Jump to content

Malwarebytes

MBAM not a feasible solution for real time protection


6 replies to this topic

#1
Guest_claudiubotezatu_*

  • Guests
Hi,

I recently did some extensive testing for MBAM in conjunction with other Internet security suites; I did not notice any major conflict between MBAM and other AVs, however there is not significant improvement in overall security running MBAM in real time;

Let’s say that your AV+antispyware has a detection rate 98% (AntiVir for example); MBAM is supposed to cover some exotic malware in 2% left uncovered by your AV; on a detection rate of 90% for MBAM that means 1.8%
.
So you have now two applications running in real time on your computer and taking roughly the same resources from your computer, one covering 98% and the other one 1.8% , which is not a feasible solution. In addition “exotic “ malware means that is very unlikely that you will get them and using minimum common sense is enough to avoid them.

On the other hand MBAM is an exceptional tool for “on demand” scan or to cleanup a system already infected, so for the time being a good AV+Antispyware on real time protection and MBAM “on demand” seems to be the best combination. (of course , this is on top of having an imaging software to restore your HDD to a known clean status, just in case)

MBAM is moving in the right direction (very slow, but is moving); when MBAM will be a full security suite most likely will be a very powerful tool. :D

Claudiu
Toronto, Canada

#2
GT500

    Mostly Cantankerous

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 5,524 posts
  • Gender:Male
  • Location:Fortville, IN
So let me guess, you tested against a repository of old malware you had laying around? Yea, we don't detect that old stuff that no one can get infected with.

Do you want me to scrape together some live links to test with? Some real in-the-wild malware that will rape your computer, and leave your anti-virus's head spinning? Just say the word, and I'll get it for you.

Quote

For we wrestle not against flesh and blood, but against principalities, against powers, and against the worldly governors, the princes of the darkness of this world...

#3
Buddel

    New Member

  • Members
  • Pip
  • 47 posts

View Postclaudiubotezatu, on Jan 8 2009, 01:50 PM, said:

when MBAM will be a full security suite most likely will be a very powerful tool.
Let's hope it will never be a "full security suite". What I need is something that can be used as an addition to my AV/Suite, an additional layer of security, so to speak. I want something that detects malware my AV may miss. I'm glad I have found it: MBAM! :D Don't change a thing, guys and gals. MBAM is perfect. Some minor improvements are always welcome, of course, but it should by no means be turned into an AV or even a Suite.

Kind regards,
Buddel

#4
Raid

    Malware Researcher

  • Experts
  • PipPipPipPipPipPip
  • 1,549 posts
  • Gender:Male
  • Location:United States

View PostBuddel, on Jan 8 2009, 11:04 AM, said:

Let's hope it will never be a "full security suite". What I need is something that can be used as an addition to my AV/Suite, an additional layer of security, so to speak. I want something that detects malware my AV may miss. I'm glad I have found it: MBAM! :D Don't change a thing, guys and gals. MBAM is perfect. Some minor improvements are always welcome, of course, but it should by no means be turned into an AV or even a Suite.

Not to worry. We have no plans to turn MBAM into something else.

#5
Guest_claudiubotezatu_*

  • Guests

View PostGT500, on Jan 8 2009, 04:47 PM, said:

So let me guess, you tested against a repository of old malware you had laying around? Yea, we don't detect that old stuff that no one can get infected with.

Do you want me to scrape together some live links to test with? Some real in-the-wild malware that will rape your computer, and leave your anti-virus's head spinning? Just say the word, and I'll get it for you.

Hi,

I tested MBAM against 458 viruses/spyware/malware and every time my AV blocked them first.

I used also the link provided by you (Thanks!) and I got some fake Antivirus teling me that my computer is infected and I need to install something; I could tell from the begining that is a fake antivirus (different resolution on screen, different partition on HDD, etc) that is the moment the common sens should kick in; I went further more and I clicked 'Install"; installation was blocked by IE7 (second level of common sense) ;I allowed installation and MBAM reacted before my AV.

As you can see you have to really look for trouble on some exotic links to make MBAM to react somehow; MBAM is very good, do not get me wrong, but only for 1-2% of malware not covered by AVs, that's way I said is not feisable .

Is similar with buying collision insurance for your car (very likely to hapen)-------> this is your AV , and on top buying insurance against being hit by a meteorit (very unlikely to hapen) -------->, this is MBAM.

If MBAM would be a full package insurance that would make sense, otherwise is not FEISABLE!!!


Claudiu
Toronto,Canada

#6
TeMerc

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 1,935 posts
  • Gender:Male
  • Location:Phx. AZ. USA
  • Interests:Formula 1 Auto Racing, Computer Security, Entertainment, Sci-Fi, SuperHeroes
Hi claudiubotezatu.

Please take my criticisms as they are intended, to educate and not as demeaning or spiteful.

The fact you elected to use anti-virus suites in any comparison with MBAM shows you really don't understand how our software works.

We don't monitor for those types of threats as a whole. That's because av software looks for different types of threats. Any comparison needs to be between two products that work in the same areas of functionality. Granted, the line between viruses and worms and trojans and spyware is becoming more blurred everyday and that does not help.

Why not instead compare SAS or Spybot or CounterSpy to MBAM? Those are all malware tools and would I'm fairly certain fail in this comparison of yours as MBAM did.

This is the type of testing which really serves no useful purpose other than to point out the obvious. I suggest you go back and compare apples to apples and not to artichokes.

And a 'full insurance package' is simply a pipe dream and will never happen. Actually, it does exist.....you unplug your pc and find another hobby.
Tom Mercado
Consumer Support Engineer

Posted Image

Follow us: Twitter, Become a fan: Facebook

#7
GT500

    Mostly Cantankerous

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 5,524 posts
  • Gender:Male
  • Location:Fortville, IN

TeMerc said:

And a 'full insurance package' is simply a pipe dream and will never happen. Actually, it does exist.....you unplug your pc and find another hobby.

Or run your operating system from a bootable CD so that no new startup items can be created, and no operating system files can be tampered with. A fresh operating system with every reboot.

claudiubotezatu said:

As you can see you have to really look for trouble on some exotic links to make MBAM to react somehow; MBAM is very good, do not get me wrong, but only for 1-2% of malware not covered by AVs, that's way I said is not feisable .

Please note that it is very common to run across the malware that MBAM was designed to detect and remove. The reason you do not is because you browse smarter than most. I know people who come across that stuff all of the time, and MBAM is the only thing stopping it.

The targets are people searching for porn, free/illegal music, and many things Hollywood related. Since those are what the mindless masses are interested in, that is where the really nasty stuff cocentrates it's "social engineering" tactics.

Quote

For we wrestle not against flesh and blood, but against principalities, against powers, and against the worldly governors, the princes of the darkness of this world...





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

Follow Us