What is scanned when you use the Context Menu Scan

[DreamRyder]

G'Day,

I'm a new kid on this block---I just downloaded,installed, & updated MBAM. I Uninstalled my AVG freebie stuff to disable any potential software conflicts from surfacing. I think I have also set up all the options properly.

I've searched until I turned blue (didn't like the colour---sorry blues), but couldn't find an answer to what I need to know.

This is the question:

Does MBAM scan way down inside zip, rar, etc....etc.... compressed files? when the compressed file (in my case a .rar) is scanned via the right-click context menu in Windows Explorer?

The reason I ask is simply that I downloaded a .rar file. Within the .rar file were a few folders. Within 2 of these folders were some compressed files...some .rar & some .zip. I decided to right-click the master .rar file and selected to scan it with MBAM. It came back as clean as a whistle. Great,,,,I thought.

Well, I learned a long while back to follow this quote "Trust, but verify". So, I opened each compressed file & did a right-click scan on each file extracted from it. I was both shocked & pleased at the same time.

Shocked that there were a few nasties within the compressed files & that MBAM failed to find them when I scanned the master .rar.

Pleased that I didn't trust MBAM & decided to verify each & every extracted file (not a rip on MBAM---it eventually did find the nasties, just needed my help a bit) as I would do with any new product I hadn't completely tested to the point of trust yet.

So, what's the answer to my question?? Does MBAM scan way down inside zip, rar, etc....etc.... compressed files?

I certainly hope it's just a matter of an option I overlooked or misread. I would find it very hard to believe that MBAM doesn't scan deep into compressed layers (to date every decent AV program I've used did).

Thanks,,,,,Bobby

Oh, PS.......Does it scan incoming mail?

[exile360]

Greetings and welcome DreamRyder. I don't believe MBAM scans inside .rar and .zip files, but even if the malware you have were decompressed into the folder MBAM would probably still not detect it. The reason is because it's not a regular file scanner like antivirus software. It detects threats based on where they would be were they actually infecting a system. So if you had a trojan .dll for example and it would normally reside in System32 on an infected system, then it should only be detected by MBAM if it's actually in the System32 folder. It also uses detection algorithms based on coinciding registry entries related to the infection so scanning a folder of inactive malicious files typically yields little to no results with MBAM, but doing a quick scan with MBAM on a system where the infections are active would find the infections (as long as they're in MBAM's database) no problem.