mbarwind.arw high disk usage while playing GOW Ragnarok

[cyberblood]

As the title says, after approximately 1-2 hours of playing "God of War: Ragnarok", I notice heavy slowdowns caused by Malwarebytes heavily reading/writing to mbarwind.arw.
After the issue starts, my options seem to either reboot or completely close Malwarebytes to get the system back to normal.

I am a hard-core gamer, and no other games (so far) seem to trigger this issue; my guess it that it would involve something related to the PSN SDK.
I already added "programData\Sony Interactive Entertainment Inc\PSPC_SDK" and my GOW Install folder to the MalwareBytes Allow List as a test, but the issue persist.

I have these options turned ON:
- Real-time protection
- Web protection
- Malware and PUP protection
- Ransomware Protection
- Exploit Protection (and block potentially malicious email attachments)

Bruce Force and Tamper protection are OFF.

Malwarebytes is Version 5.1.11.133

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[David H. Lipman]

Have you tried putting the game's folder (where the game executes from) in the Allow List ?

[cyberblood]

Logs attached

mbst-grab-results.zip

[cyberblood]

12 minutes ago, David H. Lipman said:

Have you tried putting the game's folder (where the game executes from) in the Allow List ?

I did, that's what I meant when I said I added "my GOW Install folder to the MalwareBytes Allow List"

in my case, it would be:
G:\Games\SteamLibrary\steamapps\common\God of War Ragnarok

I also tried added the PSN folder:
C:\ProgramData\Sony Interactive Entertainment Inc\PSPC_SDK

Neither worked, as MalwareBytes still goes haywire after a couple of hours of gameplay.

[Porthos]

Instead of just adding folders to the allow list, also add the game executable itself.

Do you also see web blocks when playing the game?

Might want to add the to Defender as well.

Edited September 25 by Porthos

[cyberblood]

Ok, I am still having the issue, but here are a few updates

I used the "Malwarebytes Support Tool" to "clean/uninstall" Malwarebytes, rebooted then reinstalled.
I then went ahead and unchecked "Register Malwarebytes with Windows Security center" (I havent have any issues running both), and added the following to the exclusion list:

• G:\Games\SteamLibrary\steamapps\common\God of War Ragnarok\GoWR.exe (as suggested by Porthos)
• C:\ProgramData\Sony Interactive Entertainment Inc\PSPC_SDK
• C:\Users\MyUsername\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache (Nvidia shaders cache)

I started playing God of War Ragnarok, and it took about 40 mins for mbarwind.arw to heavily writing to disk.

21 hours ago, Porthos said:

Do you also see web blocks when playing the game?

then closed the game and  checked the "Detection history" as in blank, nothing detected.
then decided to try shutting down Malwarebyte's protection one at a time (instead of quitting all together),

• Web Protection
• Malware
• Ransomware

I did one at a time, and waited about 30 secs in between as a test, and once I turned OFF Ransomware protection, disk usage started going down.
it would seem that Ransomware protection is not playing nice with something the game (or the PSN SDK) are doing.

For now, I will go ahead and add GoWR.exe as an exclusion to Defender as well; While I dont see a reason to do it (since this is a Malwarebytes issue), but I might as well test it for the next time.

is there a way to further troubleshoot to see what is triggering the disk writes to mbarwind.arw ?

 

[Porthos]

2 hours ago, cyberblood said:

and once I turned OFF Ransomware protection, disk usage started going down.
it would seem that Ransomware protection is not playing nice with something the game (or the PSN SDK) are doing.

That is what I was going to ask you to do next, and that is what I figured was going to happen.

[cyberblood]

Yup, can confirm that "Ransomware protection" is the issue.
I had GoWR.exe added to Defenders exclusions then started playing again, once I noticed the slowdowns (after about 40 mins) and confirmed it was mbarwind.arw acting up, I alt-tabbed (leaving the game open) and turned off Ransomware protection, then everything went back to normal.

This seems to be the only game (so far) that triggers this issue for me, so it not terrible, but, should I be emailing/opening a ticket somewhere (besides this post) so Malwarebytes takes a look at this issue?

I also made a Reddit post about the issue, and two other users seem to have the same issue with "Apex Legends"; I have not played that in a long time, so I have not been able to confirm if it also affects me. Link below for reference.
https://www.reddit.com/r/Malwarebytes/comments/1fpeq6n/mbarwindarw_high_disk_usage_while_playing_gow/

 

[Porthos]

11 minutes ago, cyberblood said:

This seems to be the only game (so far) that triggers this issue for me, so it not terrible, but, should I be emailing/opening a ticket somewhere (besides this post) so Malwarebytes takes a look at this issue?

No, it's not needed. This is fine.

 

[AdvancedSetup]

Hello @cyberblood

Please follow the directions to enable "Event log data" in the General Settings

https://support.malwarebytes.com/hc/en-us/articles/22807114153235-Manage-Desktop-Security-settings-on-Windows-devices

 

Then restart the computer. Wait a few minutes to allow the system to load everything.

Then try to replicate the issue. Once you're able to replicate the issue, then run our MBST Support Tool and gather a new set of logs to review.

 

Thank you

 

[cyberblood]

I followed the instructions, and the Logs with Event log data turned ON are attached.

 

mbst-grab-results.zip

[AdvancedSetup]

Thank you for the log @cyberblood

I was unable to locate a specific reason in the log to account for the issue.

 

Please download Microsoft Process Monitor from the following link.
https://technet.microsoft.com/en-us/Library/bb896645.aspx

 

Try to guess about how long you can run the game before you'll notice an issue and try to run this Process Monitor before then (it makes huge logs so don't want to run forever)

Then when you believe the issue has happened, stop the monitoring and save the log to .PML format.

Then zip the file and see if  you can send via Wetransfer - get the LINK and send to me in a Private Message.

 

 

 

 

 

 

Upload File(s) to WeTransfer:

• Visit WeTransfer.com
• Click on I Agree
  
  
   
• Click on Manage Cookies
  
  
   
• Uncheck all the cookies and other Ad settings
  
  
   
• Click the triple dots for more options
  
  
   
• Select the Link option "Get transfer link" - then click the Message and enter a message.
  
  
   
• Click on +Add Files - Browse to the location of the file and double-click on it or click once on it and select Open
  
  
   

• Click on Get a link to send the file and get the link to post back
  
  
   
• Once the transfer completes, click on Copy link
  
  
  
   

Once you receive the Copied! message please save in notepad so you can post the link into your next reply

 

 

Edited September 27 by AdvancedSetup
Updated information

[AdvancedSetup]

You might want to run the Process Monitor without the game a couple of times to get used to it

 

Process Monitor 101

 

[cyberblood]

Ok, Thank you.

I again played for approximately 40 minutes, then turned ON Process Monitor capture, then the issue started happening around 5 mins after.
I have send you a PM with the WeTransfer Link, 115MB compressed (2.7GB PML)

 

[AdvancedSetup]

Thank you very much. I'll send this in to the internal team for review

However, please note the following

Important Notice: Support Times Delayed Due to Hurricane Helene

https://support.malwarebytes.com/hc/en-us/articles/33844486966163-Important-Notice-Support-Times-Delayed-Due-to-Hurricane-Helene

 

Depending on how things go it could be a week before most of the team is fully back to work again