So exactly why cant malwarebytes premium replace your antivirus?

[jamiehavok]

..i mean it seems to detect everything and block malicious websites well? And if it cant detect cetain things, why not make it so it can? then you'll pretty much havet he best antivirus profuct out there!

[David H. Lipman]

Here 'ya go with the technical reasons.

 

1.  First, MBAM is incapable of removing malicious code from an infected, legitimate, file

 

File infecting viruses (real viruses, not what people "think" is a virus) prepend, append or cavity inject malicious code into legitimate files.  As a virus, the infected file can, in turn, infect other files and/or systems.  Some trojans may also prepend, append or cavity inject malicious code into legitimate files.  However, in this case, the infected files don't infect other files or systems.  These are known as being "trojanized" or "patched".  In both cases, MBAM can't remove the malicious code from infected files.

 

2.  MBAM does not target documents, graphics/media or scripted files.  That means scripted files such as;  HTML, VBS, JS, JavaScipt, PHP, BAT, CMD, etc are not targeted.  Documents such as;  DOC, DOCx, XLS, XLSx, PPT, PPTx, PDF, ODF, RTF, etc are not targeted.  Mediia files such as graphics are not targeted such as;  GIF, PNG, JPG, BMP etc.  Movie files such as;  MOV, AVI, MPG, etc are also not targeted.

 

This means that MBAM will not target a MS Word document that has a Macro Virus or a movie file that is a Wimad trojan. 

 

3.  MBAM does not target exploit code.  That means malicious Java, PDF, Word files or other files that have been specially prepared to exploit a vulnerability will not be targeted. 

 

4.  MBAM targets Windows executable files.  They can be EXE, DLL, SYS and OCX.  Windows Executable files have the first two characters being 'MZ'.   Any executable file that has been renamed will still be targeted just as long as they are Windows executables where the first two characters are 'MZ'.  That means an EXE that has been renamed to have the JPG extension will still be targeted.

 

5.  MBAM is not a historical anti malware solution.  That means MBAM will not target malware that was seen in the wild in 2008, but is no longer seen in the wild.  MBAM targets new, fresh, malware seen in the wild Today.  Malwarebytes' personnel periodically cull the signatures for malware that is no longer seen in the wild and thus no longer relevant.

 

So when you take all that into account, MBAM complements a fully installed anti virus solution.  The fully installed anti virus solution is relegated to the detection of such things as a malicious JavaScript, a PDF that is using exploit code or if the site is hosting a malicious Java Jar.

 

What MBAM excels over anti virus solutions is remediating the modifications that malware makes to an Operating system.  Today's non-viral malware will greatly modify the computer they infect to change the way they work.  This could be changing file structures, NT Services or Registry modifications.  Traditional anti virus applications do poorly in reverting those changes to normal.  MBAM excels in reverting those changes to normal.

 

HTH

 

{ I could probably write more but that's good enough - for now }

[XXPepper]

Sorry if I'm being obtuse, but out on the front of the site there's a quote from a user, employed as sales pitch, that says, "...forget the rest...".   In here it sounds like you're saying that, rather than "forget the rest", we should actually run three products:

1. Some other brand of antivirus,

2. Malwarebytes Premium

3. (implicitly) Malwarebytes Anti-exploit.

 

Is this a correct understanding of the gist here?

 

Thanks very much for clearing this up, either way.

[David H. Lipman]

That pretty well sums it up.

 

"...forget the rest..." is too vague and really should be;  "...forget the rest in the same class of anti malware..."

 

You know how marketing people are.  They like to keep things "simple".

[XXPepper]

For clarification on my question, I found this thread because I'm trying to figure out if I need both Malwarebytes Premium and Malwarebytes Anti-Exploit or if one or the other of them does both jobs.

 

Thanks.

[David H. Lipman]

Anti Exploit is a whole different product.

 

Whether you need it or not, depends on how you use your computer.

[1PW]

It'd be a good idea for David, if acceptable to the Forum boss, to do a thorough explanation on the subject and pin it.

+100

Well done again David. May we please have your permission to reproduce with the proper attribution?

Thank you.

[David H. Lipman]

But of course 1PW !

 

Yes.