AVG v Malwarebytes

[tumasek]

My AVG subscription is almost due and I have been recommended Malwarebytes. Naturally I have thus tried the free version in the first instance but have come across a situation which I am not happy about.

AVG picks up a Trojan - Generic12 ASFU which has found its way into a folder called "resycled" (spelling correct!) and is a file called boot.com. An internet search on this item confirms it is indeed malware. However, running a quick and full scan with Malwarebytes fails to find this at all, which is clearly giving me concern. Reading previous posts you suggest that Malwarebytes will not necessarily pick up any "nasty" that is just sitting idle in a folder, as this appears to be doing. However, as the free version does not have "running protection" then surely this Trojan could be activated between scans - hardly a safeguard. It seems to me that malware, even sitting idle, should be detected and removed BEFORE it can possibly be activated.

I cannot yet see why I should purchase Malwarebytes with the concern I have. At least AVG spots it and removes it pronto, even if it is lying "idle".

Some observation on this apparent problem, and indeed if I am expecting too much from Malwarebytes, would be welcome before I consider upgrading to the commercial version.

[GT500]

Here are some things that you need to know about Malwarebytes' Anti-Malware:

* It is not anti-virus software, and will not detect the same things your anti-virus detects. We recommend AntiVir from Avira for a good anti-virus.

* It can detect idle threats in places that malware , but it does it's job best against live threats that have real load points on your system. Something with no load point is only going to harm you if you execute it manually.

* The protection module prevents installation of most new malware. It does not act as a real-time protection scanning every file like your anti-virus does.

[tumasek]

Here are some things that you need to know about Malwarebytes' Anti-Malware:

* It is not anti-virus software, and will not detect the same things your anti-virus detects. We recommend AntiVir from Avira for a good anti-virus.

* It can detect idle threats in places that malware , but it does it's job best against live threats that have real load points on your system. Something with no load point is only going to harm you if you execute it manually.

* The protection module prevents installation of most new malware. It does not act as a real-time protection scanning every file like your anti-virus does.

Thanks for the swift comment.

Am I therefore safe in assuming that if such an "idle" threat were to be executed manually, then Malwarebytes would indeed detect it? Problem would surely arise though that without the "protection" of the upgraded version, this would still get onto the machine, where Malwarebytes would pick it up and correct it on the next scan. Is that correct?

Sorry to be a bit obtuse about this but it seems to me that the AV would be useful to pick up a "possible" threat whereas Malwarebytes would eradicate an existing one. Is that it?

[quietman7]

No single product is 100% foolproof and can detect and remove all threats at any given time. The security community is in a constant state of change as new infections appear. Each vendor has its own definition of what constitutes malware and scanning your computer using different criteria will yield different results. The fact that each program has its own definition files means that some malware may be picked up by one that could be missed by another. Thus, a multi-layered defense using several anti-spyware products (including an effective firewall) to supplement your anti-virus combined with common sense and safe surfing habits provides the most complete protection.

[GT500]

Am I therefore safe in assuming that if such an "idle" threat were to be executed manually, then Malwarebytes would indeed detect it? Problem would surely arise though that without the "protection" of the upgraded version, this would still get onto the machine, where Malwarebytes would pick it up and correct it on the next scan. Is that correct?

That depends on what it is, how old it is, and if there is a valid point of infection for it.

There's no reason to add detection for something that doesn't have a current point of infection, especially if traditional anti-virus software is detecting it. The role of MBAM is to detect what anti-virus software does not detect. We do not aim to be an all-in-one application.

If you feel it should be in our definitions, then you can upload it to our UploadNET, and one of our researchers will take a look at it.

Sorry to be a bit obtuse about this but it seems to me that the AV would be useful to pick up a "possible" threat whereas Malwarebytes would eradicate an existing one. Is that it?

Not so much. As I said above, the point of MBAM is to detect what anti-virus software does not or can not. MBAM's protection module can prevent most new types of malware from installing, but the free MBAM's main goal is to remove the newer and more stubborn malware when your anti-virus fails you.