Malwarebytes reeks havoc with DPC levels on Win 7 and 8

[Kamakzie]

I had a problem with DPC levels in 8 and assumed it was Windows 8 itself. After troubleshooting on the Microsoft forum it was showing my DPC issues were caused by the ndis.sys which is related to my NIC card. I was using onboard Realtek NIC. So I got a different PCI NIC with the same result. The high DPC makes audio stuttering and popping. So anyways I bought a PCI-e NIC from Intel, same issue. So I had it with Windows 8. I installed 7 again and all was great, until I installed Malwarebytes again. I was running DPClat at the time and then my DPC values skyrocketed again. I uninstalled MB and my numbers went back to normal. I booted 8 and clocked MB and again no more sound issues. Then I noticed if I uncheck "Enable malicious website blocking" everything is fine. Any ideas whats going on? It did this problem in both OS'. I can't run it with the website blocking on if its going to make my sound glitchy!

Thanks!

[exile360]

Greetings and welcome

This issue has been reported by several others. It seems that some sound cards for some unknown reason share IRQ addresses with your NIC/LAN, meaning anything which adds any overhead to your NIC (in this case the blocklist filtering used by Malwarebytes Anti-Malware's website blocking component) will likely cause more frequent interrupt requests, thus resulting in audio issues. Note that this ONLY occurs if the IRQ address for your audio device/sound card is the same as your NIC.

We are looking into the problem, however it may end up being one we're unable to solve. Quite frankly, I cannot understand why a sound card would be sharing the same IRQ space as a NIC but apparently the drivers for some brands of cards do this very thing, which explains why some users have this problem and some users do not.

[exile360]

You may also find this to be of use, just be careful and be sure to back everything up before you make any changes if you do decide to give it a try.

[Kamakzie]

Hmmm that is odd because my NIC and Soundcard aren't on the same IRQ. Plus my Intel NIC is PCI-e and my sound card is PCI. After reboot I see that the website protection re-enables itself. Anyway I can keep it disabled without it turning itself back on?

[exile360]

That is strange. If that's the case, then it should not affect audio throughput, at least according to the info I've gathered about this issue so far.

As for disabling Website Blocking from starting, yes, you can do that. Simply open Malwarebytes Anti-Malware and click on the Protection tab then uncheck the box next to Start malicious website blocking when protection module starts. and it shouldn't load when your PC boots.

[Kamakzie]

Where it hits the DPC is in the ndis.sys and makes the CPU run wild.

[exile360]

Where it hits the DPC is in the ndis.sys and makes the CPU run wild.

Right. I guess what I'm wondering is, why does DPC throughput in the NIC (NDIS) cause issues with audio IO throughput? In other words, why is network overhead impacting audio streaming?

[Kamakzie]

Right. I guess what I'm wondering is, why does DPC throughput in the NIC (NDIS) cause issues with audio IO throughput? In other words, why is network overhead impacting audio streaming?

High CPU use I think or at least thats what the Microsoft Community Helper guy said. I was doing traces for him and he confirmed it was a ton better after disabling the Malicious website feature. With that disabled does MBAM protect me at all?

[exile360]

High CPU use I think or at least thats what the Microsoft Community Helper guy said. I was doing traces for him and he confirmed it was a ton better after disabling the Malicious website feature. With that disabled does MBAM protect me at all?

That's strange. I see very little CPU usage from my system, with or without Website Blocking disabled. Is it a matter of the number of threads perhaps or are we talking about actual high CPU usage/spiking? If it's the latter, I don't see it here and haven't had reports of it.

As for whether or not Malwarebytes Anti-Malware provides protection with it disabled, yes it does. Filesystem Protection will block any infections which we detect from executing and quarantine them, thus preventing them from infecting your system. The advantage of Website Blocking is that it goes beyond that, blocking the IP addresses of known malicious websites, which can block unknown threats.

[Kamakzie]

I'm running Latencymon and here is a screenshot of Malwarebytes running with Malicious website blocking disabled. The next pic is with it on, as you can see the system becomes unstable with it enabled. Just thought you would be interested to see.

[AdvancedSetup]

Closing topic.

You said you didn't have time and pretty much wasted time having us analyze logs for you which I have since removed as you didn't want to work on it.

http://forums.malwarebytes.org/index.php?showtopic=123165&pid=653236&st=20entry653236