Is Malwarebytes really protecting me?

[agtavy]

I just bought 3 PRO licenses for my 3 PCs and see something interesting.

If I look in Windows Task Manager I see one item relating to MBAM: mbamgui.exe @ 2,412K of memory.

Then when I double click on the blue MBAM icon in the System Tray, the program opens and I see the program's full console with all the settings. Now looking at Task Manager, I see mbam.exe is running @ 88,624K of memory. The program is idling at this point, not scanning. When I close (X) Malwarebytes, the mbam.exe entry disappears. This happens on two of my machines, both Windows 7. (The setting "Start With Windows" is checked)

Question 1: When mbam.exe isn't running in Task Manager, am I being protected? 2,412K of memory doesn't sound like much for a realtime scanner.

On my third PC, I am still using the trial version of PRO (I just bought the licenses and haven't activated that machine yet). But on that one, mbam.exe is always running in Task Manager even though I haven't opened the icon from the System Tray as I did in the above example. That third machine is a little old and the 130,000K of memory MBAM uses when idle taxes the resources. The 130,000K is constant. That machine is Windows XP Pro.

Question 2: Why does MBAM constantly run on one machine, no matter what I am doing with MBAM? Then, on the other 2, mbam.exe only runs when opening the program from the System Tray then disappear again when closing the interface?

Question 3: If MBAM is fully protecting my machines when only the mbamgui.exe is running, then why is the one machine always running mbam.exe and using a considerable amount of resources?

[exile360]

Greetings and welcome

mbam.exe is not part of the protection module, it is the on-demand scanner and user interface component of the product and is also used whenever a scheduled scan runs. mbamscheduler.exe is the process used for launching scheduled scans and updates in the paid/trial versions of the product. The processes used by the realtime protection components of the paid/trial product are mbamgui.exe and mbamservice.exe Note: In order to see mbamservice.exe you'll need to enable the option to Show processes from all users in Task Manager

The amount of RAM used by the protection module varies from one system to another and many different factors determine just how much it uses, but here's most of it:

• The OS being used:
  
  • Memory management capabilities built into Windows Vista, Windows 7 and Windows 8 are much better than those built into Windows XP
    
  • The architecture of the drivers/services used by Malwarebytes Anti-Malware on different Windows versions vary depending on the capabilities and requirements of the OS (again, XP is very different from Windows Vista, 7 and 8)
    

  [*]The number of processes running on the system and that run at startup that Malwarebytes Anti-Malware's realtime protection must check whenever the protection module starts

  [*]The size of the database and the number of signatures it contains

  [*]The total amount of RAM contained in the system and how Windows chooses to allocate that memory (again, the OS being used is a major factor here)

Now, if you'd like to test whether or not the realtime protection components are functional, you may do so via the information in this knowledgebase article.

[agtavy]

Hi Exile. I appreciate your thorough information. It certainly helps.

In Task Manager, under Processes, mbamgui.exe is running.

In Services, MBAMScheduler and MBAMService are both running.

So based on your response, I should be protected.

Incidentally, the test link to spycar.org no longer works. The IP test was indeed blocked.

Thanks for your response.

[Uriah]

exile360, in the knowledgebase article, the linked to spycar site is no longer active, it states the domain has expired.

[exile360]

exile360, in the knowledgebase article, the linked to spycar site is no longer active, it states the domain has expired.

Ah yes, it seems that Spycar.org is no longer around or have failed to renew their domain name .

Thanks for letting me know. We'll have to set up a test of our own from now on. I'll get with the developers and see about cooking something up, though I'm certain it will take a while (but hopefully not too long).

[agtavy]

I wanted to follow up with one more bit of information to be sure I'm fully protected (Someone recently got all my logins and passwords - including bank accounts, investment account and credit cards - created bank accounts in my name and withdrew money, so I am very paranoid now. I reformatted all 3 machines and want to know I am safe)

So, I am now looking at my third PC, the XP unit mentioned in my first post. Looking in Task Manager/Processes, here's what I see:

mbamgui.exe @8,188K

mbamscheduler @ 6,636K

mbamservice.exe @120,840 K

But on the Windows 7 PC, I have only mbamgui.exe in Processes. And MbamScheduler.exe and MbamService.exe are listed under the Services tab.

Does this sound kosher? After all I went through with identity theft and having money stolen, I want to be sure.

Thanks again in advance.

[exile360]

I wanted to follow up with one more bit of information to be sure I'm fully protected (Someone recently got all my logins and passwords - including bank accounts, investment account and credit cards - created bank accounts in my name and withdrew money, so I am very paranoid now. I reformatted all 3 machines and want to know I am safe)

So, I am now looking at my third PC, the XP unit mentioned in my first post. Looking in Task Manager/Processes, here's what I see:

mbamgui.exe @8,188K

mbamscheduler @ 6,636K

mbamservice.exe @120,840 K

But on the Windows 7 PC, I have only mbamgui.exe in Processes. And MbamScheduler.exe and MbamService.exe are listed under the Services tab.

Does this sound kosher? After all I went through with identity theft and having money stolen, I want to be sure.

Thanks again in advance.

Yes, it does, as long as you see mbamscheduler.exe and mbamservice.exe listed under processes when you click on Show processes from all users and as long as you see the Malwarebytes Anti-Malware icon in your tray on the lower right hand side of your taskbar near your clock and other notification area icons and it is blue in color (not gray).

[agtavy]

Most excellent, Exile. Thanks very much once again.