[Question About Email Protection]

8 hours ago, David H. Lipman said:

Like I wrote, Telos is a regular member and can not provide anti malware advice.  This Forum has set certain criteria to protect regular members from bad advice. 

As an example; reference:  Groups authorized to help with malware removal logs

MBAM's scanner only targets PE files.  That is MBAM specifically targets binaries that start with the first two characters being; MZ
They can be; EXE, CPL, SYS, DLL, SCR and OCX. Any of these files types can be renamed to be anything such as;  TXT, JPG, CMD and BAT and they will still be targeted just as long as the binary starts with 'MZ'.

MBAM does not target other file types so there is little overlap.  The files that come via email are most often not PE files.  They are Scripted Malware, Documents and media files.   When a malicious email is sent with a PE file attachments, the malicious actors hide the maliciousness of the file.  They may exploit Microsoft's repeated stupidity in setting the OS to "Hide extension of known file types" so when they do send PE files they often use double extensions such as MyDocument.PDF.exe.  The recipient sees MyDocument.PDF because the .exe is hidden and thinks it a PDF.  Or they will use a funky schema implementing character Right-to-Left Override ( aka; RTLO ) which Windows Explorer ( the OS Shell ) interprets and confuses the recipient by hiding the EXE in plain sight.  They may also take advantage of the fact that MS-DOS is a fore-father of Windows and in CP/M and DOS executable files use the .COM file extension.  Windows inherits that file extension as a executable file extension.  Malicious actors will exploit the fact that the original Internet TLDs used .COM  for a COMpany.  They rename a EXE file to something like Google.Com and Windows will execute it as if it had the .EXE file extension.  MBAM will indeed target these.  But MBAM will not flag emails that have a DOC or XLS Macro downloader trojan or JRAT or QRAT.  As I have stated before a MAPI and/or VIM compliant AV solution or one that uses a POP/IMAP proxy will decode MIME and look at not just the attachments but the body of the email. 

Since there is little overlap ( that being PE files ) it behooves the email recipient to segregate, isolate, quarantine and/or delete those malicious emails that do not contain a PE file attachment.  Simply put, there is more to malicious emails than just PE file attachments and the email recipient should be alerted to them and protected from them.

BTW:  I did not get to be a member of this Forum's "Experts" group through posting volume.  I was granted that privilege based upon vetting a few months after I joined.

 

Thank you for that lucid explanation, David, I'm sold!

I've junked MSE after a brief flirtation and reverted to AVAST Free Edition with File System, Mail and Web Shields enabled. It also seems to play much better with Malwarebytes 3.05 than MSE did.

Also, I use CryptoPrevent 8.0 Premium on my Windows 7 Home Premium 64x notebook and that does a very good job of blocking the opening of files with duplicate extensions amongst other things.

Iain

[VSS snapshots filling "C-drive"]

Yes, thanks Becky - really needs fixing (along with all the other issues).

[MB 3.0 system tray and protection layer errors]

I'm still having occasional problems with Malwarebytes 3.0 at startup. I appreciate that you are aware of some of the issues and are working to resolve them, but my installation of Malwarebytes seemed to have been behaving pretty well, apart from the odd rogue report at startup that one of the real-time protection layers was off - and that generally seemed to resolve itself within a minute or two. I'm just posting the errors in case they help you resolve the issues for the next release.

On booting up this morning, I got a message that mbamtray.exe was unable to start correctly (see image). Eventually the tray icon appeared, but was followed by the message about one or more protection layers being turned off (see image). I attempted to turn on Web Protection from the message button, the tray icon and also within the program itself but without success. I closed Malwarebytes and started it again but was still unable to turn on Web Protection. On rebooting the PC, I got the message that Web Protection was turned again off but it quickly resolved itself and Malwarebytes reported that all was well.

Window 7 SP1 with all service packs up to date
Malwarebytes Premium 3.0.5.1299
MSE with the 6 relevant Malwarebytes processes added to excluded processes and real time protection turned off
CryptoPrevent 8.0 Premium

I attach the zipped log folder and images of the errors.

logs.zip

[Malwarebytes 3.0 Nightmare]

There are plenty of posts here showing that v3.0 has a problem with MSE and I've experienced the same with Windows 7 x64. I would expect you'll see a fix soon. In the meantime, make sure sure you add the following files to MSE Excluded Processes

C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
 C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
 C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
 C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
 C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

And disable active protection in MSE also until a fix is found. My v 3.0 runs sweetly and W7 closes swiftly then

[Ver 3 a huge mistake for Win7 / MSE]

Macrium Reflect deservedly gets a lot of recommendations but if you're prepared to pay for a backup solution (as I am), Casper takes some beating. I've been using it for years myself and installed it for clients as well and it has never, ever let me down - now on version 10. Tech support is also excellent. 

https://www.fssdev.com/products/casper/features.aspx

[Premium User needs advice]

I think these FAQs may answer your questions 

 

[VSS snapshots filling "C-drive"]

Thanks for the info everybody, I'll await a fix from Malwarebytes.

[VSS snapshots filling "C-drive"]

Not something I understand much about, but is it likely that anything that makes a shadow copy is likely to leave residue? On my Windows 7 Home Premium system, I use Casper 10 to make alternate incremental bootable backups to drives in USB enclosures. I have Malwarebytes 3.0.5 Premium installed and also have System Restore enabled to use 5% of my C: drive. I also use the Registry Backup component of Tweaking.com's Windows Repair to make regular registry backups using the VSS service. After viewing this post and the linked thread in the Wilders Security forum, I ran a Tree size report on my System Volume Information Folder and the size of the folder reported as 44.8 GB. I ran a Casper Backup after turning of the Ransomware component of MB and the folder size was then reported as 32.9 GB. So something does seem to be going on with Casper as well....... 

Will Registry Backup also be affected by this bug in MB 3.0 and be leaving snapshots in C: drive? And how would I identify them? 

[DATE CHANGING IN WIN 7 pro new install even with MB 3.0 running]

6 hours ago, Kurttb1 said:

LISA, hold on to your chair !!!  just kidding but I did have something virus, worm, web backdoor, what ever and the person actually took over my administrator account and limited my ability to change anything including the "internet time sync"  So I decided it was too much for me to handle and started over.   This time I used a Windows disc I purchased from Zoftar for another computer I have.   I used the program to install professional but the disc would have installed any of the Win 7 OSes.   I started off with a different computer name and admin name and then after downloading all updates, Norton Internet security, I changed the names back to the original and activated Windows.   My POINT is that YES I did have a BIG HUGE problem and MB3 did not do anything to tell me about it or anything to keep it from taking over my computer.  Another thing, I noticed was after installing the OS on a brand new Corsair SSD different from the first Kingston I installed on and getting everything somewhat secure with Norton and MB3 I decided to attach the first SSD and erase it.  I plugged it in, started my computer and it flashed up a pop-up saying I had to hit the button to see the disc or something like that, this happen on the first SSD Kingston AND on my Seagate 4TB second HD,  both did the flash up on the screen.   I immediately went to control panel etc.. and reformatted both disks, removed the partitions and then recreated new partitions.  I read about a new USB hack which can take over some of your computer even if it is locked, read about this on intel's forum, called "poison (something)" .  Anyway AGAIN I HAD A PROBLEM..  MB3  had no clue what I was dealing with and always showed my computer as AWESOME, except when the date changed then it said MB3 was not up to date.    So far I am having good luck.. and I did change my admin password to 13 characters, I guess that is above normal but If they have a computer to search or go thru numbers figured the longer the better.  CAN Malwarebytes SEE that something besides the administrator is doing things in the computer and warn you??  or better yet stop it and plug up the hole?  No offense to anyone here, just telling you my experience.

I had never heard of Zoftar but a quick Google search throws up some concerns about them. Are you sure that disk is legit? 

[mbamtray.exe Application Error]

I don't seem to be able to edit the post above - perhaps because I've made very few posts? Just to add that I rebooted and the error did not reappear.

[mbamtray.exe Application Error]

Over the last couple of days Malwarebytes has behaved impeccably but, on logging in to the laptop this afternoon, I got the mbamtray.exe error message shown in the attached image file - I've not seem this error before. However Malwarebytes Tray Icon does appear in the system tray as normal and reports no errors; furthermore, by right clicking on it I can open the application as normal and Malwarebytes shows itself as up to date.

I pass this on in case it helps to resolve any current issues with Malwarebytes 3.0 - I attach a JPG of the error message and Malwarebytes zipped log files.

Windows 7 SP 1 x64 - build 7601
Malwarebytes Version 3.04.1269
MSE with real time protection switched off
CryptoPrevent Premium Edition 8.0.1.7
 

logs.zip

[Thank you Malwarebytes team!]

I would echo the praise - I've had a number of minor issues with version 3.0 Premium  which have been resolved quickly by searching this forum and also the insightful replies from experts to my posts. Not quite a finished product yet but seems to run sweetly on my Windows 7 laptop.

I may never know how truly effective it is unless I'm unlucky (or stupid) enough to expose myself to virus or malware - but I've used earlier versions to resolve problems on other people's machines, and version 3 Premium comes with a lot of extra armament, runs faster and may indeed be a one stop solution. Well done, Malwarebytes team! 

[Malwarebytes 3.0 and Chameleon]

That's good news - thanks for the update.

[Malwarebytes 3.0 and Chameleon]

Thanks, Ried, I put those files into MSE and everything runs smoothly except for an unacceptably long shutdown time - so I've switched off Real Time Protection again and just let MSE run a weekly scan as a bit of extra security in addition to the protection provided by Malwarebytes. 

I've got to say that I agree with your overall approach. I've been messing around with computers since the days of the ZX81 and can only remember ever succumbing to one true virus infection on Windows 95, I think, that arrived on a floppy from a computer magazine! Despite that, I sit behind a pretty secure router, back up my registry every day, use Casper 10 to make regular alternating bootable disk copies to 2 hard drives in USB enclosures which are only connected to my computer when I perform the backup operations. And I back up my really vital files to DVD on a regular basis. But I'm a bit belt and braces! 

Thanks again for your help your help,

Iain

[Malwarebytes 3.0 and Chameleon]

Thanks for that - I thought perhaps Chameleon was hidden away somewhere.

I decided to uninstall Avast and try running with MSE instead in order to avoid Avast's intrusive pop ups - especially as Malwarebytes Premium now claims to fill the roles of both antivirus and antimalware. This lead to problems on startup when Malwarebytes would report that Real Time Protection was turned off, the occasional freeze, and shutdown times of around 5 minutes. Following advice in another thread (to which I can't find the link just now), I turned off Real Time Protection in MSE and that eliminated the errors. When I return to my laptop, I'll try configuring MSE as suggested in the same thread and see if that allows it to play nicely enough to allow real time protection - although perhaps that's not needed in MSE if Malwarebytes is also installed?

[Malwarebytes 3.0 and Chameleon]

I've installed version 3.0.4 of Malwarebytes Premium after first uninstalling my old version 2.0 and it seem seems to be performing well and coexisting peacefully with Avast Free Antivirus. It's great to have Anti Exploit and Anti Ransomware included in the package but the Chameleon tool does not now appear to be available. Is this no longer available or no longer needed?

Thanks for a great piece of software - if it does indeed eventually allow me to do without additional AV, that will be wonderful - but I'll stick with Avast as well for the moment...................

Iain

[Concerned that MBam 3.0 is actually not updating]

On 10/12/2016 at 5:57 AM, bdubrow said:

Actually at this moment, 1.0.682 is the latest.

I appreciate your comments though on version info. I get what you're saying. I think it depends on what sort of user you are -- novice, expert, etc.  Typically (at least when updates are running smoothly) most novice users really only want to know whether the app is up to date or not.  Ideally Malwarebytes should be updating automatically so you don't have to worry about this.  You should only be notified if there is a problem.  Would love to hear from others about this, too.  :-)

I would certainly prefer that the definition file name reflected the date/time of issue........