Is Quick Scan really all you need?

[nccomp]

I have watched a couple of online interviews with Bruce Harrison a MBAM researcher.

Being the internet I was not sure how legit the interviews where.

In the interviews he says the Quick Scan is all you need to run.

Is this correct?

[swagger]

Hello nccomp,

Yes, that is correct. The quick scan is just as effective as the full scan when using MBAM

[ioni]

Hello nccomp,

Yes, that is correct. The quick scan is just as effective as the full scan when using MBAM

Unlike other Anti-malware....MBAM quick scan is capable.....

[srtools1980y]

My small brain says that quick scan mode is akin to routine (say urine/blood analysis when you are ill) test & full scan is equivalent to culture test. You may be knowing that culture test is more sensitive & deep than routine tests.

Comments please.

[swagger]

My limited knowledge says that 'quick scan' scans the known malware locations on your computer while 'full scan' scans your entire computer. Full scan also gives you the ability to scan more drives or only scan certain drives that are not necessarily your Windows (ex. C:) drive.

[exile360]

The Malwerbytes' Quick Scan is designed to detect all active malware on a system that exists within its database. Whenever a particular location, be it in the registry or within a folder, is discovered by the Malwarebytes' researchers to contain something that they detect, if that registry key or folder/file location isn't already included in the Quick Scan, it gets added to it .

Now, all that being said, there's a reason for this, MBAM is not like your typical file scanner and doesn't detect malware the same way that most other tools do. As an example, if you were to take a bunch of files that are components of an infection and collect them in a folder on your desktop then scan the folder with Malwarebytes', it would likely miss detecting most of them because they aren't located where they would be if the infections were actually active on the system. This detection method has proven to be most effective (although most generic comparisons done against products that disregard file location and other attributes that are used by MBAM's heuristics may indicate otherwise ). MBAM's primary detection method is actually based on heuristics believe it or not, and not positive identification of an individual file. This is what allows the Quick Scan to be so effective and also makes it so potent against new and unknown variants of existing threats, because MBAM sees them coming based on the patterns that the infections themselves use, whereas your typical antivirus or other tool would need to have positive identification of the individual file itself to detect it as malware.

[whatmeworry?]

As an example, if you were to take a bunch of files that are components of an infection and collect them in a folder on your desktop then scan the folder with Malwarebytes', it would likely miss detecting most of them because they aren't located where they would be if the infections were actually active on the system. This detection method has proven to be most effective (although most generic comparisons done against products that disregard file location and other attributes that are used by MBAM's heuristics may indicate otherwise ). MBAM's primary detection method is actually based on heuristics believe it or not, and not positive identification of an individual file.

Exile, thanks very much for this very useful explanation. I had figured that since MBAM is the best anti-malware program I know, I'd also use it for individual scans of files I download to a specific directory. I can now see that there's little point in my using MBAM in this way. Instead, I should depend on scanning with my AV, plus (if I'm uneasy) something like Spybot from the context menu. I hadn't realized this before.

[exile360]

Correct, although this does change a bit when you're dealing with installers and droppers. Those will usually be hit if they're stored somewhere such as your desktop. Of course, the best way which would also let you avoid having to scan the file would be to use MBAM in realtime. If you've downloaded something that's bad and tried to execute it, MBAM's protection module would block it immediately (provided it's covered by MBAM of course) and would let you quarantine it .

[noknojon]

Correct, although this does change a bit when you're dealing with installers and droppers. Those will usually be hit if they're stored somewhere such as your desktop. Of course, the best way which would also let you avoid having to scan the file would be to use MBAM in realtime. If you've downloaded something that's bad and tried to execute it, MBAM's protection module would block it immediately (provided it's covered by MBAM of course) and would let you quarantine it .

Is that the best reason to also run S A S along side MBAM - As it seems similar but it also picks up the "smaller" items that MBAM will not ?? -

eg. Advertising cookies and things like that ?? -

[exile360]

Pretty much . SAS and MBAM both cover very similar territory, but with so much malware out there these days I use both because I'm paranoid, which you can tell by my setup. For most people I'd recommend one or the other in realtime and the other one as a backup on-demand scanner .

[swagger]

Which is how I run my setup. MBAM real time with SAS on demand But there's nothing wrong with being paranoid, especially here on the internet where 60% or more are trying to scam and make money off others