Malwarebytes goes full Anti-Virus

[wraith808]

So, I was praising the fact that Malwarebytes stays in it's lane dealing with certain types of malware, and leaving the more in depth anti-virus functions to others.

Today, I received notice of an upgrade and a requisite e-mail touting the fact that it's going full anti-virus replacement.

https://blog.malwarebytes.com/malwarebytes-news/2016/12/announcing-malwarebytes-3-0-a-next-generation-antivirus-replacement/

I'll have to see where they go from there- most antivirus these days are worse that the problems they purport to solve, which is the reason I stopped using anything other than Malwarebytes and Windows defender.  They're also bloated, and tie up your computer forever, and block things that shouldn't be blocked with false positives, so I'm not optimistic...

[f0dder]

What a shame

[wraith808]

What a shame

And the initial outlook... not good.  I never had a scan last longer than 30-45 minutes before.  Which made it easier to run it anytime.  Made a scan after the upgrade - 5 hours, 23 minutes, and it didn't finish.  Even worse?  I tried to cancel it because it was bogging down my computer, and it asked me if I really wanted to end it.  5 minutes later and it still hasn't aborted.

Very disappointing.

UPDATE: It's the heuristic analysis part that is bogging down the machine, and taking so long, and there's no obvious way to turn that part off.

UPDATE 2: 2 hours later, and it has not responded to my request to stop it, nor cancelled.  Very Disappointing.

[Arizona Hot]

Do tell! I already have it. I am planning to get a more powerful system to avoid these problems.

[4wd]

It doesn't really say it's going full anti-virus, it says you can finally not use a separate anti-virus however it will still work in tandem with a dedicated anti-virus.

It seems to be pointing to the fact that with it's advanced signature-less technologies the use of a signature based AV is no longer necessary.

FWIW, I don't let MBAM do any system scanning at all, (or any previous AV I used except Defender and it only does the Quick scan), because system impact was always too high.
All I ever use is the Real Time Malware Prevention and on-demand file scan, (Website Protection is turned off because, quite frankly, it is a PITA).

It would be nice if I could restrict it to when a file is opened for reading but that option seems to have disappeared from AV/AM products quite awhile ago, (I think Outpost was the last one I used that let me do that).

[wraith808]

That's not what that said to me, but maybe it's in the reading, though the title says "a next-generation antivirus replacement", which seems pretty clear.  But I will say that I've never had problems with it before, and I've always had it scheduled on several machines.  It's never taken a long time, nor has it bogged down my machine.  It is now, very badly, and I can only point to this update.  So no matter what what it means, it's pretty useless to me at this point.

And when I finally killed it in the task manager, my machine stopped for a not insignificant amount of time while it re-started itself.  And in the task manager, it showed it taking 73.4% of my CPU.  Malwarebytes anti-malware?  More like Malwarebytes Malware at this point.

And it seems like I'm not the only one:

The only downside I see is that this uses A LOT more CPU than before, it shoots up to 100% CPU load on an i7 4770K when it would be like around 20% in the background before, is this where the 4x speed increase comes from?

There's a lot more like it in the comments.

[mwb1100]

I got a pop-up saying there was an upgrade. My willingness to be bleeding edge is gone now - so I declined. I have a policy of letting others take the arrows before I dive into new system software (OS, anti-malware, drivers, etc).

More like Malwarebytes Malware at this point.

It seems to me that this kind of thing happens to so many anti-malware tools.

[4wd]

That's not what that said to me, but maybe it's in the reading, ...

It's in the reading, if you ignore the overenthusiastic hype in the heading and first couple of paragraphs:

With the launch of Malwarebytes 3.0, we are confident that you can finally replace your traditional antivirus ...

That says to me that they think their product can now perform the function of an normal AV program.

They then go on to say you can still use your AV program in tandem with it:

But rest assured, we continue to support compatibility if you choose to use a third-party antivirus or other security software alongside Malwarebytes 3.0.

ATM, I'm still running v2 after the debacle of trying to get v3 to install, upgrade, or work.

I can't understand why they wouldn't see that going from signature style virus detection to signature-less would naturally increase the load on system resources.
One can only guess that the only machines they have to test on are all using top tier components.

[Curt]

my version is in Danish, so these are my translations of the User's Interface:

Open Malwarebytes 3 > Settings > Schedule scanning > check Type > click Edit , then in Type of Action change "Normal", to "Defined by User" or Hyper.

Modified:
1) I am not quite sure, because I can't remember this part, but you may have to first delete the job that was already there (instead of editing it), and only then create a new job with your preferred type of action.

2) oh, yeah, Fill "Exclusions" with everything you already trust. Why not?

Malwarebytes 3 is easy to live with, but we have to do the settings, don't we.

[wraith808]

my version is in Danish, so these are my translations of the User's Interface:

Open Malwarebytes 3 > Settings > Schedule scanning > check Type > click Edit , then in Type of Action change "Normal", to "Defined by User" or Hyper.

Modified:
1) I am not quite sure, because I can't remember this part, but you may have to first delete the job that was already there (instead of editing it), and only then create a new job with your preferred type of action.

2) oh, yeah, Fill "Exclusions" with everything you already trust. Why not?

Malwarebytes 3 is easy to live with, but we have to do the settings, don't we.

I've already done what you said.  You see my results above.  First thing I do with any software is to check the settings.  And, as I pointed out, I'm apparently not the only person with the problem.  And the very thing they tout (heuristics) seems to be what is causing the problem.  And I don't see any way in any of the settings to turn it off.

[wraith808]

That's not what that said to me, but maybe it's in the reading, ...

It's in the reading, if you ignore the overenthusiastic hype in the heading and first couple of paragraphs:

With the launch of Malwarebytes 3.0, we are confident that you can finally replace your traditional antivirus ...

That says to me that they think their product can now perform the function of an normal AV program.

They then go on to say you can still use your AV program in tandem with it:

But rest assured, we continue to support compatibility if you choose to use a third-party antivirus or other security software alongside Malwarebytes 3.0.

ATM, I'm still running v2 after the debacle of trying to get v3 to install, upgrade, or work.

I can't understand why they wouldn't see that going from signature style virus detection to signature-less would naturally increase the load on system resources.
One can only guess that the only machines they have to test on are all using top tier components.

I got all of that in the reading.  I just took away something different- if you can replace your AV with it, even if it works with your existing AV (i.e. doesn't conflict, which is good), then it has to have the same functionality, right?

[Curt]

Almost what you want:
Edit planned scanning > Edit > Plan frequency > Once

[wraith808]

Almost what you want:
Edit planned scanning > Edit > Plan frequency > Once

That just makes it so that it only scans once.  I don't see what that has to do with the heuristic scanning.

[cyberdiva]

I don't see what that has to do with the heuristic scanning.

Wraith, I'm very sorry to hear about your horrendous experience with MB3, but I'm most grateful to you for posting about it.  You've saved me from moving to MB3 from MB2.  One very weird thing about your present experience is that apparently it's the heuristic scanning that is taking so long. In MB2, the heuristic scanning occurs at the end of the scan and takes VERY little time, perhaps a minute or so. 

[wraith808]

I don't see what that has to do with the heuristic scanning.

Wraith, I'm very sorry to hear about your horrendous experience with MB3, but I'm most grateful to you for posting about it.  You've saved me from moving to MB3 from MB2.  One very weird thing about your present experience is that apparently it's the heuristic scanning that is taking so long. In MB2, the heuristic scanning occurs at the end of the scan and takes VERY little time, perhaps a minute or so. 

I know!  I was surprised!  It got to the heuristic scanning after about 30 minutes- which on the longer side, but not overly so.  The rest of the time was just that.  I've changed the schedule to once a week in the dead of night on Monday morning.  I'll see how it goes, but not upgrading any of my other machines until I figure this out.

[cyberdiva]

It got to the heuristic scanning after about 30 minutes- which on the longer side, but not overly so.  The rest of the time was just that.  I've changed the schedule to once a week in the dead of night on Monday morning.  I'll see how it goes, but not upgrading any of my other machines until I figure this out.

Actually, ~30 minutes is pretty much what MB2 takes on my desktop computer when the scan includes checking for rootkits (without that, it takes about half as long). So perhaps the problem you're experiencing is something wrong with the heuristic scanning in MB3, rather than something absurdly excessive about the entire scanning process.  Have you reported this on the MBAM Forum?

[wraith808]

It got to the heuristic scanning after about 30 minutes- which on the longer side, but not overly so.  The rest of the time was just that.  I've changed the schedule to once a week in the dead of night on Monday morning.  I'll see how it goes, but not upgrading any of my other machines until I figure this out.

Actually, ~30 minutes is pretty much what MB2 takes on my desktop computer when the scan includes checking for rootkits (without that, it takes about half as long). So perhaps the problem you're experiencing is something wrong with the heuristic scanning in MB3, rather than something absurdly excessive about the entire scanning process.  Have you reported this on the MBAM Forum?

No, just looked through the other people's threads that had the same problem.  If they didn't get a solution, didn't look very worth it - I don't frequent many forums, and try to keep it that way.  Might try a support ticket.