Safe Mode Scanning - Less Effective ?

[ksiemb]

On another forum, I stated that MBAM would be less effective scanning in Safe Mode (as opposed to Normal Mode) due to the fact that most, but not all infections would not be active, and that MBAM works more effectively when the intruder is active. The response to my post more or less said I didn't know what I was talking about.

Any Comments ?

[Firefox]

Yes it is more effective when running in Normal mode. While in safe mode, not all load points from the registry are loaded and not all processes get loaded. If I ever have to scan in safe mode, and find infections, I then reboot and go into normal mode, and more infections are always found.

[exile360]

Our DDA (Direct Disk Access) driver doesn't load in Safe Mode either, that means MBAM can't check for hidden stuff like rootkits.

[shadowwar]

The only time safe mode should be used is if mbam wont run in normal mode because of an infection blocking.

A full scan should be run in safe mode if you have to use safe mode.

Because of the infections not being in memory Quick scan would be quite hampered in safe mode.

A scan will also be a decent amount slower in safe mode becuase of the disk tech mbam and windows allows in safe mode.

[ksiemb]

Thank You Gentlemen, Thank You all !

[aford10]

Hey guys,

I'm one of the moderators on Tom's Hardware, and I'm one of the advocates for using Malwarebytes in safe mode with networking. I've actually put together a malware guide, and stickied it at the top of a few of our sections.

I've cleaned a couple hundred of client computers, and used the method in my guide. When paired up with SuperAntiSpyware, and Combofix in safe mode with networking, it has always proven to be very effective. Malwarebytes has been very ineffective at detecting and removing threats in normal mode, if it will even run at all. I did a test on my most recent client, and posted some screenshots.

I stated my reasons for my method in the thread here. And you can see the method I use in the guide in my signature. The thread was started by ksiemb.

http://www.tomshardware.com/forum/242596-49-malwarebytes-scan-safe-mode

[nosirrah]

The majority of high powered load points are active from safemode and we have additional low level direct disk access in regular mode.

As one of the architects of MBAM and someone that has installed many 10s of thousands of infections I can say that in far less than 1% of occasions does Malwarebytes need to be run from safemode.

Safemode scanning as a necessity went extinct about a decade ago.

[shadowwar]

Aford,

Do you have the full superantispyware log?

Also were the scanner settings double checked in Mbam?

[1PW]

@aford10:

I read your post in the other forum and not letting MBAM scan with its full capabilities brings serious questions about the accuracy and perhaps the integrity of your intentions.

An experienced & reasonable person who saw a MBAM normal mode, full scan, of a C: partition (particularly if it's the %SystemDrive%) finish in 5 seconds and only see 175 objects would immediately know that something was seriously flawed and pursue it.

That alone discredits your post. You would do well to examine your methodology, correct your errors, and append your post with corrected data if you are interested. Until then your findings are invalid.

[aford10]

I ran both MBAM scans with the default settings.

Looking back at the logs, I just noticed that the normal mode scan didn't even pick up the F and G drive. When more computers come my way, I'll get more logs.

I think you guys are misunderstanding me. I'm not trying to bash MBAM at all. I think it's a very nice piece of software. I proudly recommend it to those asking for help. I'm just trying to show why I recommend running it (as well as other scans) in safe mode. Honestly guys, I have no agenda.

@1PW

I am both, experience, and reasonable. Thanks for asking. Though, the hostility is neither necessary, or warranted.

[shadowwar]

No problem Aford i know you arent bashing. Just would like to know a cause of this as i posted on toms.