Does Malwarebytes remove trojans and viruses too?

[luckybug]

What exactly does malwarebytes remove?

spyware?

adware?

trojans?

viruses?

[Maniac]

MalwareBytes' Anti-Malware remove viruses, worms, trojans, rootkits, dialers, spyware, rogue applications and malware.

[exile360]

Yes, although Malwarebytes' does remove some viruses, it is no replacement for antivirus software, it's designed to catch what most AV's miss. For more info please see this thread: http://www.malwarebytes.org/forums/index.php?showtopic=8068

[coppertrail]

Yes, although Malwarebytes' does remove some viruses, it is no replacement for antivirus software, it's designed to catch what most AV's miss. For more info please see this thread: http://www.malwarebytes.org/forums/index.php?showtopic=8068

I run Malwarebytes and Avast! Antivirus on my PCs.

[GROM73]

Can I ask for a little Clarity here:  The responses are a little contradictory . . .

 

I have purchased the premium edition of malwarebytes for two computers.  I have been informed that there is no point in running two different anti-virus.  I am also told that Malwarebytes catches everything.

 

One of the replies here says it catches everything

Another says it catches what other AV misses.  If this is the case surely it must mean that it catches everything INCLUDING anything your other AV fails to pick up!!

 

Who are the experts here and who has the right answer?

Edited October 8, 2016 by shadowwar

[David H. Lipman]

MBAM is not an anti virus application and does not replace an an anti virus application.  MBAM is an adjunct, complimentary, anti malware application.
 
In its role as a adjunct, complimentary, anti malware application it has limitations in aspects that the anti virus application performs in its role.
 
MBAM does not target script files. That means MBAM will not target; JS, JSE, PY, .HTML, HTA, VBS, VBE, .CLASS, SWF, SQL, BAT, CMD, PDF, PHP, WSF, etc.
It also does not target document files such as; PDF, DOC, DOCx, DOCm, XLS, XLSx, PPT, PPS, ODF, RTF, etc.
It also does not target media files;  MP3, WMV, JPG, GIF, etc.

Until MBAM, v1.75, MBAM could not access files in archives but with v1.75 came that ability so it can unarchive a Java Jar (which is a PKZip file) but it won't target the .CLASS files within. Same goes with CHM files (which is a PKZip file) but it doesn't target the HTML files within. MBAM v1.75 specifically will deal with; ZIP, RAR, 7z, CAB and MSI for archives. And self-Extracting; ZIP, 7z, RAR and NSIS executables (aka; SFX files).

MBAM specifically targets binaries that start with the first two characters being; MZ
They can be; EXE, CPL, SYS, DLL, SCR and OCX. Any of these files types can be renamed to be anything such as;  TXT, JPG, CMD and BAT and they will still be targeted just as long as the binary starts with 'MZ'.
 

MBAM targets mainly non-viral malware.  The exception being a virus dropper ( a malware file that drops a virus and starts a virus infection but is not infected with the virus ) and worms ( such as Internet worms and AutoRun worms ).
 
MBAM is incapable of removing malicious code that has been prepended, appended or cavity injected into a legitimate file.  That means if a file infecting virus infects a legitimate file MBAM will be unable to remove the malicious code.  An anti virus application should be able to remove malicious code from an infected file and hopefully bring it back to its preinfected state.  Which may or may not return the file to its original, non infected, checksum value.
 
A file infecting virus will prepend, append or cavity inject malicious code into a legitimate file.  Once infected, that infected file can further the infection by infecting other legitimate files.
 
On the other hand there are trojans that will prepend, append or cavity inject malicious code into a legitimate file.   However that file can not infect other files.  The infection stops with that targeted file.  These files are either deemed to be "trojanized" or "patched".  Since MBAM can not remove the added malicious code, at best MBAM will try to replace the trojanized file with a legitimate, unaltered, file.
 
Where a traditional anti virus application is weak, MBAM is strong.  Today's malware is much more complex than 10 years ago.  When we saw the Melissa virus ( I-Worm via SMTP  ), Lovsan/Blaster worm (  I-Worm via RPC/RPCSS @ TCP port 135 ) etc, they were distributed for the effect, damage and bragging rights.  Today's malware is more sophisticated in that it is "all about the money".  Malicious actors use malware to profit from.  Either by stealing, distribution affiliation revenue, data exfiltration, personal identification impersonation, etc.  To effect that the malicious actors don't want the victim to know that their system was compromised or they are so blatant about it by generating advertisements,  Yesterday's malware was simple and less obtrusive.  Today's malware is very intrusive and makes numerous modifications to the Operating System.  Those numerous modifications to the Operating System is where the traditional anti virus application does poorly and where MBAM specializes.
 
MBAM is not a historical anti malware solution.  That means it will not target old malware.  It's intent is to target 0-Day malware.  Malware that is infecting computers Today with malware found in-the-wild, Today.  That means that something like the BugBear which infected years ago will not be targeted by MBAM.  Malwarebytes will actually cull their signature database for malware that is no longer seen in-the-wild Today.   This is why Malwarebytes requests samples that are submitted for detection consideration be no older than 3 months old.

 

[GROM73]

Complicated Dave but reading between the files it is best to get anti virus.  On my laptop I have both Malwarebytes and AVG but on this desktop just Malwarebytes.  I will get AVG ASAP

[record]

On ‎10‎/‎8‎/‎2016 at 2:22 PM, David H. Lipman said:

MBAM is not a historical anti malware solution.  That means it will not target old malware.  It's intent is to target 0-Day malware.  Malware that is infecting computers Today with malware found in-the-wild, Today.  That means that something like the BugBear which infected years ago will not be targeted by MBAM.  Malwarebytes will actually cull their signature database for malware that is no longer seen in-the-wild Today.   This is why Malwarebytes requests samples that are submitted for detection consideration be no older than 3 months old.

 

Hi David,

Tested today SpyCar Suite  (8 years old) ; detected " MBAM has blocked a threat"!!!!   So, what is the story about 0_day malware???

[David H. Lipman]

I do not understand the question.

 

[record]

8 minutes ago, David H. Lipman said:

I do not understand the question.

 

The question is very clear: on one hand there is a statement that "MBAM is not a historical anti malware solution" and on the other hand MBAM detects a 8 year old "non-malware" as a "threat"

This "pick and mix" approach is very confusing to the end user: nobody knows anymore what MBAM detects and what not.

On the other hand is very convenient to justify non detection of an item.....

[screen317]

SpyCar is a literal dummy file for testing antimalware engines. Notice the detection name is "Legitimate." Meaning it doesn't detect it as a threat, as you suggested in your post. I'm locking this ancient thread as it has served its purpose.

Edited October 9, 2016 by screen317