mbamservice.exe hogging resources

[Skyezz]

I am presently running Malwarebytes Anti-malware version 1.45.

I have had this registered program for several months now but, since my last update,

mbamservice.exe has been hogging resources to the extent that I have taken to just turning the whole thing off.

Even as I write this, my Windows Task Manager shows about 100% of my resources being continuously used by mbamservice.exe.

I have a pretty up to date computer and am running Win XP Pro 5.1.2600 service pack 3 build 2600.

Is there a fix for this???

I've done some research on this topic and this problem seems to be a verrrrryyyyyy long termed problem with this program.

Will there ever be a true fix?

My license to renew with malwarebytes should be coming up soon. Should I just disable this program, cut my losses, and find another program that works?

Sorry if I sound harsh but I probably paid $50 for this program and I have spent the last few weeks very disappointed in it.

Excuse me while I go and reboot now.

[Firefox]

First off the price of the program is only $24.95 and it is a life time license. Where did you pay $50 and why do you have to renew it.

It is quite possible that your antivirus software and Malwarebytes is not playing together correctly. What Antivirus software do you use?

Please exclude the following files from your antivirus:

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude them from it as well

For Windows XP:

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
  
• C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude MBAM.EXE from it as well

Note: Once that's done, please make sure that if either of those programs has any sort of web filter, that you add the following as a trusted site:

data-cdn.mbamupdates.com

The FAQ contains examples of setting file exclusions for some known AV products

Please post back and let us know how it went.

[noknojon]

My license to renew with malwarebytes should be coming up soon.

Welcome Skyezz -

First you never have to renew your license - It is a Lifetime license for you -

Please respond to Firefox as to your A/V program -

Thank You -

[Skyezz]

Hi Firefox and noknojon,

Sorry if I sounded so upset before. I have been trying to find a work around for this problem for 2 or 3 weeks now (on my own) and haven't had any luck so far. I have spent a lot of hours researching, reading about and trying various things concerning this problem and I guess that I had just reached a point where I was just totally frustrated. With computers, it probably happens to all of us at one time or another. Sorry.

I am running CA Security Center from Time/Warner as my AV. I have excluded the files from my antivirus/firewall as suggested by Firefox, (Thanks) and have seen no improvement. I am also now having trouble getting updates to malwarebytes unless I totally turn off my firewall.

I have tried pretty much everything that people have suggested on this and in other forums. The only things that have improved my computer speed was when I totally uninstalled Malwarebytes. Once I reinstalled it however, I had the same problems as before. Both with updating and with resource usage.

I know that it is undoubtedly my firewall/AV that is in conflict with Malwarebytes, but this problem just never occurred before this latest (ver. 1.45) update. I was always 100% happy with the product until just recently. Also, I have noticed that others have had this problem while using other AV's.

My inclination now is to just disable the program and to wait until version 1.46 comes out and see if that fixes the problem. I realize that this puts my computer at great risk but currently I spend most of the day watching my Task Manager show 60-100% CPU usage for long periods of time. (Pentium 4, 3.4ghz, w/ 2ghz RAM.) I am just at my wits end and need to get some work done.

I appreciate this forum and the good people who take the time out of their day to help customers. Its not very typical that software has such good support, both from tech support and from other customers.

I will continue to monitor this forum often and anticipate a quick fix to this problem either from the developers, or another user. I will still (probably/maybe) run Malwarebytes some of the time. I just keep finding myself turning it off more and more these days. No doubt, big mistake.

Thanks again for your help and I hope that you both have a great week.

[greyowl]

I am having a similar problem. I am running XPsp3 and Avira Security Suite. My CPU is at 100% most of the time and my curser has an hour glass most of the time. If I shut down all the MBAM realtime functions, will this disable it? How soon can we expect a fix?

[exile360]

Both of you please do the following, I suspect something else is going on that's conflicting with MBAM (I know it's not Avira as we have many Avira users, both of the free and premium versions, who don't have this problem):

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here and save it to your desktop.
  
  • Note: If using Windows Vista or Windows 7 then you also need to do the following:
    
    1. Right-click on Autoruns.exe and select Properties
       
    2. Click on the Compatibility tab
       
    3. Under Privilege Level check the box next to Run this program as an administrator
       
    4. Click on Apply then click OK
       

  [*]Double-click Autoruns.exe to run it.

  [*]Once it starts, please press the Esc key on your keyboard.

  [*]Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures

  [*]Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.

  [*]When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.

  [*]Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder

  [*]Attach the Autoruns.zip folder you just created to your next reply

Thanks

[greyowl]

Attached is the Autorun.zip.

Thanks for the help.

AutoRuns.zip

[exile360]

Disable Autostart Entries Using Autoruns:

Please open Autoruns.exe again and allow it to perform its scan. Once it finishes please proceed with the following:

• Click on the Boot Execute tab and click the checkbox on the left side of each of the following so that they are unchecked:
  
  
  
  
  
  • autocheck PuranDefragBT -AD
    

  [*]Once that is complete, restart your computer.

Let me know if that corrects the issue or not.

Thanks

[greyowl]

Samuel,

Unfortunately, this did not correct the problem.

I did a Flash scan with MBAM and found a Trojan.Qhost and removed it.

But, the problem still persists. The CPU is running too high and there is an hour glass on the cursor most of the time.

Please give me some more instructions on correcting this.

Thanks you for the help.

[exile360]

Since you found an infection, it's possible, even likely, that infection is at the root of the issue. I'd have to recommend you starting a topic in the Malware Removal part of the forum to receive a check up.

[greyowl]

Samuel,

I have discovered that if I disable the new feature ProActiv of Avira 10, then the excessive CPU use declines so this may fix the problem. I had not had problems before, but maybe a recent Avira update precipitated the problem.

I will watch it for a while and if I have further problem, then I'll start a topic on the Malware Removal section. Unless, you think I should go ahead with it now.

Thanks again for your help.

greyowl

[Perdido Beach]

Hi Folks...

I am having the exact same issue...(Ver 1.45) Extremely HIGH CPU usage on a WIN XP SP3 System.

It appears that is is doing a SCAN (No , I have NOTHING in the Scheduler) which cannot be seen or stopped.

The MBAM service is working hard when viewed with Task Manager.

If I remove the MBAM starup processes by use of MSCONFIG, then the machine sits idle with 99% free time...

If the MBAM process is allowed to start -up normally, there I go, back to 80-99% CPU usage which effectively makes the machine unusable.

2 other machines (1 -Win7 64 bit and 1 - WinXP SP3 are not experiencing the trouble -YET)

Shuttting down my Anti Virus had no affect.

Am using the normal Win Firewall. This is a recent issue last several weeks.

Something is not right here...

Appreciate any and all input.

Steve

Perdido Beach, AL

[exile360]

Greetings Steve

Please do the following:

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here and save it to your desktop.
  
  • Note: If using Windows Vista or Windows 7 then you also need to do the following:
    
    1. Right-click on Autoruns.exe and select Properties
       
    2. Click on the Compatibility tab
       
    3. Under Privilege Level check the box next to Run this program as an administrator
       
    4. Click on Apply then click OK
       

  [*]Double-click Autoruns.exe to run it.

  [*]Once it starts, please press the Esc key on your keyboard.

  [*]Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures

  [*]Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.

  [*]When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.

  [*]Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder

  [*]Attach the Autoruns.zip folder you just created to your next reply

Thanks

[Perdido Beach]

Exile360,

Many thanks for your reply,

I will have to re-install and add my ID and key to do this...

The machine was so taxed that I could not use it so I disabled the MBAM startup, booted and uninstalled.

I'll reinstall on that same machine and run your test as instructed.

Thanks for your attempt to isolate the problem.

Steve

Perdido Beach, AL

[Perdido Beach]

Exile360,

Here is the file, hope is contains a clue.

Malwarebytes has worked jsut fine since December 2009 but recently, within the last 3 -4 weeks ... the slowdown has made the machine unusable without uninstalling Malwarebytes....

I thank you and look forward to hearing from you

Steve

Perdido Beach, AL

AutoRuns.zip

[exile360]

Hello again

Is your HP printer hooked up via network or is it directly connected to your PC via USB or Parallel connection?

Do you still have any Acronis products installed?

[Perdido Beach]

Exile,

No Acronis now. Printer hooked up via USB and I did have access trouble today accessing that printer from the office PC running Win XP SP3.

Sending a print to it froze up the access application on the office PC.

Steve

Thanks so much for all your trouble helping !

[YoKenny1]

Perdido Beach I had to delay MBAM GUI at least 30 seconds with WinPatrol on my XP Pro system to prevent system problems.

I still have Acronis True Image Home 2010 on my XP Pro system.

Please see this hint from here

mbamservice.exe uses a lot of memory and CPU on my XP Pro system especially at startup.

[exile360]

The issue with networked printers in some setups is a known issue and is being looked into. It is possible that it's related to the other problems you're having but for now lets get rid of those Acronis drivers since you no longer have it installed:

Delete Autostart Entries Using Autoruns:

Please open Autoruns.exe again and allow it to perform its scan. Once it finishes please proceed with the following:

• Click on the Drivers tab and right click each of the following entries and select Delete:
  
  
  
  
  
  • snapman
    
  • tdrpman
    
  • tifsfilter
    
  • timounter
    

  [*]Once that is complete, restart your computer.

Please let me know if that makes any difference or not (I doubt it, but without Acronis installed, there's no reason to have its drivers loading every time your PC boots up).

Thanks

[stuchido]

Hi all,

I just purchased and installed the product and from the moment I activated it, my CPU is at 85% or more.

I am attaching my autoruns.zip file for analysis. I am running XP SP3 on a Dell Lattitude D630 with 4GB of RAM and an Intel Core2 DUO 2.4 GHZ processor.

Any help would be appreciated.

Thanks

AutoRuns.zip

[exile360]

Greetings

I see that you are running McAfee Virusscan Enterprise.

Please follow the instructions posted here to see if they resolve the issue.

If they do not and this is a work computer then please contact Malwarebytes Corporate Support at corporate-support@malwarebytes.org.

Please include your CleverBridge ID # so that they can expedite your support request.

Thanks

[Perdido Beach]

Exile,

Although I am not running Acronis True Image Home, I am, using MaxBlast 5 to make a full system image backup once a month...

I suppose that is where those drivers are coming from ??

The image is placed on a removable HD.

Thought I would mention that before I did anything.

Of course, there may be other backup systems that would be more compatible with MalwareBytes.

Backup is important and with the amount of software out there, it sometimes leaves us confused as to what is REALLY best...

Appreciate you comments and suggestion at this point.

Steve

Perdido Beach, AL

[exile360]

Ah, I see. Yes, that could be how they got on there indeed. No worries, I doubt they're related to the issue with Malwarebytes' Anti-Malware, I just didn't realize that you needed them since you said you had no Acronis software installed so I thought it best to remove them. Keep them as they are as you do not want to break the functionality of your backup software .

[Perdido Beach]

Exile,

After removing MaxBlast and UNCLICKING "Start malicious website blocking...." all seems to have settled down.

Wish I had not done 2 things at once although I do have another machine running XP Pro and all seems normal on that machine.

The macine giving us so much trouble acted like it was working the scheduler (constant disk activity and showing mbam services as the working proces) , however, there was nothing scheduled and I had made sure the scheduler was clear the day before. Whatever the problem, it is serious in that it effectively terminates the use of the computer until Malwarebyte services are stopped.

I'll post immediately if something goes awry.

Regards,

Steve

Perdido Beach, AL

[exile360]

Determining the cause should be simple enough with those 2 variables, just enable Website Blocking on startup again, reboot, and then see if the issue returns. If it doesn't, then it was a conflict with MaxBlast, if it does, then it's the Website Blocking component and most likely totally unrelated to MaxBlast.