16 replies to this topic

[Tigger93]

Are you scanning with the full scan? There is really no need, quick scan is designed to catch 100% of malware.

[exile360]

Tigger93, on Dec 21 2008, 02:18 PM, said:

Are you scanning with the full scan? There is really no need, quick scan is designed to catch 100% of malware.

Yup, +1 to that because just as malware only uses certain file extensions, it also only hides in certain places (when active) and that's where the quick scan is designed to look. It typically takes between 1-5 mins. to do a quick scan which to me is completely reasonable, especially considering how effective it is.

[exile360]

You could potentially just scan the Windows folder and Program Files folder if scanning a slave drive, but doing so instead of scanning a drive that's active means you miss anything that would normally be loaded into memory as well as the registry, which are key points MBAM uses to detect active infections on a system. I can understand slaving a drive to scan if you absolutely can't boot, but otherwise most tools work much better on a system that's booted, especially MBAM.

[IT Expert]

I have done a controlled test. I ran malwarebytes quick mode, and full mode. On a VM box. After It was done doing the quick scan, I then ran the full scan. To my suprise it still found a few more infections the quick scan missed, so to say it finds 100% of malware in quick scan is false....

[Tigger93]

And could you please post those results? I'm willing to bet they were leftovers and nothing to worry about. I still say a full scan is not needed, quick scan is more than enough.

[Tigger93]

Oh sorry, that was meant for IT Expert, not you.

We cannot allow people to edit posts, sorry, people have just abused the feature too much.

[RubbeR DuckY]

Let me shed some light on this,

Quote

I have done a controlled test. I ran malwarebytes quick mode, and full mode. On a VM box. After It was done doing the quick scan, I then ran the full scan. To my suprise it still found a few more infections the quick scan missed, so to say it finds 100% of malware in quick scan is false....

Malware archives do not count! Please posts the results and we will see exactly what was detected.

Quote

P.S. We need to be able to EDIT our posts, where's the 'EDIT' function?

Yes, I apologize, there were some bad eggs that edited their posts after someone already read them and it was just a mess.

Anyway, the quick scan catches 99.9% of malware the full scan catches. The only reason are anomalies such as malware archives and new malware hiding in new locations (which we detect a few hours after it is detected). So basically, it is like Lysol. Lysol is a germ killing spray, but in the commercials they say they kill 99.9% of germs. Reason -- some mutant strains and they get sued. I know, I know, bad analogy, but you get the point .

[exile360]

DasFox, on Dec 22 2008, 04:50 PM, said:

Ok if the Quick Scan does the job, then why is the Full Scan even in the program as an option? See you are confusing users, LOL...

If it's not really need as you are pointing out then please remove it.

I'm a geek and a Tech, but I'm not a coder, so even at my level of experience I am seeing these as two choices. Do one when you don't have the time to get some of the nasties, do the other when you have more time to get the nasties the Quick Scan can't, or didn't pick up. See my point now?

THANKS

Full scan's best use as far as I can tell would be to scan for malware on a slaved hard drive from a PC that won't boot, and also to use the software's built in heuristics to detect malware in the rare case that it isn't in the default location. One thing you might notice though, is that unlike most security scanning tools, the default option is quick scan and not full scan. The first thing most AV/AS softwares want a user to do is update and perform a full scan to make sure the system is clean, primarily because they work based on file signatures only instead of the kinds of detection algorithms that MBAM uses, which is why MBAM is so efficient at scanning and why the database files are so small.

[IT Expert]

Tigger93, on Dec 21 2008, 04:00 PM, said:

Oh sorry, that was meant for IT Expert, not you.

We cannot allow people to edit posts, sorry, people have just abused the feature too much.

I did not save the logs, but I will next time. I have long since formated over my infection box. I will keep an eye on it, I typically always scan quick first then scan full just to make sure everythings gone.

[nosirrah]

The full scan cant catch any more malware that has the ability to enter memory because that portion of the scan is identical for both versions . Both versions use the same registry scanner , same heuristic checks , same load point checks and same memory checks . The only thing that full scan can do better is to catch a few extra traces .

I cant go into all the details but there are at least 5 ways we can hit files not inside of the usual quick scan locations so the smaller number of places we look has nothing to do with where we can hit a file , it only has to do with reducing the amount of time wasted looking at files that have no chance of being malware .

Someone asked why have a full scan option then , that is simple , people (even knowing the full specs) would rather have the ability to catch these occasional traces then to have that option taken away from them .


This next statement I stand behind 100% as the lead researcher for Malwarebytes Corp .

I have not even one single time needed to run a full scan with MBAM while researching new malware to completely kill its ability to enter memory on reboot .