Using Malwarebytes for Scan Only

[BillHalberstadt]

Among Apple Mac users there is often a desire for a "scan-only" malware scanner. It is usually believed that Malwarebytes can fit this need by simply not enabling its real time protections. However, I have encountered a problem with this. I have Malwarebytes Free 4.15.9 (latest), and 1Password 7.9.4 (latest) on a MacBook Pro (2019 16") under macOS Monterey 12.4 (latest). I use the form of 1Password that uses their servers for central storage and synchronization of the data.

I was trying to track down a problem that manifested as failure to update the 1Password servers (and thus my other devices) when I deleted a 1Password record. Creating or editing a record did propagate, but deleting a record did not. After many attempts at diagnosing this problem, I found that it did not occur if I uninstalled Malwarebytes, and did happen upon reinstalling Malwarebytes. I have never enabled any of Malwarebytes real-time protections (they show a "Off"), nor bought the premium version.

After contact with Malwarebytes support, they suggested putting 1Password.com in the "trusted site" list, and that did remove the problem. [Note: I can no longer find that feature in my installed Malwarebytes, and don't remember how support led me to it]. As expected, though, after another uninstall/install of Malwarebytes (without a trusted site entry), the problem returns.

So, it appears that as normally installed, and without using a "trusted" list. Malwarebytes for Mac does interfere with certain network communications. If true, this is an important fact for Mac users to know, if hey are seeking a "scan-only" solution.

Is this the intended operation?

Bill Halberstadt

[BillHalberstadt]

Just FYI - I have now found where the "Allow" list is - under Detection History. Doesn't affect the question/problem.

[treed]

Just confirming, are you using the Malwarebytes for Mac anti-malware software, or are you using Malwarebytes Privacy for Mac (the VPN software)?

Malwarebytes for Mac does not include any network blocking functionality, and thus there is no facility for adding sites to an allow list. Further, if you're using it for free, there's no protection-related process running in the background. I also use 1Password and have not seen this behavior, even with real-time protection features turned on. I'm not sure what might be going on in this case.

On the other hand, if you're using Privacy, there is a network filter involved with that. If you are using that, do you have the kill switch feature turned on, or do you have any connection rules active?

[BillHalberstadt]

As originally stated, I am using Malwarebytes for Mac, version 4.15.9, showing as "Free", and with the two real-time protection features showing as "Off". If I click on the "Detection History" panel, there is an "Allow List", where my problem disappears if I enter the 1Password app (or uninstall Malwarebytes).

I certainly expected there to be no network interaction, but my very repeatable evidence shows otherwise. I'll be glad to cooperate with any detailed research.

Bill Halberstadt

[treed]

This simply does not make sense, as Malwarebytes for Mac does not block network connections at all. Only our Mac Privacy app does any kind of network blocks at the current time. Further, many people on the Mac team at Malwarebytes also use 1Password, and we're not seeing this. I just tested, by deleting an entry from 1Password on my Mac, with exactly the same version of Malwarebytes for Mac installed, and saw that it also was deleted from iPassword on my iPhone.

I reviewed your conversation with support, and it looks like there was a misunderstanding. I do not believe the support agent understood what you were asking, and was under the impression that the issue was resolved. However, I can tell you definitively there's no network blocking in Malwarebytes for Mac... it doesn't have a network filtering system extension, which would be required for network blocks on Monterey.

Can you provide more details about exactly how you are able to reproduce this?

[BillHalberstadt]

Two comments:

First, the problem does not occur with the newest release of 1Password (version 8).

But second, it is curious that the free version of Malwarebytes does provide a setting for whitelisting items, on an "Allow List", even though you say nothing is blocked:

 

[treed]

The Allow List is to prevent Malwarebytes from detecting or blocking execution of files on the hard drive. Since Malwarebytes for Mac does not do network blocks, it has no relation to that.

[BillHalberstadt]

Understood. Thanks!