Tips on Using Malwarebytes “Anti-Malware” Program

Malwarebytes Anti-Malware

The Malwarebytes program known as “Anti-Malware” or “MBAM” for short, does a wonderful job of removing malware. It comes in a free, and “Pro” version. The “Pro” version offers real-time protection – actively working in the background examining files as you open them and checking them for any known malware,  and it offers an IP Blocking feature called “IP Protection”, which can prevent you from accessing a known malicious website.  The free version offers neither IP Blocking nor real-time protection. It’s not a total solution to malware, but no single product is. It is a tool and should be a part of everyone’s malware toolbox. As good as it is, you will need to dig around to find out how to use it effectively. The built in help is very skimpy. You can visit Malwarebytes.org and search the message forums for more help.

Better in Normal Mode

I’ve found a couple of things which will help get the most out of “Anti-Malware”. First of all, while it will install and run in Safe Mode, it works BETTER in Normal Mode. Don’t ask me why – that’s what the guys at Malwarebytes said and who should know better? There may be times when it’s preferable to run it in Safe Mode, but I’d advise you to follow that up by scanning in Normal Mode as well.

Quick Scan Versus Full Scan

Most times you can select the “Quick Scan” option rather than choose “Full Scan”.  The overwhelming majority of infections target a subset of files on your computer, usually operating system files or registry keys.  Quick Scan  is generally sufficient. If you’ve determined that you are infected with a virus which attaches itself to every single file on your computer, then you must choose “Full Scan”. If you’re unsure, select “Full Scan” and go take an extended  break.

When Anti-Malware Won’t Run

Anti-Malware has gotten so good at removing malware that some newer malware programs have been designed to look for it specifically and prevent it from running. One way around this is to rename the Anti-Malware installation program – mbam-setup.exe – to something else. I usually change it to mbm.exe but anything will likely work. If it still fails to load, reboot and go into Safe Mode and try again.

Beware of IP Blocking Feature

If you have the “Pro” version and have the “IP Protection” feature  enabled, “Anti-Malware” examines the IP address of the site you are trying to reach and compares it to a list of “bad” IP addresses. If there is a match, the browser is prevented from loading that website. This feature sounds like a great idea until you understand the idea of “shared IP addresses”.

Because the pool of available IP addresses is growing small, Internet Service Providers (ISP’s) are employing a method that allows multiple websites to share one IP address. Through some sort of DNS gymnastics, you are sent to your desired final destination, despite the fact that other websites may have the same IP address as the website you are visiting.  And that is where the problem with IP blocking lies.

When one of your IP sharing neighbors is deemed “bad”, perhaps because it’s hosting malware, it’s IP address is added to a blacklist. When “Anti-Malware” blocks that IP address, it blocks every other website that shares that address, even though they may be  perfectly safe.  How many websites might that be?  That depends on the ISP,  but I suppose it could be 100 or more. Anti-Malware does have an “Ignore List” in which you can exclude something which is being blocked, but again, it only works with IP addresses, not individual domain names.

You can disable IP Protection at any time by right clicking on the Anti-Malware icon located in the Notification area, at the lower right corner of the Windows Desktop screen and make sure IP Protection is not checked. So, the take away here is that just because Anti-Malware is blocking you from getting to a website, it does not necessarily mean that the website is malicious. You may have to do some investigating on your own to determine whether it is really safe or not.

I suppose if there were a better way to block a bad site, Anti-Malware would use it. Apparently it’s just something we have to deal with. I personally disagree with blocking by IP address. It’s like using a meat cleaver when you need a scalpel.