False Negatives??

[nkormanik]

Curious if anyone out there has reported a "false negative" from malware.  Well, recent past, that is.

In other words, IFF our anti-malware reports that all files are safe, are we basically good to go?

Is it advisable to run multiple anti-malware programs -- Malwarebytes included, of course -- just to be sure?

Thoughts on this greatly appreciated!

Nicholas Kormanik

 

[exile360]

It's always a good idea to get a second opinion, and there are plenty of freely available options to do so.  Most of the major AVs offer some kind of free scan to check for threats, and most of them also include remediation so that you can remove anything they find.  Since there is no 100% silver bullet for detecting every possible threat ever, it is a good idea to at least occasionally get a second opinion to make sure your system is clean, though it also depends a lot on the activities of the user behind the keyboard and the sites they choose to visit and habits they adopt when using their device as some activities put the system at much greater risk of getting infected and/or infested with PUPs (Potentially Unwanted Programs; i.e. adware, spyware, search hijackers, trackers and the like).

I've used many such scanners over the years, though my personal favorites in the past have been the likes of ESET, Kaspersky and Avira, but as I said, most of the major AVs offer such a tool/scanner, so there are plenty of choices.  There are also second opinion scanners like HitmanPro and tools like VirusTotal where you can upload a file to have it checked by multiple AV/AM engines (though do keep in mind that many of the real-time and behavioral detection capabilities of those products/engines are often not included in VT scans and other multi-engine scans as they rely on more than just the base scan engine and its signatures/definitions; this is also true of Malwarebytes, as Malwarebytes Premium has multiple layers of defense and threat detection which are not a part of the scan engine in the free version because they look at things like application and process behavior in real-time rather than static file analysis).

This is also why Malwarebytes has been designed to be compatible with most other security software and why many keep Windows Defender enabled alongside Malwarebytes as this reduces the chances of the system getting infected.  You don't have to run an AV or any other security software alongside Malwarebytes and you'll still have excellent protection from most threats, however there will always be new threats that go undetected in the wild for at least a short time before a security vendor has had a chance to capture samples for analysis to write signatures and/or heuristics to detect them, so a second opinion as well as smart surfing and safe choices go a long way to keeping your device and data safe when going online.

Malware and PUPs are not the only threats to watch out for, either.  There are countless scams out there where criminals try to convince people to pay them or provide payment information and personal information for their own profit (such as tech support scams, fake inheritance emails and many other types of scams and threats).  You can learn more about a lot of the threats out there by reading the Malwarebytes Labs blog if you're curious and want to know more about many of the latest threats and online scams.  They even have a Tech support scams: help and resource page with great info and links to various articles and guides on what these scams are, how they work, how to deal with them if encountered, and how to avoid them.

I hope this helps.

[nkormanik]

Wonderfully worded and explained.  Much thanks!

I perceive that recently, since ransomware has gotten attention -- by taking down many computers, and (apparently) garnering the perpetrator lots of money -- downloadable programs have increasingly been loaded with such horrid malware, very quickly encrypting thousands of precious files.

The perps now feel financial motivation.  As opposed to simply being mean spirited.

 

[exile360]

Malware (and PUPs for that matter) haven't been about simply being mean spirited for decades, not since the earliest days of maybe Windows XP.  Malware is a major business, operated by organised crime, hostile governments and malicious coders and distributors seeking profits.  As far as ransomware is concerned and how it is delivered; it is not typical to find ransomware within downloadable programs as the most common vector of infection is through the use of exploits (this is why the Exploit Protection in Malwarebytes is actually for more proactive against ransomware in the wild than the actual Ransomware Protection component is, because it stops most would-be ransomware attacks in their tracks at the initial exploit attempt, long before the actual ransomware payload is ever even downloaded to try and ransom the user's data).

I recommend taking a look at the diagram and information found on this page to better understand how the layered protection in Malwarebytes works to effectively detect and stop all sorts of malware attacks and PUPs at nearly every phase of the attack chain/kill chain; something that greatly increases the overall effectiveness of Malwarebytes alone (which is the reason it is now sold as an AV replacement).  You may review this FAQ entry for further info on that subject.

This also means that simply adding a single additional layer such as the free Malwarebytes Browser Guard, and on top of that, keeping Windows Defender enabled/active alongside it has proven to be a very effective combination, and one that we highly recommend.

I also recommend going through the excellent topic, Tips to help protect from infection.  There is a lot of information there, so there's no need to rush to implement any or all of it (and you likely already know at least some of the info it includes), but you are likely to find at least a few useful tidbits that can help you to improve your odds against online threats (as well as better protecting your privacy online).

I hope that you find this information useful.