Latest Version of Malwarebytes

[Slartybart]

If you're having trouble with Mbam v2 (other than it's SLOW)

https://forums.malwarebytes.org/index.php?showtopic=146024
Note: I left out the Farbar log request - but if they need it, provide it.

Please create an mbam-check log:

Download mbam-check.exe from here and save it to your desktop

• Double-click on mbam-check.exe to run it, it should then open a log file
• Please do not copy and paste the entire contents of the log into your next post, instead please attach the log CheckResults.txt file which should now be located on your desktop to your next post.
• Click on the More Reply Options button, then click on the Browse button to locate your log then click the Attach button to attach the log to your post

These logs will help us to see what's going on with your computer so that we can then offer further advice based on what's found in your logs.

You would create a post on the Malwarebytes forum, not here on Sevenforums.

 

[AdvancedSetup]

For general help I'll be happy to help but for issues beyond the basics then yes posting for help on our support site would certainly be faster and easier for users. Posting in a wide open forum with no controls becomes chaotic very quickly as misinformation is posted over and over. We can provide you 1 on 1 support on our site or our Consumer Help Desk.

 

[AdvancedSetup]

Please note that we have actually just released a public beta of the build that is newer than the one I was testing with.

I would highly recommend that everyone please install this one and test it out and provide feedback on our site if possible. It should scan faster and fix a few other reported issues.

https://forums.malwarebytes.org/inde...owtopic=147144

Thanks everyone

 

[Brink]

Thank you AdvancedSetup. First post updated.

 

[Slartybart]

Very rough notes on my "tests" with 2.0.2

Previous version (2.0.1) presented a no scan + fix button afterit was installed
has that been removed? or is this becasue 2.0.2 recognized the last 2.0.1 scan

2.0.1 Lands on Dashboard with an orange Scan has never been run
2.0.1 Fix button

2.0.2 Lands on Dashboard with green Malwarebytes Antimalware (Free)
2.0.2 Scan Now Button (instead of Fix now?)​

Check for update window flashes - then scan window
If connected, window stays visible for a few seconds
If not connected, just a flash (only knew the flash was from check for updates because I saw the window when connected)

(scan times) Fresh install over 2.0.1, no settings changed from what installed set

(12:08) scan time improved (v 2.0.1 = 29 mins) same options (Heur, Root, Arch), same machine
Note: the scan has not been performed warning was not displayed

(11:06) Scanned without Rootkits - 11 mins (most time spent in Heuristics)

(09:56) Scanned without Rootkits, without Heuristics
-- Still reports Heuristics Analysis: Working in the left pane of the Scan main window
-- About 50% of the scan time was Hueristic Analysis

(08:42) Scanned without Rootkits, without Heuristics, without Archives
-- I'm a little confused by the options. Mbam scans for active threats - why the archive option? Custom scan would be the only reason I can think of.

Recap 12 - 11 - 9 - 8 mins. I would expect better

(07:44) Scan with no options checked - changed PUP & PUM to ignore - 7:44
preScan: @0:00 -> 0 mins 11 secs
MemObj: @0:24 -> 0 mins 13 secs
StartUp: @0:42 -> 0 mins 28 secs
FS: @4:03 -> 3 mins 35 secs
Heur: @7:44 -> 4 mins 41 secs

(07:08) Scan with no options checked - changed PUP & PUM to warn

As a resource comparison I ran an avast quick scan and found that Mbam is chewing up 2-3 times the memory. I grabbed a screen shot of ResfMon



I was about to exit when I went to Dashboard and saw that there was a database alert and Scan progress = Not running
Fair enough - I checked for updates and .06 replaced .05
I'd rather see a last scan completed on date instead of Not Running
-> the data is displayed under the scan now button.

This will be a common complaint - there's too much marketing.
Menu bar: Activate
Menu bar: Buy Premium
Dashboard License: Buy Premium
Dashboard License: Start Free Trial

A lot of real estate is used on your screens that don't help the end user. Why have a scheduler option on the free version (under Scan Now on Dashboard) - just ticks me off when I click only to find I can't use it.

Even the scan adverts bug me - but as long as the product works and works faster, I guess I'll take what the development team delivers.

Bill

---

As installed scan - no settings changed

Scan Date: 04/21/2014
Scan Time: 14:08:45
Logfile: mbam-log-2014-21-14 [2.0.2 beta].txt
Administrator: Yes
Version: 2.00.2.1007
Malware Database: v2014.04.21.05
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Slartybart
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 246151
Time Elapsed: 12 min, 8 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0 (No malicious items detected)
Modules: 0 (No malicious items detected)
Registry Keys: 0 (No malicious items detected)
Registry Values: 0 (No malicious items detected)
Registry Data: 0 (No malicious items detected)
Folders: 0 (No malicious items detected)
Files: 0 (No malicious items detected)
Physical Sectors: 0 (No malicious items detected)
(end)

---

No root option log

Scan Date: 04/21/2014
Scan Time: 14:31:21
Logfile: mbam-log-2014-04-21 [2.0.2 beta NoRoot].txt
Administrator: Yes
Version: 2.00.2.1007
Malware Database: v2014.04.21.05
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Slartybart
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 245509
Time Elapsed: 11 min, 6 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0 (No malicious items detected)
Modules: 0 (No malicious items detected)
Registry Keys: 0 (No malicious items detected)
Registry Values: 0 (No malicious items detected)
Registry Data: 0 (No malicious items detected)
Folders: 0 (No malicious items detected)
Files: 0 (No malicious items detected)
Physical Sectors: 0 (No malicious items detected)
(end)

---

No Root, no Heur scan log

Scan Date: 04/21/2014
Scan Time: 14:44:18
Logfile: mbam-log-2014-04-21 [2.0.2 beta NoRoot, NoHeur].txt
Administrator: Yes
Version: 2.00.2.1007
Malware Database: v2014.04.21.05
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Slartybart
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 245342
Time Elapsed: 9 min, 56 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Disabled
PUP: Enabled
PUM: Enabled
Processes: 0 (No malicious items detected)
Modules: 0 (No malicious items detected)
Registry Keys: 0 (No malicious items detected)
Registry Values: 0 (No malicious items detected)
Registry Data: 0 (No malicious items detected)
Folders: 0 (No malicious items detected)
Files: 0 (No malicious items detected)
Physical Sectors: 0 (No malicious items detected)
(end)

conclusion - Malwarebytes is making headway the next release will hoepfully go through a short beta before being finalized and released. I've offered a few hours to test the next release, but can't commit more time to this release.

Bill

 

[jonnyhillow]

I am finding the scan times even with everything enabled including the rootkit very fast . Apparently I was wrong

 

[ThrashZone]

Objects scanned is not all that much,
Besides you used the Threat scan,
It's always been pretty quick,
Mine was only at 10 minutes can't remember the objects count 300k ?
Even the Hyper was pretty quick,
The issues were mostly with the initial custom full scan with rootkit enabled,
Cheers.

 

[AdvancedSetup]

The issues were mostly with the initial custom full scan with rootkit enabled,
Cheers.

Yes it was and there are now several users that have posted that that time has decreased by 50% or more and in some cases has gone from several hours to less than an hour.

Please do a FULL SYSTEM scan with your antivirus and post back the log. I'm sure it too has to take a while. As I said in my testing with millions of files it to about 48 hours for both Kaspersky and Symantec.

 

[Britton30]

Here's the results of my last NIS 2013 scan. The log is in some .mcf format.

View attachment Scan Results.zip

 

[AdvancedSetup]

I have NIS on one of my machines here at home that is running an i7 processor and fast sub-system. I'll see if I can do a full scan as well tonight. Unless they're using some type of hash table or similar fingerprint technology there is no way they can scan almost a million files that quickly. It takes almost that much time to simply read file details about those files.

 

[Britton30]

Well, there are my results in living color mate.
NIS does use Trust Control, it doesn't re-scan a file found to be OK from a previous scan. 55% of mine are trusted. If there is any type of change to a file it will trigger a new scan.

 

[andrew129260]

Well, there are my results in living color mate.
NIS does use Trust Control, it doesn't re-scan a file found to be OK from a previous scan. 55% of mine are trusted. If there is any type of change to a file it will trigger a new scan.

I don't know about you, but that sounds like a dangerous way for an antivirus to work. Just because a file is trustworthy one day does not mean it stays that way. No wonder they no longer participate in av comparatives and av test.

 

[A Guy]

If it is based on the hash it should be OK. Not sure if a hash can be faked? Besides, if the file is changed, it is scanned again. A Guy

 

[Britton30]

Well, there are my results in living color mate.
NIS does use Trust Control, it doesn't re-scan a file found to be OK from a previous scan. 55% of mine are trusted. If there is any type of change to a file it will trigger a new scan.

I don't know about you, but that sounds like a dangerous way for an antivirus to work. Just because a file is trustworthy one day does not mean it stays that way. No wonder they no longer participate in av comparatives and av test.

Note this.

 

[andrew129260]

I did see that, but there are ways for a file to be changed and hashes to be faked and not detected. The worst of malware does preciously that. I know most AV's do this now, its just something I am not comfortable with the new practice of this. I know why it was done, to speed us scan time and grow a database of safe files. But it's risky to me. But unfortunately I cannot change the way anti-malware software works.

 

[Slartybart]

Yes it was and there are now several users that have posted that that time has decreased by 50% or more and in some cases has gone from several hours to less than an hour.

I have not had any major issues with my testing Mbam 2, but it would be negligent for me not to state observed scan times (my pet peeve). These are not exact, but hopefully give you an idea of what one end user sees.

2.0.0.x: 9-11 mins Threat scan - no options - all options
2.0.1.x: 22-29 mins (same test set)
2.0.2.x: 8-12 mins (added initial scna without changing settings)

This tells me that there really wasn't any gain - the scan times were out of whack in 2.0.1.x and the next version 2.0.2.x fixed what 2.0.1.x 'broke'. It happens, but v1 was about 5 mins.

I understand that v2 does more, so if 10 minutes for 250,000 files is what v2 ends up running - that's ok
30 mins was not OK. I'm sure Malwarebytes wants better times too.

There were a few very minor glitches (update screen popped up between inistall and initial scan - most likely an artifact of the change to automatically update instead of depending on the end user to update. A momentary screen flicker isn't a deal breaker. It was introduced between 2.0.1 and 2.0.2 though.

I'm glad they toned down the screaming screens, I asked nicely if they could tone down and consolidate the marketing.

I plan on joining their forum and participating directly if there is a short 2.0.3.x beta. It doesn't help posting here.

I have a full plate the next two weeks (daughter#3 getting married, daughter# 2 / son-in-law arriving from the Philppines, daughter# 4 buying a house). I think I can sneak in a few hours though, to run four scans and document/analyse the findings.

Here are avast times on my machine to use as comparison
- the quick scan uses cached results, the full scan does not use the cache, it builds the cache

 

[AdvancedSetup]

@SlartyBart

For many users there is little change in times as you noted, but for others there is a huge change. There were some hardware and software issues involved that "some" users have that caused very slow scans. This was hopefully corrected for at least most of those users. Myself I have similar fast scan times in all versions with my hardware/software mix.

The Full Scan time by Avast is more in range with what I would expect. Wife is on the computer I was going to test NIS on but seeing that it is now reported that they're fingerprinting that makes sense as you can read the hash much faster than you can read properties and analyze a file. I'll still try to do one myself but guessing my times will be pretty quick too. My 48 hour scans were from last year over a UNC path to a mapped server drive that had millions of files.

 

[Britton30]

I did see that, but there are ways for a file to be changed and hashes to be faked and not detected. The worst of malware does preciously that. I know most AV's do this now, its just something I am not comfortable with the new practice of this. I know why it was done, to speed us scan time and grow a database of safe files. But it's risky to me. But unfortunately I cannot change the way anti-malware software works.

Howe may I change/fake a has so it matches a previous one? As far as I know for a given file MD5 uses one algorithm to calculate the hash, if the file is changed in any way so does the has.

Say you have 1000s of images (I do) they don't need to be scanned more than once. Videos are in the same boat along with audio files. Those 3 classes of files can comprise 100s of GB on users' systems.

 

[UsernameIssues]

I did see that, but there are ways for a file to be changed and hashes to be faked and not detected. The worst of malware does preciously that. I know most AV's do this now, its just something I am not comfortable with the new practice of this. I know why it was done, to speed us scan time and grow a database of safe files. But it's risky to me. But unfortunately I cannot change the way anti-malware software works.

Howe may I change/fake a has so it matches a previous one? As far as I know for a given file MD5 uses one algorithm to calculate the hash, if the file is changed in any way so does the has.

Say you have 1000s of images (I do) they don't need to be scanned more than once. Videos are in the same boat along with audio files. Those 3 classes of files can comprise 100s of GB on users' systems.

MD5 - Wikipedia, the free encyclopedia

In 2004 it was shown that MD5 is not collision resistant.[5] As such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property for digital security.

Peter Selinger: MD5 Collision Demo

Here, you can download the software that I used to create MD5-colliding executable files.

And then there is a line of malware that intercepts & changes the hash value being reported to programs that ask for them. No need to have the file be special, just lie about its hash.

 

[Britton30]

Thanks UNI, I did not know that.