So the "auto-update of bad virus definitions" can brick a PC, without a scan of any type, assuming vital system files are quarantined? Purely because definitions are updated?
Can brick or will brick? Only if unattended?
I was bricked in the April 2013 unpleasantness. I had left my PC running and left the house for 2 or 3 hours and came back to a black screen as I recall. Not sure what I would have seen on screen had I been at home watching.
Surely this is not limited to Malwarebytes. A faulty virus update to any real time AV could brick Windows.
Yes, it can brick a PC if it detects valid OS system files as malware just with real-time protection (no scan needed). That's what happened in 2013.
If you have Auto quarantine turned off you get 40 seconds to respond to prevent the quarantine.
It's for this reason i changed my auto update to every 4 hours rather than every 1 hour.
I figure i have less chance of getting a bad update if I get updates less often.
It's still a crap-shoot...
It's why I rely on MSE for real-time protection (a lot of other AV programs having bugged me with false positives and performance issues over the years) plus twice-weekly manual scans with the free version of MBAM on which basis it can't force auto-quarantine. I also do a quick forum check to make sure there are no current issues with MBAM before running the updater prior to the scans.
During that 40 seconds, what choices are offered to you on the screen?
What's the decision process as the clock ticks?
I assume that it would be best to accept the quarantine since you'd have no way of knowing in that 40 seconds that it was a false positive that was going to brick the PC. That's possible but a relatively low probability and therefore a better choice.
I've never had this happen, so i can't say for sure.
I found this in the documentation (Notification Window Examples), so i guess this is what you would see.
Source: Malwarebytes Anti-Malware 2.0 Help Documentation
I think it's always preferable when prompted to quarantine a file to do a little research before allowing it, on a different machine if possible. Any quarantine tends to break whatever program/application it relates to, which is a nuisance even without it relating to the operating system which is clearly disastrous, therefore you really want to be sure it isn't a false positive by reference to the forums so long as you can establish that safely. However, 40 seconds doesn't really allow anything more than a mild panic attack at being told that your machine is compromised, and then the timer's up and the file is quarantined anyway. In any event, it would take me the full 40 seconds to read and inwardly digest either of the two notification boxes DavidE displayed!
David:
I note that those pix from Macrium say "detected as a function of real-time protection". I wonder if that necessarily includes downloaded definition updates.
Maybe the ideal config would be to auto-quarantine the "malware detected" classification and not quarantine the "non-malware detected", but that's not available in the controls.
A 40 second window is so short as to be useless. No one can research anything in that time. It may as well be 5 seconds, to better avoid what might happen in that 35 second differential.
Has Mbam released a stable version thats newer than 2.04.1028 or is it still a beta ?
Thank you
A few points of clarification:
1) It is absolutely NOT the case that default update checks occur in "realtime" and "every 5 minutes". The default settings are "Hourly" and randomized +/- 15 minutes in a new installation. If a user sees any other configuration, then those changes were made by a user with access to the computer and the MBAM installation/settings. If they were retained after a version upgrade, then it would be because the previous version was not completely inactivated and was not completely, cleanly removed prior to the upgrade. (On-top upgrades will retain settings.) "Realtime", "Every 5 Minutes" update checks, by default, on millions of home computers, would unnecessarily bring the update servers to their knees. It simply is not configured that way by default.
2) The illustrations posted here are actually for the current version 2.1.4.1018, not for 2.0. But, as shown, there is an option to "Allow Once", if the user chooses to prevent the automatic quarantine one time, in order to research the detection, or to "Exclude Always" (IOW "Allow Always").
3) The reason for the 40-second timeout is explained in great detail by the former MBAM Product Manager here and in many other threads at the Malwarebytes forum.
4) If users are uncomfortable with the real-time protection or automatic updating of MBAM Premium, then opening the dashboard > "My Account" > "Deactivate" will convert the program to the free, manual, on-demand scanner.
Here are links to the User Guide for the current build:
HTML
Thank you,
Quote