Possibly new issue found with scans done in safe mode

[ThomFrost]

I have found that infected systems that will only boot in to safe mode (or have msconfig set to selective start up) when mbam scans the system will find and remove infections, but when the system is rebooted in to normal mode and scanned again even more infections will be found.

I have tested many systems and ran several scans in safe mode until mbam will say system is clean, then when the system rebooted in to normal mode and scanned again even more infections are found and removed.

Not sure why this should be, is there a way of fixing this and maybe putting it in to the next version of mbam?

[lordpake]

Not entirely sure of this but I recall reading here somewhere that normal mode is the preferred way for scanning, as not everything is loaded under safe mode. This would include some part(s) of MBAM too.

So this is not a new issue, but something of design issue If you can only boot to safe mode, then I think you need to scan first there, and then in normal mode once that's possible (someone correct me if I'm wrong).

[AdvancedSetup]

The product is not designed to run in Safe Mode. If you have to and it can not run in Normal mode but will run in Safe Mode then go ahead and run it and do the scan and clean, but when done make sure you do run it in Normal mode where it was designed to run and update the program and scan again.

[ThomFrost]

The product is not designed to run in Safe Mode. If you have to and it can not run in Normal mode but will run in Safe Mode then go ahead and run it and do the scan and clean, but when done make sure you do run it in Normal mode where it was designed to run and update the program and scan again.

yup and in a perfect world windows would not get any viruses lol

when i work on some systems they are just so infected that safe mode is the only option period.

like i said dont know if its just a design flaw or issue but seems like it is something that should be looked at and considered and fixed.

some systems i work on are so infected that even when mbam says it is clean it will still not boot in to normal mode because there is something that just keeps reinfecting the system and brings it to it's knees.

this is just a suggestion and something that maybe mbam might want to look in to as a possible product update/feature.

[exile360]

Part of the issue is drivers (MBAM's drivers won't load in safe mode as it only loads the minimum required ones), I believe the other part is MBAM's heuristics. It is a lot more likely to detect infections while they're running in memory, which many don't in safe mode.

That is not to say you can't, or shouldn't use MBAM in safe mode. But I've always recommended rescanning with any tool in normal mode after a safe mode scan and removal.

[AdvancedSetup]

Thank you for your suggestion ThomFrost but the product is currently working the way it was designed. I don't see any change in the near future with this regard. If you take a look at the hundreds of posts all over the Web you'll see that yes there are infections that can not be cleaned in Normal Mode or Safe Mode by any current tool and do require tools and methods from someone that knows whats going on and how to overcome it. Even the big guys like Microsoft, Kaspersky, Symantec, McAfee, etc... are being disabled by new infections and they're not able to block it or fix it either.

We are always looking for new ways to improve the product but how it works in Normal mode vs. Safe mode is not one of those areas as it works so well that our product was one of the first ones to be blocked by Malware.

Thank you again.