Windows 10: Introducing the Malwarebytes Anti-Ransomware Beta

It was causing problems so I uninstalled it. I had to reinstall Office 365 and Pale Moon because of false positives. I still need to check to see if all my programs will run.

 

Since the beta 3 the only false positive I'm getting is WinDirStat. Office 2012 and 2016 both work OK (I only use Word and Excel though). PaleMoon portable works but I've not tried the installed version as I don't use it.

I've got it installed on 10586 (x64) and 14257 (x86) and it is much more usable than a week ago.

 

I also removed it - due to False exe Blocking...

 

So far no problems with it. Guess I'm lucky.

 

Beta 4 released last night.

Download link (beta4 - build 0.9.12.336)
https://malwarebytes...mzam93089m85bfb

Need to download as it won't auto-update.

Jim *Cool

 

Thanks for that. It has fixed WinDirStat so I'm not getting any false positives any more (that I've found anyway *Wink )

 

I'll wait until for a few more releases. I saw the warning about office being ransomware. After that I couldn't open it. When I tried to run Pale Moon I got a message about the program not being found. When I checked the Pale Moon folder the .exe file was missing. I haven't checked all my programs yet to see if any more have been deleted.

 

Thx Beta 4 now installed.

 

How many security software programs is MalwareBytes going to release?

I find that doing frequent backups is the best way to deal with malware, but even here I find that attackers can do things that make restore difficult.

 

Regular backups is definitely one of the best thing we can do. After the backup is made it needs to be kept off the computer so it can't get infected. If my computer ever gets infected I'm going to use a Linux boot disk to completely wipe my drive then do my restore.

 

Does ransomware encrypt macrium reflect images?
I do my daily system image backups onto a second internal hard drive, and only seldomly do a system image backup onto an external hard drive.

Another question: what's going to happen to my dropbox and onedrive files if I get hit by ransomware? Will the encrypted version of my files get synced to the cloud? If so, what's the best way to recover? It's pretty hard to restore a previous version manually on thousands of individual files.

 

Hi there

Malwarebytes like most consumer grade AV programs have passed their sell by date - not needed and is an irrelevance nw.

Unless the database is updated daily how in the world does Malwarebytes distinguish between a legitimate windows program for example PHOTOSHOP.EXE and say a PUP called FOTKINO.EXE. Both programs legitimate windows programs - neither makes any specific dangerous kernel calls / uses any windows loopholes say memory leaks etc . All the PUP does is say call an internet service which in any case you can block with Windows firewall / your router - Photoshop also calls an internet service to check on licence / activation status.

I can't see how malwarebytes is of any use whatsoever in these situations.

I'd be interested in seeing if Malwarebytes actually in PRACTICE on typical users machines detects anything serious that Windows defender has missed.

For the test you need a typical users machine under normal user conditions and not a lab setup with specifically written viruses.!!

As far as ransomware is concerned - a decent restore from a backup will fix this - typically these days on modern machines a Macrium restore takes probably 15 mins at the most - and even less if you've got SSD's.

Ransomware probably comes usually from people opening emails with dubious attachments -How many times have people been warned NEVER EVER do that.

Again if the Ransomware manifests itself as a legitimate windows executable unless the database specifically names the program there isn't a hope that Malwarebytes (or most other AV stuff) will catch it. Even if the specific executable name exists in database the program might be called something else.

You can only basically make a partial attempt (not 100% effective anyway by comparing the entire executable with a copy of it stored in the AV database and if say there is an over 90% correlation between the two then refuse to run it. This would significantly increase the size of the database and definitely slow your machine down by a significant amount. Also the Ransomware writers would immediately change the code etc so until the next DB update the ransomware would get through.

I mean don't people have BRAINS on these Forums any more - If I were writing Ransomware or other Malware I'd have a few machines equipped with these products (The AV one's) so my nasties could avoid detection anyway. Just one successful scam would more than pay for extra hardware needed to write these nasties -- and if there's a lot of money to be made you can be sure Organised crime will be involved often with considerable resources too.

Cheers
jimbo

 

Malwarebytes is not an AV program, it is anti-Malware, and recently it was the only system that found and removed a potential attack on this forum, Admins, and SuperMods here use the Pro version in addition to the server based tools - the potential attack went through the in-built defender like an open window - Malwarebytes is not updated daily, but more like hourly.

The other thing with ransomware is that the modern versions lock the backup programs and the backups so a lot of users cannot use the system they have installed

 

Hi there.

I'm talking about HOME computers - SERVERS and CORPORATE computers / networks require a different order of magnitude of protection and they face very different threats. For starters - these are connected probably 100% to the internet so they can get hourly updates etc - a lot of home computers aren't connected 24/7 to the Internet. Home computers don't usually have 100's or even several thousands of totally different types of users. Home computers are generally single user machines.

If the Ransomware locks the machine it doesn't matter as I assume you'd do the restore from a bootable stand alone (bare metal version of the restore program) - so job done.

Data can also be recovered if you have decent backups too. A lot of people store data on the cloud and elsewhere. Regular backups should always kill any Ransomware.

Cheers
jimbo

 

The potential attack on this forum was one where the target was the users not the servers, (a bad link in a post), we thoroughly tested using a a variety of user systems, (after we'd isolated the threat to ensure that no user was compromised *Wink ), Anti-Virus suites never even saw the attack nor did any of Microsoft's in-built software, malwarebytes Pro flagged the post as malicious without even having to click the link