Running Multiple AV programs: Do they run in series or parallel

[AXG1]

Suppose I'm running multiple AV programs in my Systray. For example Malware-bytes and McAfee. In this case, we're not scanning a disk. Instead we are scanning a data stream...

I'm assuming an AV program acts like a data conduit with a filter in it, in other words, data enters the program through one port and exits through another, where it is then accessed by an application, such as a browser. Bad things are mostly filtered out, but once in a while something gets through, hence the "need" to have several AV programs running at once.

What happens when you run two or more of them? Do they (a) connect end to end, where the output of one AV program is input to the next AV program and re-filtered? Or do they (b) run in parallel - where both take data from the same source and provide two outputs, only one of which is connected to an application at a time, or both are multiplexed or each is selected at random?

Obviously (a) is preferable to (b), but what really happens, does anyone know how this works?

[DarkSnakeKobra]

Hi AXG1

First Malwarebytes' is not an anti-virus. It is anti-malware and is designed to catch everything your anti-virus misses. Second you should never run two av's at once in real-time. If both av's detect the same thing there will be major problems unlike two anti-spyware's. If you do have two running at the same time leave one on and all others off. Also what av's do you have?

[AXG1]

Sorry, I did not mean to create a distraction by using improper semantics. I tend to lump them together in my mind as "AV" programs. What I mean is any two programs that filter incoming data and filter out bad things that will mess up your computer (e.g. spyware, malware, virus, adware, rootkits, etc...).

I am interested in how they interact together. For example, I am running McAfee (Security Center, AntiVirus and Firewall) and will some day be running Malware-bytes at the same time, as soon as I can get it to work (but that's a different thread).

Do they pipe data from one program into the other, or do they interact in some other way?

[Firefox]

Malwarebytes is designed to run together with your antivirus software. Some antivirus software tends to conflict with malwarebytes on some computers so we have a list of files that you can configure you AV to exclude and this solves this issue. These instructions are listed below:

Please exclude the following files from your antivirus:

Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude them from it as well

For Windows XP:

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

For 32 bit versions Windows Vista or Windows 7:

• C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\System32\drivers\mbamswissarmy.sys
  

For 64 bit versions of Windows Vista or Windows 7:

• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
  
• C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
  
• C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
  
• C:\Windows\System32\drivers\mbam.sys
  
• C:\Windows\SysWoW64\drivers\mbamswissarmy.sys
  

Please post back and let us know how it went.

[exile360]

MBAM's realtime protection does not scan files on access or as they are downloaded, thus avoiding slowdowns and conflicts with antivirus software running in realtime. It checks process on execution in memory, long after your AV would've already scanned it so if MBAM detects it, it's only able to do so because your AV missed it .

[AXG1]

@exile360: Thanks. That answered my question.

@firefox: I'm working that issue on another thread, no need to repeat it here. Please feel free to visit the bottom of that thread and contribute. I'd appreciate any help you can give me.