Malwarebytes Free not Scanning Files on Mapped Drive

[letsfixthis]

Hello,

I recently noticed that when I scan my mapped drives Malwarebytes looks like it's scanning the files but actually scans 0 objects. This happens if I use the right-click context menu to perform the scan on a specific subfolder or if I set up a custom scan from the interface and scan the entire mapped drive. It was working a few months ago.

I'm running MBAM v3.3.1.2183. I've tried to uninstall, reboot, and reinstall the software. Right clicking+Scan With Malwarebytes the root or any subfolder of any mapped drive (currently Y and Z) results in a ~10s scan with the following:

Scan time: 10s

Items scanned: 0

Threats detected: 0

Threats quarantined: 0

There are thousands of files of different types to scan.

A custom scan of either or both mapped drives produces a result of the same ~75k objects being scanned. This is the result of prescan operations, memory objects, startup files, and registry objects. No files are scanned. This scan takes about 13 seconds. The drives are mapped to shared folders residing on a NAS device.

Was the ability to scan network drives removed from the free version or is there another issue here?

Thanks

[letsfixthis]

Is anyone available to reply to this? Have I posted in the wrong forum?

[Porthos]

Sorry your post got buried/overlooked by an issue that happened about the same time but @dcollins can give you an answer or fix.

Edited February 12, 2018 by Porthos

[dcollins]

MB3 doesn't currently support scanning network drives in Free or Premium mode. While it can be scanned using Custom Scan or the context menu, it's not actually scanning the drive. I'm working with our development team to make this more identifiable.

[letsfixthis]

On 2/12/2018 at 1:36 PM, dcollins said:

MB3 doesn't currently support scanning network drives in Free or Premium mode. While it can be scanned using Custom Scan or the context menu, it's not actually scanning the drive. I'm working with our development team to make this more identifiable.

Thanks for the reply. I might not have noticed that it wasn't actually performing a scan in the past.

Is this a feature that the team plans to implement? Many people store media on NAS devices these days. My particular concern is with the subtitle vulnerability found last year. I tend to scan content retrieved automatically (SRT files in this case) using both Malwarebytes and my virus scanner to be on the safe side.

Thanks

 

[dcollins]

It's something we have in our list of features to add, but no ETA at this point.

[prolecs]

Well I think this is a serious shortcoming. Not much good scanning half my system.

[exile360]

Technically speaking, network storage isn't a part of your system, it's a separate device connected via the network, but I see your point and I agree that this should be addressed if possible.  The biggest challenge is permissions.  Being able to read a location over the network is one thing, but actually being able to write to it and/or delete items from it is quite another, especially in modern Windows where the system is deliberately walled off as frequently as possible via permissions restrictions through UAC and similar technologies.  Currently, even though the scan engine in Malwarebytes runs as SYSTEM, since it's still technically a local user token/permissions level, it still doesn't apply to or provide full write access to network attached storage devices so some alternative solution will need to be developed, likely involving some kind of network/domain user token spoofing or the like (assuming that's possible these days as it was in the pre-UAC days).

Either way it's a pretty tall order, but hopefully the Developers will be able to come up with an elegant solution to the problem.

[BillH99999]

Sorry to butt in, but I need a clarification.  I use MB3 Premium to scan my NAS drive which is connected via USB.  The scan appears to work and says that a non-zero number of files have been scanned.  I use the right click menu to initiate the scan.  Is what you are talking about here something different? 

Thanks
Bill

[exile360]

That's different.  Since the drive is attached to the system via USB, Windows sees it as a locally connected drive/device so it isn't scanned over the network.  Were the drive attached to your router via USB, ethernet or wireless and the PC connected to it through the network, that would be what we're referring to here.

At least if I'm understanding what you're referring to correctly that is.

[BillH99999]

@exile360

OK... that explains it.  You were understanding what I was saying correctly.

Thanks
Bill

[exile360]

Sure, no problemo  

[dcollins]

Also, since this post was made, we now prevent scanning of network drives to make sure there's no confusion. So if you can scan the drive, it's being scanned properly

[exile360]

Right, it used to scan them but wasn't actually capable of detecting or removing anything from them so the ability to scan them was removed until full detection and remediation capabilities for networked drives could be implemented.  That was quite a while back so I'd forgotten that they did at one time allow them to be scanned.