Mbamservice.exe - 30 to 80 CPU

[Ben-amin]

Hello, i don't know the problem but when i start the PC the MBAMservice.exe gets on and use about 30-80 CPU all the time.

I tryed to add the enclusions to my COMODO firewall and my Antivir premium suite....

But it haven't changed and i tried to uncheck the malware of site block thingie..

None of them worked...

What should i do?

I got the version 1.46.

[nosirrah]

What do you have for hardware?

[Ben-amin]

MS Windows XP pro 3 SP3

Intel pentium 4 processor CPU 3.000ghz, 1,0GM RAM, ASUS AH4650 series.

[noknojon]

Hi -

Can you also check the Database Version of the program - When you click on the Update tab it will show you -

About 4585 is current -

Thank You -

[Ben-amin]

4573

it's on.

[Ben-amin]

EDIT: I updated and now it's on 4586

[noknojon]

Hi -

Just try a quick scan now and see if there is any change with your problem -

Thank You -

[Ben-amin]

I've done that... the problem is that an "ipconfig.exe" starts every second and maybe that cause the CPU usage of the MBAMservice.exe?

or could it be something else?

Thanks for answer.

[Firefox]

Can you elaborate on this...

the problem is that an "ipconfig.exe" starts every second

Is this something you are doing yourself?

[Ben-amin]

No it's not me whos doing it... it's automatiicly starting. I don't know really why, bu i think it's my Belkinacces USB stick who is making this... but the thing is that i have like 4-5 ipconfig.exe and one is always restarting.. it's really weird and i dont know how to stop it..

Could it be that who making the CPU with the MBAMservice.exe so high?

Can you elaborate on this...

Is this something you are doing yourself?

[Haider]

Hello Ben-amin:

I don't think ipconfig.exe should show up in normal circumstances in taskbar, could you please copy/paste Quick Scan log (current definition version 4591)

Should you have any other question(s) please post back

[Firefox]

Like Haider has stated, there is no reason to have ipconfig running every two seconds....

have you tried updating your Malwarebytes to the latest version and database as well and running a quick scan?

Can you post the log so we can see it here please.....?

[Ben-amin]

Here you have the logg from the latest.

I've scanned before and i found some threats, but those were "safe" applications and files because i use them for my own purpose and so.

Would that be a problem?

Here it the latest.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Databasversion: 4586

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

2010-09-11 11:33:04

mbam-log-2010-09-11 (11-33-04).txt

Skanningstyp: Snabbskanning

Antal skannade objekt: 143627

F

[Ben-amin]

And for my own use. (Not in illegal way)

[noknojon]

H -

Are you running any Torrent / uTorrent / type of programs on your system -

This will be the cause of the problem if you are - We do not agree with it's use as most sites carry generally illegal software -

Thank You -

Ardamax Keylogger Software Informer: Latest version download, news ...

please, don't buy or publicize Ardamax keylogger. Because it's a fraudlent software, they just have frauded me and probably many others customers. ...

ardamax-keylogger.software.informer.com/

What is Hacking Tool Dialupass.C. Encyclopedia. Panda Security

Dialupass.C is a hacking tool. These are programs designed to enable malicious users to cause or facilitate action ...

Technical name: Hacktool/Dialupass

I think we have solved your problem -

Regards -

[Ben-amin]

Yes i do use Utorrent.

And about Ardamax... The thing you say is just from a customer who got "frauded" i use it and haven't got frauded.

And it's harmless.

About the Keysniff, i deleted those who was marked as dangerous.

Thanks

[GT500]

No it's not me whos doing it... it's automatiicly starting. I don't know really why, bu i think it's my Belkinacces USB stick who is making this... but the thing is that i have like 4-5 ipconfig.exe and one is always restarting.. it's really weird and i dont know how to stop it..

Could it be that who making the CPU with the MBAMservice.exe so high?

Yes. Every time an application launches MBAMService's CPU usage will spike. Mine will spike anywhere from 2%-30% depending on the application that is launching, but that is going to be different for different processors (mine is an old dual-core AMD FX-60, socket 939, so newer processors will fair better than mine does).

[1PW]

Yes. Every time an application launches MBAMService's CPU usage will spike. Mine will spike anywhere from 2%-30% depending on the application that is launching, but that is going to be different for different processors (mine is an old dual-core AMD FX-60, socket 939, so newer processors will fair better than mine does).

Please forgive my intrusion on this thread.

I believe the operable clue, on the part of the OP, is that the Comodo

application is in use.

This past Wednesday, September 15th, Comodo's personal firewall, as

part of Comodo Internet Security (CIS), was upgraded to version

5.0.162636 from a previous version 4.1.150349.

In the case of two of my XP systems (Home & Pro SP3 32bit), I upgraded

Comodo from version 4 to 5 and I too see mbamservice.exe CPU Usage, as

observed by Process Explorer v12.04, peak to over 40% and sustain a

constant 10% or greater on an otherwise idle system.

Furthermore, Within Comodo's version 5, switching the Firewall section

from "Safe" to "Disable" has only slight usage effect. In fact, disabling

"Defense+" also did not significantly ease the CPU Usage of

mbamservice.exe either. However, exiting Comodo completely was the

only thing that quieted mbamservice.exe to 0% on an otherwise idle

system.

Both of my XP system's MBAM are the full v1.46 with DTBS version 4645.

Again - I apologize for the intrusion.

[GT500]

1PW, thank you for the info. I'll make sure that our QA department is aware of this.

[1PW]

1PW, thank you for the info. I'll make sure that our QA department is aware of this.

Greetings GT500:

I have also made reference to this thread in the Comodo forum. I hope this does not start a

finger pointing contest between Comodo & MBAM. These of course are both superior products

in their chosen niche.

<https://forums.comodo.com/install-setup-configuration-help-cis/cis-50162636-vs-mbam-t62001.0.html>

HTH

[noknojon]

Hi 1PW -

As long as the Comodo users configure the exclusions listed below , there is usually no problems -

You tend to find that there are other processes running on top of both of these 2 basic programs (MBAM and Comodo) - Not unusual -

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude MBAM.EXE from it as well

Note: Once that's done, please make sure that if either of those programs has any sort of web filter, that you add the following as a trusted site:

data-cdn.mbamupdates.com

Thank You -

[GT500]

I have also made reference to this thread in the Comodo forum. I hope this does not start a

finger pointing contest between Comodo & MBAM. These of course are both superior products

in their chosen niche.

Actually, I'm fairly positive that Comodo wants to work with us on compatibility issues.

[1PW]

Hi 1PW -

As long as the Comodo users configure the exclusions listed below , there is usually no problems -

You tend to find that there are other processes running on top of both of these 2 basic programs (MBAM and Comodo) - Not unusual -

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude MBAM.EXE from it as well

Note: Once that's done, please make sure that if either of those programs has any sort of web filter, that you add the following as a trusted site:

data-cdn.mbamupdates.com

Thank You -

Hello noknojon:

We may need to consider an approach where the least experienced Full version MBAM user need not engage the services of an expert just to permit their system to run correctly.

The default installation of a Full version MBAM 1.46 should not make a system unusable. This is quite the case where a lesser system (Intel Pentium III E (Coppermine) 650MHz, 768Mb) running XP Pro SP3 and Comodo Internet Security 5.0 is spending 80+% CPU Usage on mbamservice.exe on an otherwise idle system.

Perhaps without giving adequate thought to this situation, a Comodo forum moderator suggested that MBAM not be used:

<https://forums.comodo.com/empty-t62001.0.html;topicseen>

We really don't want anyone suggesting the exclusion of MBAM from their systems.

My $.02USD

[GT500]

We may need to consider an approach where the least experienced Full version MBAM user need not engage the services of an expert just to permit their system to run correctly.

Adding exclusions to the anti-virus is always the best solution. As Doug (our VP of development) has pointed out, compatibility issues between MBAM and an anti-virus are rarely the fault of MBAM. Our protection module does not work like a normal anti-virus does. It only scans each application as they launch, so MBAM is not constantly monitoring the processes from your anti-virus (it only checks them once when they first execute). On the other hand, if I am not mistaken, your average anti-virus will constantly monitor the processes from MBAM, and scan any file they access (as long as it is a file type that they are set up to scan), which is why adding exclusions for MBAM's processes and files to your anti-virus software always solves compatibility issues. As long as your anti-virus software leaves MBAM alone, then compatibility issues pretty much never happen.

[exile360]

I tested this myself in a VM running Windows XP Service Pack 3. I installed CIS Free (all components except the DNS Server option which is not selected by default on installation) and after setting full exclusions in all of CIS's components for MBAM, I'm happy to report that there were no constant CPU spikes at all. When a new process was executed in memory, mbamservice.exe would jump up in CPU usage while checking the process, then it would go back to 0% and stay there until I ran another process.

I believe the config settings for the exclusions I made are stored in 3 config files (one for each component of CIS) in its program folder. I have them in case Comodo needs them.

For info, I did not just exclude MBAM's processes, I also excluded its entire program folder, both drivers (mbam.sys and mbamswissarmy.sys) as well as the C:\Documents and Settings\All Users\Application Data\Malwarebytes folder.

Setting exclusions between security softwares is unavoidable these days considering the low-level stuff that modern antivirus software is doing. I understand why they do it, it is often necessary so I'm not saying they shouldn't, but it just adds an additional prep step when getting everything set up, which in my opinion is just a minor inconvenience at best, and well worth it for adding that additional layer of protection to help prevent infection.