MBAM set to "do not check for removal" but still removes

[dfarns]

After running MBAM, there was a list of 8 malware found, including the file names. When I checked the first two results looking in their folders for these bad files ( wanting to run the suspect files through Virus Total to confirm their badness), I discovered they weren't there. I checked the MBAM quanrantine and they weren't there either.

So the MBAM results log shows and names these files, but they've disappeared from their folders. Is it possible that MBAM is deleting suspect files even though I have it set to "show in results list and do not check for removal". The scanner settings tab is the only place I've found where I can make this choice.

Am I missing something?

[exile360]

Those options are not for malware, they are for Potentially Unwanted Programs (PUPs), Potentially Unwanted Modifications (PUMs), and Peer-to-Peer software (P2P).

Anything removed by the software will have a copy placed in quarantine and should be visible in the Quarantine tab in Malwarebytes Anti-Malware. You may restore anything removed by the program by using the buttons on the Quarantine tab to do so.

[dfarns]

Then it looks like there is no way to prevent MBAM from deleting (removing) a file it thinks is bad. I'm glad to know that now...I'll use the program much less in the future as there are plenty of other programs where the user can control the resulting action after a scan.

[exile360]

Then it looks like there is no way to prevent MBAM from deleting (removing) a file it thinks is bad. I'm glad to know that now...I'll use the program much less in the future as there are plenty of other programs where the user can control the resulting action after a scan.

Yes you can, you simply uncheck any item you do not desire to have it removed, and you may even add items detected to the Ignore List to prevent them from being detected in the future.

[dfarns]

I don't see where I can uncheck anything. After a scan, MBAM presents me with a Notepad screen showing a text file of what happened. As far as I can tell, any bad files shown on this screen have already been removed...and hopefully placed in Quarantine. Looking in the Quarantine tab, I still don't see anyplace to uncheck anything. I know I can use Restore, but I want to prevent a file from being removed by a scan. Could you show me exactly how to do this?

Thanks

[exile360]

I don't see where I can uncheck anything. After a scan, MBAM presents me with a Notepad screen showing a text file of what happened. As far as I can tell, any bad files shown on this screen have already been removed...and hopefully placed in Quarantine. Looking in the Quarantine tab, I still don't see anyplace to uncheck anything. I know I can use Restore, but I want to prevent a file from being removed by a scan. Could you show me exactly how to do this?

Thanks

You get to notepad popping up by clicking on Remove Selected after a scan is complete. Here's the scan process step by step:

1. You initiate the scan by selecting the scan type and clicking on the Scan button
   
2. The scan proceeds and once it is complete, if nothing is detected, it displays a message stating that nothing was found and notepad is opened displaying the scan log (which will show that nothing was found)
   
3. If malware is detected, you will be notified by a message stating as much and prompting you to click on the now visible Show Results button
   
4. Once you click on Show Results you'll be presented with the scan results screen which looks something like this:
   
   
5. You may then use the checkboxes on the left side of that screen to choose which items you wish to have removed. Any object you uncheck the box next to will not be removed by Malwarebytes Anti-Malware
   
6. You may also click on any object listed and use the Ignore button to add that item to the Ignore List so that it will no longer be detected as a threat by Malwarebytes Anti-Malware
   
7. Once you've made your selections, click on the Remove Selected and anything you still had selected or removal will be quarantined, the logfile will open in notepad, and if required for removal to complete, you will be prompted to reboot your computer with a 'Yes' or 'No' prompt so that you can choose whether to restart now or later
   

[exile360]

If you wish to restore an item which Malwarebytes Anti-Malware has already quarantined, this video will show you how.

Once such an item has been restored from quarantine, it may be added to your Ignore List so that Malwarebytes Anti-Malware will no longer detect it, either by using the scan method described above, or manually by visiting the Ignore List tab, clicking on the Add button, then browsing to the file's location using the provided browse dialog and then selecting said object and clicking OK.

Objects can be added to or removed from the Ignore List at any time using the buttons provided there.

[dfarns]

Thanks for the good explanation. I think I was looking at the Quarantine screen and not seeing the check boxes and confusing it with the Show Results screen.. And earlier I was mostly completing scans with no found malware and thus getting the notepad screen so I was then going to the Quarantine screen and also confusing it with the Show Results screen. I just did a full scan that picked up a bunch of malware and displayed the Show Results scrren with the check boxes. I don't know what happened to the missng files after the earlier scan but I'll have to leave that alone unless it happens again.

Interestingly, on the full scan, not all of the malware listed had checks in their boxes. Does this mean anything?

[exile360]

Interestingly, on the full scan, not all of the malware listed had checks in their boxes. Does this mean anything?

Yes, if the items detected were PUP (Potentially Unwanted Programs) or PUM (Potentially Unwanted Modifications) and you have them set to detect but not select for removal of those object types under the Scanner Settings tab then that would be why .