\ProgramData\Microsoft\Windows\Start Menu\Programs # dir /b | findstr Malwarebytes
Malwarebytes.lnk
------------Elapsed Time :  00:00:04.343

-------exploit protection disabled------------
C:\ProgramData\Microsoft\Windows\Start Menu\Programs # dir /b | findstr Malwarebytes
Malwarebytes.lnk
------------Elapsed Time :  00:00:00.203

-----------------------------------------------------------------------------------

-------exploit protection enabled------------
E:\utils # for /f %C in ( ' echo hello ' ) do set string=%C
E:\utils # set string=hello
------------Elapsed Time :  00:00:04.375

-------exploit protection disabled------------
for /f %C in ( ' echo hello ' ) do set string=%C
set string=hello
------------Elapsed Time :  00:00:00.265

-----------------------------------------------------------------------------------

-------exploit protection enabled------------
E:\utils # dir>nul
------------Elapsed Time :  00:00:02.218

-------exploit protection disabled------------
E:\utils # dir>nul
------------Elapsed Time :  00:00:00.077

------------------------------------------------------------------------------------------------

Conclusion - I'll keep exploit protection truned off and ignored until it gets fixed. The delays are just too annoying for me.

[Dave77]

There is definately a delay even loading a command prompt in Windows 10 with Exploit Protection turned on, using Malwarebytes 4.6.7.

This has only started happening recently.

This can be replicated easily by just turning exploit protection on/off and starting a command prompt. The delay is consistant and very noticable.

[Dave77]

This has been reported here, seems to be the same issue?

 

[HarryWho]

Thanks Dave77 !
I didn't realize that actually there's no need for redirection to notice the delay with Malwarebytes version 5

I just assumed it was the redirection because that's what was giving me the false "Exploit payload process blocked" (which was even more annoying).

And yes, I just started noticing it recently, with windows 10/malwarebytes 4.6 AND Windows 11/malwarebytes 5

so, just the plain old "dir" command is much slower with exploit protection ON.

example:

exploit protection ON

dir

...

2058 File(s) 1,118,700,653 bytes
123 Dir(s) 1,525,729,992,704 bytes free
Elapsed Time : 00:00:02.294

exploit protection OFF

Elapsed Time : 00:00:00.243

[tetonbob]

This issue has been addressed in the current Beta release.