Latest Version of Malwarebytes

DavidE said:

Lady Fitzgerald said:

Thanks for the link. Being the confirmed coward I am, I'll still wait a bit before updating, just in case.

You're welcome and i'm a coward too
You can read more of my thoughts about this update at Ten Forums here:
Latest Version of Malwarebytes Anti-Malware - Page 3 - Windows 10 Forums

I always make an image before updating, making changes, installing new programs, etc. as well as once a week. I never could get System Restore to work correctly in Win 7 so I shut it off and depend on imaging. Right now, I'm waiting for a TV show to finish recording so I can make an image before seeing what happens if I move C: from my User folder to my main data drive.

MoxieMomma said:

Announcement:
Malwarebytes Anti-Malware Update to 2.1.7

I received an update notification via the internal updater yesterday and I went ahead. 2.1.7 appears to work just fine. I can confirm that the rootkit scanning option is no longer included during a Hyper Scan; any idea why it was removed? Now Threat Scan must selected for rootkit scanning (assuming of course that feature is enabled in advanced settings). The update is much appreciated

2.1.7 is not being offered yet on my other PC. It would be nice if an installer was made available for manual update.

Hi, Victek:

Announcement:
Malwarebytes Anti-Malware Update to 2.1.7

Victek said:

I received an update notification via the internal updater yesterday and I went ahead. 2.1.7 appears to work just fine. I can confirm that the rootkit scanning option is no longer included during a Hyper Scan; any idea why it was removed? Now Threat Scan must selected for rootkit scanning (assuming of course that feature is enabled in advanced settings). The update is much appreciated

AFAIK, Rootkit scanning never was a feature of Hyper scan.
By definition, a "Hyper" scan, which is the "fastest" scan type, does not include the deep, anti-rootkit scanning -- if it did, it would not be a "Hyper" scan.
I don't think that behavior has changed with version 2.1.7.
Having said that, the Hyper scan is NOT the recommended scan type.
If anything is detected on a Hyper scan, a Threat scan should be performed for full malware removal.
The Threat scan is the recommended scan type for regular use.
The types of scans are explained HERE

2.1.7 is not being offered yet on my other PC. It would be nice if an installer was made available for manual update.

This release is limited to users updating from Malwarebytes Anti-Malware 2.1.4 or greater to start, so we don’t have a direct download link to share right now. I will update this topic with a way to access the full download once we’re ready to do so. Malwarebytes Anti-Malware Update to 2.1.7

Release of 2.1.7 via the auto-updater is being "throttled" (released to a small percentage of users at one time). It's not unexpected that computers in the same household may or may not yet have been offered it, yet.
Your other systems will eventually be offered the new build via the auto-updater, and a standalone installer for 2.1.7 will be made available for download at some point. It is not yet available at this time.

Thanks for your patience and understanding,

MoxieMomma said:

AFAIK, Rootkit scanning never was a feature of Hyper scan.
By definition, a "Hyper" scan, which is the "fastest" scan type, does not include the deep, anti-rootkit scanning -- if it did, it would not be a "Hyper" scan.
I don't think that behavior has changed with version 2.1.7.
Having said that, the Hyper scan is NOT the recommended scan type.
If anything is detected on a Hyper scan, a Threat scan should be performed for full malware removal.
The Threat scan is the recommended scan type for regular use.
The types of scans are explained HERE

Sorry but that is incorrect. See the screenshot of MBAM 2.1.6.1022 doing a Hyper Scan with rootkit scanning enabled. Also note that the rootkit portion of the scan only accounts for a few hundred objects and in this case took about a minute. The complete Hyper Scan looked at over 353,000 objects and took over eight minutes; the rootkit phase did not significantly increase scanning time. It was useful having this option in a Hyper Scan in some situations and so some functionality is lost in 2.1.7. I am interested to know why it was removed. And thank you I'm aware that a followup Threat Scan is recommended if anything is discovered by the Hyper Scan.

Hi:

Hmm, that's interesting.
I just ran a *manual* Hyper scan on my own system (which has ARK enabled in the D&P settings) under version 2.1.6.
The scanner window does indeed show the scan progress as scanning for rootkits, and the resultant scan log does show "rootkits enabled". So I stand corrected, although I am surprised, as I did not know that a Hyper scan included ARK scanning.

HOWEVER, a couple of thoughts:

• There are 2 different places to enable ARK scanning -- both in the D&P settings in the main GUI, AND (for *scheduled* scans), in the Advanced settings of the task scheduler. (I don't think there is an option to change settings for a *manual* Hyper scan, as that is pre-configured.)
• I'm not sure if what shows up in the scan log reflects the D&P ARK setting or the scheduled scan task ARK setting, or both.
• The 2.1.7 announcement does indeed say that ARK scanning was removed from the Hyper scan:

Issues Fixed:
<snip>
Disabled option to specify rootkit scanning as part of a Hyper scan

I have queried the MBAM Product Team over at the MBAM forum for clarification.
This appears to be an intentional coding change to fix a "bug" in earlier versions, rather than removal of a feature.

Until they reply, can you please tell us, regarding your 2.1.7 installation:

1. If you look in the GUI for 2.1.7 (Settings > D&P > Detection Options), is "Scan for Rootkits" enabled?
2. Was the Hyper scan you ran that you say lacked the ARK feature a *manual* Hyper scan or a *scheduled* Hyper scan?
3. If it was a *scheduled* Hyper scan, if you look in the Scheduler (Settings > Automated Scheduling > Hyper Scan > Edit > Advanced > Schedule Options), is "Scan for rootkits" enabled?
4. Can you please export to a *.txt file the Hyper Scan log you referenced, and attach it to your next reply here?

I will report back when I get clarification. Please let me know if you need screen shots of anything I mentioned. I am not yet running 2.1.7 on my rigs, but I don't expect the GUI looks very different from 2.1.6.


Sorry for the confusion and thanks for your patience,

Hi, Victek:

OK, the MBAM product team (Senior Technical Product Manager bdubrow) has clarified the situation.:)

To summarize:

1. You were, of course, correct that ARK scanning has been removed from 2.1.7 Hyper scans.

Unfortunately that setting was never properly removed or disabled in Hyper Scans so it was possible to incorrectly configure Hyper Scans to include a rootkit scan up until 2.1.7. We corrected it because technically, if a rootkit was ever discovered then a full file system scan would also be necessary to ensure we can detect and clean the rootkit properly. This file system scan is NOT a default part of Hyper Scan. And while we could add an option for a full file system scan to Hyper Scan, that would add even more time to the total scan time, thus further defeating the entire purpose of Hyper.

2. That feature *was* present in earlier builds of 2.x, but it should not have been there in the first place.

But it absolutely should NOT have been.

Honestly, users could have found themselves in a bad situation because there are some cases where if we detected a rootkit during a Hyper scan and it was NOT followed up appropriately with a full file system scan, then that could have had caused severe problems on the system. so while it may have seemed like the rootkit scan was running just fine, and in the majority of cases it was, this has the potential for undesirable results.

So really, should never been allowed from the beginning.

3. As mentioned earlier:

If someone wants to do a rootkit scan, a standard Threat Scan with that option enabled is still the best bet.

4. And finally, it was the earlier builds of 2.x (pre-2.1.7) that were broken, so 2.1.7 fixes that problem.

And while it may seem like we should be able to "just leave it in there--it works fine," there are good reasons why it should not be included.

Bottom line:

ARK scanning is still included in the Threat (and Custom) scan, but has been removed from the Hyper scan, where it did not belong.
Threat scan remains the recommended and default scheduled or manual scan type for MBAM 2.x.

There will be more information (including an updated User Guide) and a standalone installer for the next build available soon.

Thanks,

MoxieMomma said:

Hi, Victek:

OK, the MBAM product team (Senior Technical Product Manager bdubrow) has clarified the situation.:)

1. You were, of course, correct that ARK scanning has been removed from 2.1.7 Hyper scans.

Honestly, users could have found themselves in a bad situation because there are some cases where if we detected a rootkit during a Hyper scan and it was NOT followed up appropriately with a full file system scan, then that could have had caused severe problems on the system. so while it may have seemed like the rootkit scan was running just fine, and in the majority of cases it was, this has the potential for undesirable results.

So really, should never been allowed from the beginning.

Thanks for checking with the MalwareBytes team and clarifying the issue. It makes sense given the seriousness of detecting/removing rootkits that they would not be part of a Hyper Scan. I'll pass this along in the MBAM thread at Wilders :)

MalwareBytes AntiMalware Update to 2.1.8

https://forums.malwarebytes.org/inde...update-to-218/

Thank you. First post updated. :)