Does the FREE version of Malwarebytes allow restore and block?

[Riqiv]

Hi there, 

I tried the newest vs of Malwarebytes and it quarantined something I needed for a keylogger app to work.  I called phone help and they were not much help.

1) Does the FREE version of Malwarebytes allow me to restore something that it considers a threat and could I block it from looking into my keylogger app Refog?

2) If so, can I do this BEFORE a scan?

Thank you beforehand :-)

[Porthos]

You are talking about the Mac version correct?

[alvarnell]

There is only one version now that is still free, but contains an optional Real-Time Protection feature available for 30 day trial and then by subscription. Did the Real-Time Protection feature automatically quarantine keylogger file in question. If so, then you should be able to eliminate that by choosing "Stop Scan" from the M (Malwarebytes) menubar icon.

Anytime you run the app itself, any files found are presented to you in the Dashboard where you can uncheck those you want to ignore before clicking the "Confirm" button.

So the answer to 1) is no, but you won't need to as long as you don't confirm it's quarantine and the answer to 2) is No.

[Riqiv]

Thank guys, that was quick!

I'm using vs. 1.3.1 'cause it doesn't quarantine.

I tried the newest Malwarebytes and pressed Scan.  It quarantined something I need in Refog, and eventually I deleted Malwarebytes and then Refog and reinstalled.  I called Malwarebytes for assistance and a fellow on the phone for 20 minutes kept asking me if he could access my computer.  I told him the situation and just wanted to "un-quarantine" something and even spoke to a manager and neither mentioned a restore feature.

The manual mentions the restore feature:

https://www.malwarebytes.com/support/guides/mb/

but doesn't say where it is.

1) Is it in "preferences"???

2) Is the free version permanent or do you have to subscribe for Real-Time Protection feature eventually?

You said, Alva that, "If so, then you should be able to eliminate that by choosing "Stop Scan" from the M (Malwarebytes) menubar icon".

3) Not quite following that.  Do you stop the scan mid-scan, and then go to the Dashboard to un-confirm???

I'm using Avast now and restored what I need and blocked what needs to be blocked but it may handle viruses and not malware and is a little new to the world.

I'd like to give Malwarebytes another shot if I know I can RESTORE and BLOCK in the free version and it is (for now) a permanent solution.

Thanks again!

[alvarnell]

I'm not sure what happened as I've never had the scan feature of v3.x.x automatically quarantine a file. Only the RTProtection scan has done that to me.

That's the Windows manual. Check either of these Mac versions:

Malwarebytes Anti-Malware for Mac User Guide Version 1.2.6 (I don't believe this was updated for 1.3.1, but they are very similar).

Malwarebytes for Mac User Guide Version 3.1.1.

1) There is no restore feature for Mac, yet.

2) Version 3.x.x is free and after the 30 day trial, you have to subscribe to keep using Real-Time Protection, but you don't have to do that if you don't want to.

3) Again, if it's the Real Time Protection that is automatically quarantining files that you don't want it to, then disable it. It runs in the background all the time so there is no such thing as mid-scan.

RTProtection and the Malwarebytes for Mac app are two different processes. You can control the RTProtection either from the menubar or in the dashboard by clicking On or Off next to "Real-Time Protection: "

And once again, the Malwarebytes for Mac application itself has never automatically quarantined a file when I use it and manual click "Scan."

Edited February 9, 2018 by alvarnell

[treed]

Malwarebytes for Mac currently does not have the capability to whitelist files, and restoration from quarantine is strictly manual at this point. These things will improve in the future, of course, but that doesn't help you now.

I would seriously question any workflow that requires you to use a keylogger, but I've learned not to argue. At this time, if you don't want Malwarebytes for Mac quarantining Refog, you'll need to:

1. Disable real-time protection
2. Keep an eye on what is detected during manual scans and don't let it quarantine the Refog files

[Riqiv]

Thx Alva and Treed,

I may stick to vs. 1.3.1 for now.  

And Malwarebytes has warned me about my keylogger, but answering answers on the Sibelius (music composition app) help line and losing 45 minutes of typing accidentally on my browser my pushing the wrong key or wrong tab became too much.  I told Malwarebytes, regarding security, that their phone help pressuring me to access my computer for 20 minutes was more of a threat then an app that been faithful for 10 yrs, plus I'm the only person on my computer and Refog is set not to record passwords.

Sorry Treed, didn't mean to argue :-)

Do the developers of Malwarebytes check in here, I'd like to use Malwarebytes when the have a restore and block feature.

Edited February 9, 2018 by Riqiv

[treed]

We actually don't currently have phone support for non-business customers, and don't do remote access/control. I would guess that whoever was pressuring you to access your computer was NOT Malwarebytes. What number did you call, and where did you find it?

[Riqiv]

Hi Tweed, 

I called ###-###-#### Thur 01/25 @ 12:27pm.  

WOW, you answered my support ticket 2203988.  I love Malwarebytes!

Evidently there are several scam #'s with some very good talkers.

I'm hoping that Malwarebytes makes a $50/60 version (or free...either way) that supports "replace" and "block" for apps/folders/paths.  

Monthly payment is a little much as I've moved from Adobe Photoshop to Affinity Photo for that very reason.

If the devs come up w/something for us 2nd place Mac users, I'd love to know Tweed  :-)

Richie

 

(Edited to remove scammer phone number.)

Edited February 9, 2018 by treed
Removed scam phone number

[treed]

That is actually a scam number (and, as such, I'm going to remove it from your post so that it doesn't increase the Google search positioning of that number).

Those scammers frequently post that number claiming that it is Malwarebytes support, Webroot support, etc. They've even been on a kick of posting that number as a Malwarebytes support number in our own forums, which is particularly bold.

Keep an eye on future developments. We're not adding whitelisting right away, for a variety of reasons, but we will be adding it at some point, probably later this year. (And then people will start using it to whitelist things like MacKeeper. *sigh*)

[Riqiv]

Yes, it seems like I can't edit out the phone # so pls do so :-)

I'll keep an eye out here but if "restore" and "blocking" become a reality for Mac, and you manage to remember, pls post here.

Malwarebytes saved me from a Genieo virus and a trojan and I was very much relieved about a year ago and I still have vx 1.3.1 until it is legacy and non-working on a new OSX.

Will check back from time to time, thx!

 

 

 

[alvarnell]

I feel it's important to point out that the current version 3.1.1 (soon to be 3.1.2) has some significant improvements over 1.3.1, even with Real-Time Protection disabled. treed and I have both told you how to use it so that it won't quarantine your keylogger, so I would encourage you to upgrade now. I don't see any advantage to staying with 1.3.1 or downside to 3.1.1.

[Riqiv]

Well then I'll uninstall Avast first, thx!

Now I know how to accomplish #1, but NOT #2:

1. Disable real-time protection

You can control the RTProtection either from the menubar or in the dashboard by clicking On or Off next to "Real-Time Protection: "

 

2. Keep an eye on what is detected during manual scans and don't let it quarantine the Refog files

Any specific instructions would be helpful and if they're already above, forgive me for asking :-)

In other words, how do I stop Malwarebytes (the free Mac version) from quarantining a threat?  I didn't think that was possible.

[Riqiv]

Also, should I QUICKLY disable real-time protection, in other words it sounds like if I download it tonight and installed it and was tired and went to sleep I'd be sorry.

It sounds like I should disable real-time protection upon installation?

[alvarnell]

Correct. Disable immediately after installation.

[Riqiv]

Thank you :-)

[alvarnell]

Sorry, missed your previous question regarding #2.

At the end of each manual scan, you will be shown the results in the Scan portion of the main window. There's a box to the left of each file found that is checked by default. Simply uncheck the box next to any file you don't want to be "Remediated" and then click the "Confirm" button take action on the remainder that are still checked.

[Riqiv]

And that means that if I disable real-time protection upon installation and manually run a scan, and I uncheck anything related to Refog and it will not be deleted or quarantined?

Is that what you believe?  

Just double-checking.

Also, could that CONFIRM of a file you don't want "remediated" be made permanent.

Thx, I"ll likely do this all tomorrow and announce my success :-)

[alvarnell]

More than believe, I'm certain of that. Have done so multiple times.

But no, you will have to uncheck it each time it is found. If that's all Malwarebytes finds then you can just choose to "Cancel" remediation without unchecking or doing anything else.

[Riqiv]

Well, that's a relief Alva, I just want to let folks know I don't hold them responsible if something unforeseen happens, either in life or on my computer :-)

Well, I'll be using one of my favorite apps again, Malwarebytes, sometime tomorrow.

Many thx! 

[treed]

Yes, Al is correct. When you do a manual scan, nothing is removed until you actively confirm that it should be. You can always opt not to remove any of the detected threats, or deselect those that you don't want to remove and allow it to remove the rest.

RTP is the only case where you don't get a choice currently.

[Riqiv]

Hi guys, this is for the FREE version:

I downloaded Malwarebytes but there is no place to turn off RTP, it seems it's not there unless you purchase (upgrade and have a key).

NOW, in the free version, I've set 'Preferences > General' tab to: "Default action for potentially unwanted programs to 'SKIP'" from the the default of "quarantine".

1. If I push "Scan" will ANYTHING from Refog be moved or quarantined?

I am saying this because I believe the FREE version does not have a "restore" feature so if it quarantines something, I'd have to manually move it back (impossible) or reinstall Refog.  

2. On the other hand if I select SKIP,  will I have the option to quarantine or delete something in a window?

3. What does "Automatically check for database updates" do?

Thank you,

----------------

Preferences > My Account:

Edition: Free

Status: RTP does not work

Real-Time Protection is enabled only for Malwarebytes Premium and Malwarebytes Trial users.

I believe my Trial time is over.

Edited February 10, 2018 by Riqiv

[Riqiv]

From the manual:

• Default action for potentially unwanted programs determines the action taken on PUPs. The default option is to Quarantine PUPs, although you may also choose to Skip processing instead. This would exclude PUPs from scans. You may still quarantine PUPs by selecting them after a manual scan.

The sentence here, "You may still quarantine PUPs by selecting them after a manual scan."

Does that apply if I have set the "Default action for potentially unwanted programs to 'SKIP'" from the the default of "quarantine".

Sorry for so many questions but I can't tell you how long it took me to figure out if Malwarebytes or Drive Genius was the culprit stopping Refog and getting everything straightened out :-)

[alvarnell]

If your trial is over then you don't need to worry about Real-Time Protection doing anything any more.

Pushing Scan will cause Malwarebytes 3.1.1 to behave exactly the way that 1.3.1 was behaving for you. Nothing will be done to any files now until the scan is finished and you decide whether to apply remediation to each checked file.

Don't worry about PUP's for now. You'll be told if you have any after the scan and can make a decision at that time.

[Riqiv]

Thx Alva, 

Am I correct in my assumption that if I leave "Default action for potentially unwanted programs to 'Quarantine", very likely something from Refog will be quarantined.

I don't believe that the FREE version has a "restore" feature.