Malwarebytes' Anti-Malware

Malwarebytes' Anti-Malware is a next-generation anti-malware program that can quickly detect, destroy, and block malicious software. Malwarebytes' Anti-Malware can detect and remove malware that even many of the most well-known anti-virus and anti-malware applications on the market today cannot.

The PRO version of Malwarebytes' Anti-Malware monitors every process and stops malicious processes before they even start. The scanner and realtime Protection Module both use our advanced heuristic scanning technology to keep your system safe and secure against even the latest malware threats.


System Requirements

The following requirements are necessary to run Malwarebytes' Anti-Malware:

  • Microsoft® Internet Explorer 5.5 or higher.
  • Microsoft® Windows 2000 Service Pack 4 or higher.
  • 500MHZ processor.
  • 256 MB of RAM.
  • 15 MB free disk space.


Key Features

Malwarebytes' Anti-Malware is an anti-malware application with the following features:

  • Support for Windows 2000, XP, Vista, and 7 (32-bit and 64-bit).
  • Light speed quick scanning.
  • Ability to perform full scans for all drives.
  • Database updates released daily to protect against the newest malware in-the-wild.
  • Intelligent heuristics detect even the most persistent malware while remaining light on system resources.
  • Realtime Protection Module monitors filesystem and Internet traffic. (PRO version only)
  • Scheduler to keep protection up-to-date automatically (PRO version only)
  • Quarantine to hold threats and restore them at your convenience.
  • Ignore List for both the scanner and Protection Module.
  • A small list of extra utilities to help remove malware manually.
  • Multi-lingual support.
  • Works together with other anti-virus utilities.
  • Context menu integration to scan files on demand.

Plus many more!


Features and Functions: Registering

Registering Malwarebytes' Anti-Malware

A registered version of Malwarebytes' Anti-Malware will display partial licensing information. An unregistered version will show a "Purchase" button and a "Register" button near the bottom of the product.

To register and unlock the PRO features successfully:

  1. Locate the ID and Key from your order confirmation email.
  2. Click on the "Register" button.
  3. Copy and paste the product ID and Key into the text fields.
  4. Click on the "Register" button under the text fields.

Available check boxes:

  • Enable protection module: This option will enable the realtime Protection Module immediately upon successful registration.
  • Keep protection up-to-date automatically: This option will automatically create a daily update entry in the Scheduler to keep protection up-to-date upon successful registration.

You will receive a visual confirmation upon a successful registration as seen below.


Features and Functions

Using Malwarebytes' Anti-Malware is a breeze! The interface is neatly divided into tabs to help you move through it quickly and efficiently. Click below for a brief description of each tab.


Features and Functions: Scanner

Scanner

The scanner tab allows you to run a quick, full, or flash scan. This will reveal any known malware on your system.

  • Quick Scan: Scans all system locations where malware is known to install itself. This is the scan type recommended by Malwarebytes.
  • Full Scan: Scans every file on the drives you select in addition to all of the areas checked by the quick scan.
  • Flash Scan: Scans system memory and startup locations for active infections. It also checks key locations using heuristics. (PRO version only)


Features and Functions: Protection

Protection

In the unregistered version of Malwarebytes' Anti-Malware, the protection tab shows a comparison of the two versions, highlighting the added features available in the PRO Version. Clicking Purchase or the comparison image takes the user to the Malwarebytes' Anti-Malware online store.

In the registered version of Malwarebytes' Anti-Malware, the protection tab displays various options now available to protect the system from malicious threats, utilizing the advanced protection module along with the scheduler.

  • Enable Protection module: Realtime protection (tray icon, Website Protection, and malware execution protection) is enabled. Once checked, this option is greyed out and cannot be unchecked. Protection may be disabled by right clicking the tray icon and selecting Exit.
  • Start protection module with Windows: This option will start the Protection Module during system startup and place a tray icon in the system tray.
  • Start file execution blocking when protection module starts: This option detects and blocks malicious processes and prompts the user to take action upon detection.
  • Start malicious website blocking when protection module starts: This option blocks access to known malicious websites.
  • Show tooltip balloon when malicious website it blocked: This option will generate a tray icon notification whenever a malicious IP address is blocked. Details such as the application name, the connection type as well as the port number are shown on Windows Vista and higher operating systems.

  • Scheduler: Allows the user to schedule scans and updates to fit individual needs. An optional predefined update is included during registration. See the Scheduler section for details.

The protection tab also displays the current status of the protection module. If the tray, which controls and enables all components of the protection module is disabled, the following is shown.


Features and Functions: Updates

Updates

The update tab allows the program and database to be updated with a single click on the "Check for Updates" button. This tab contains current database information for Malwarebytes' Anti-Malware. It also displays the latest news from Malwarebytes. It is recommended that all free users check weekly for updates using this tab, and all PRO users utilize the scheduler to keep Malwarebytes' Anti-Malware updated automatically.


Features and Functions: Quarantine

Quarantine

The quarantine tab holds all potential threats found on the system. It provides the user the option to delete these items and also the flexibility to restore a legitimate item from the quarantine. If you are unsure about a particular threat, be sure to do a search on the Internet for more information or visit our online community to learn more about it.

  • Delete: To delete a single quarantined item permanently, select (by clicking) the item from the list, then click the "Delete" button.
  • Delete All: To delete all quarantined items permanently, click the "Delete All" button.
  • Restore: To restore an item from the quarantine, click the "Restore" button.
  • Restore All: To restore all items from the quarantine, click the "Restore All" button.


Features and Functions: Logs

Logs

The logs tab allows you to manage your saved log files. To view a specific log file, select it from the list and click "Open" to view its contents. These logs are named based on the date and time. They contain valuable information such as the actions taken by Malwarebytes' Anti-Malware when a scan is finished. It is recommended that you keep at least a month worth of logs for record keeping before deleting them off of the computer.

  • Open: To view a log file, select (by clicking) a log file from the list and click the "Open" button.
  • Delete: To delete a log file, select (by clicking) a log file from the list and click the "Delete" button.
  • Delete All: To delete all log files, click the "Delete All" button.


Features and Functions: Ignore List

Ignore List

The ignore list tab allows you to manage a list of items which both the scanner and protection module will exclude from scanning and detection. Programs such as other security products are usually recommended to add as you want both applications to complement each field of specialty and provide the added layer of protection without encountering conflicts and performance issues.

  • Add: To set the exclusion manually from being scanned both by the scanner and the protection module in the PRO version, click on the "Add" button and use the browse window to locate the file or folder that you want to exclude from being scanned. This option is useful for resolving performance conflicts with other security software, such as your resident antivirus program. Simply add the program folders of your security software to the Ignore List.
  • Delete: To remove a single item (file/folder/IP address) from the Ignore list, such as a file or folder, select (by clicking) the on the item listed and click "Delete".
  • Delete All: To remove all items from the Ignore list immediately, click "Delete All".

    • Addressing possible threats from Scanned Result:

    1. Upon a scan completion, Malwarebytes' Anti-Malware will indicate that there are infected objects.
    2. Click "Show Results" in the main Malwarebytes' Anti-Malware window.
    3. The Scanner tab will open showing infected items.
    4. Select only the item(s) Malwarebytes' Anti-Malware should not consider as a risk, click "Ignore" to allow.
    5. Click "Remove Selected" to remove the threats remaining in the list.
    6. If there are no additional threats left, Malwarebytes' Anti-Malware will display a message stating that there are no threats left to remove. Click "OK" to continue.

    Accessing a Blocked Website: In order to bypass and access a potentially malicious website which has been blocked by Malwarebytes' Anti-Malware, perform the following step.

    1. Navigate the web browser to the blocked website or IP address again.
    2. A balloon tip notification will pop up from the task tray indicating that access to the website has been blocked.
    3. Right-click on the Malwarebytes' Anti-Malware tray icon, hover the mouse pointer over to "Add to Ignore List". Left-click on the IP address number that you want to add to the ignore list.

    Security Risk: Once an IP address is added to the Ignore List, any website that uses that IP address will be able to bypass Malwarebytes' Anti-Malware.


Features and Functions: Settings

 Malwarebytes

Settings

The settings tab allows you to configure Malwarebytes' Anti-Malware to work just how you want it. These additional options are categorized in three sections: General Settings, Scanner Settings, and Updater Settings.

General Settings

  • Terminate Internet Explorer During Threat Removal (unchecked by default): Enabling this option allows Malwarebytes' Anti-Malware to terminate Internet Explorer browser automatically before removing detected threats resided within the Temporary Internet Files folder. If this setting is not enabled, a reboot may be required to complete the threat removal process of these types of infections.
  • Anonymously Report Usage Statistics: The option will automatically collect statistical information on malware threats detected on the system and reports to our threat research center. No personally identifiable or personal information is collected. Statistics can be viewed at: http://www.malwarebytes.org/malwarenet.php.
  • Create Right Click Context Menu: A Scan with Malwarebytes' Anti-Malware option is now available when a file or folder is right-clicked, enabling users to quickly scan an individual file/folder.
  • Automatcially Save Log File After Scan Completes: This option automatically create a saved log file each time a scan is performed.
  • Open Log File Immediuately After Saving: This option will automatically open the log file after a scan is completed.
  • Warn If Database Is Outdated By: This option will provide a pop-up notification indicating a database has elapsed the pre-determined number of days without an update.
  • Language: This drop-down menu allows the user to select the preferred language used by Malwarebytes' Anti-Malware.
Scanner Settings

  • Scan Memory Objects: This scanning option will include a scan of all processes running in memory when a scan is performed to check for actively running infections.
  • Scan StartUp Objects: This scanning option will include a scan of the Windows registry to check for installed threats and malicious alterations of certain Windows settings.
  • Scan Registry Objects: This scanning option will scan files and folders on the system to check for infected files. The number of files and folders scanned and their location varies depending on the type of scan.
  • Scan Filesystem Objects: This scanning option will perform a check of key files, folders and registry locations against our very powerful heuristics database to look for infections not found by the other parts of the scan
  • Scan Additional Items Against Heuristics: This option enables our latest heuristics detection engine to perform a more advanced analysis of the system for new threats not in our detection database, possibly finding threats the other parts of the scan cannot yet find.
  • Enable Advanced Heuristics Engine (Heuristics Shuriken): This option is enabled by default, allowing Advanced Heuristics Engine to add another layer of protection to detect new and unknown malware.
  • Action for Potentially Unwanted Programs (PUP): This option detects known, non-malicious software which may causes undesirable performance or issues for the computer.
  • Action for Potentially Unwanted Modifications (PUM): This option identifies system setting modifications which may have an adverse effect or direct impact of available functionality or resources of the system.
  • Action for Peer-To-Peer Software (P2P): This option detects file sharing software installed on the system.

    • Available actions and definition for the above 3 settings:

    • Do not show in results list: Items of this type will not be detected or shown in the scanned results list.
    • Show in results list and check for removal: Items of this type will be detected, shown in the results list and marked for removal.
    • Show in results list and do not check for removal: The detected item is shown in the scan results list but will not be selected for removal. Each item must be checked manually for removal.
Updater Settings

  • Download and Install Program Update if available: When this box is checked, new program and database update will be automatically downloaded and installed.
  • Use Proxy Server To Download Updates: When this option is checked, the user may set proxy server settings so that Malwarebytes' Anti-Malware will be able to update via the internet proxy connection. Server address and the port number is required for a successful proxy connection.
  • Use Authentication: When this option is checked, it allows the user to enter the authentication information, working in conjunction with the "Use Proxy Server To Download Updates" option.


Features and Functions: More Tools

More Tools

The more tools tab is where you find other useful tools that we have included with Malwarebytes' Anti-Malware.

FileASSASSIN is a powerful application that can delete any type of locked files that are located in the computer. The program uses advanced programming techniques to unload modules, close remote handles, and terminate processes to remove the particular locked file. It is capable of removing one file at a time, and it cannot delete registry entries or folders. Please use with caution as deleting critical system files may cause system errors.


Features and Functions: About

About

The about tab has the basic information and disclaimer regarding Malwarebytes' Anti-Malware. To learn more about Malwarebytes, click on www.malwarebytes.org button and it will launch your web browser to go to our website. Click on the Help button will open this help file.


Error Codes

This document explains some common Malwarebytes' Anti-Malware error codes. If the error is not listed, please contact us for a potential solution.

PROGRAM_ERROR_COMMAND_LINE
The command line parameters were either invalid or formatted incorrectly. Please verify the command line parameters were correct.

PROGRAM_ERROR_EXPANDING_VARIABLES
Please contact support for any known solutions.

PROGRAM_ERROR_MISSING_FILE
A file necessary to run this application is missing. Please reinstall the application.

PROGRAM_ERROR_NO_ITEMS_SELECTED
There were no items selected. Please ensure at least one item was selected.

PROGRAM_ERROR_INVALID_PROXY_PARAMETERS
The proxy information provided was incorrect. Please ensure the details are correct.

PROGRAM_ERROR_ENUMERATE_LANGUAGES
There was an error enumerating the language files. Please make sure at least one language file exists. Additionally, try reinstalling the application.

PROGRAM_ERROR_SCHEDULER_ADD
There was an error adding the scheduled task. Please ensure the details are correct.

PROGRAM_ERROR_SCHEDULER_REMOVE
There was an error removing the scheduled task. Please ensure the details are correct.

PROGRAM_ERROR_NOT_REGISTERED
You are attempting to use a feature that requires registration. Please register the product.

PROGRAM_ERROR_OS_NOT_SUPPORTED
The operating system is not supported. This application only runs on Windows 2000 and higher.

PROGRAM_ERROR_MEMORY_SCAN
An error occurred during the memory scan. Please try running the application in safe mode.

PROGRAM_ERROR_FILE_SCAN
An error occurred during the file scan. Please try running the application in safe mode.

PROGRAM_ERROR_CHECK_INFECTED
An error occurred while checking if a file was infected. Please try running the application in safe mode.

PROGRAM_ERROR_LOAD_DATABASE
An error occurred while loading the current database. Please reinstall the application.

PROGRAM_ERROR_LOAD_LOGS_LIST
An error occurred while loading the log files list. Please try restarting the application.

PROGRAM_ERROR_LOAD_QUARANTINE
An error occurred while loading the quarantine. Please try restarting the application.

PROGRAM_ERROR_LOAD_LANGUAGE
An error occurred while loading the current language. Try reinstalling the application.

PROGRAM_ERROR_LOAD_MD5
An error occurred while loading the MD5 generator. Please run Windows update.

PROGRAM_ERROR_UPDATING
An error occurred while updating the database or application. Please try again later.

PROGRAM_ERROR_ADD_TO_RESULTS
An error occurred while adding an item to the results list. Please try running the application in safe mode.

If you are unable to resolve your issue using the above documentation, please do not hesitate to contact us.


False Positives

Every anti-malware program will eventually produce a false positive detection. A false positive occurs when an anti-malware product detects a file as malicious when in fact, it is legitimate. Malwarebytes' Anti-Malware is not a perfect product and we try our best to prevent these false positives. In the event of a false positive, please proceed with the following before contacting us.

  1. Use a search engine to verify that others do not think the item is malicious.
  2. Once you are sure that Malwarebytes' Anti-Malware has detected a false positive with a legitimate application, it is time to let us know.
  3. Start Malwarebytes' Anti-Malware using the /developer command line. This is a crucial step as it will generate a developer's log where the false positive has occurred.
  4. Contact us and be sure to include a copy of this developer's log. It is crucial that we receive this log in order to analyze and resolve the issue quickly.


Command Line Parameters

Malwarebytes' Anti-Malware supports a variety of command line parameters, which can be used from either a command prompt, batch file or script. (Note: some of these parameters are available in the PRO version only.)

mbam.exe <parameters>

(where parameters is one or more of the following)

  • /errorsilent: suppresses all critical errors and writes the last error to <root-drive>\mbam-error.txt where <root-drive> is the hard drive where Windows is installed, also known as the System Drive.

    Example:

    mbam.exe /errorsilent will suppress all errors when the program is running.
  • /proxy <required server> <optional port> <optional username> <optional password>: allows the user to update through a proxy server. Leave blank to remove any proxy settings previously set.

    Examples:
    • mbam.exe /proxy will remove the proxy settings.
    • mbam.exe /proxy proxy.com 80 will use proxy.com on port 80 with no credentials.
    • mbam.exe /proxy proxy.com 80 admin password will use proxy.com with the specified credentials.
  • /logtofolder <optional path>: allows the user to save all log files to the specified folder. If this folder does not exist, Malwarebytes' Anti-Malware attempts to create it. If the path is blank, changes are reverted to default settings. These logs do not show up on the Logs tab.

    Example:

    mbam.exe /logtofolder C:\mbam_log_files will save all future log files to the location C:\mbam_log_files.

    Note: Protection logs created by the protection module will always be saved to the same location
  • /logtofile <optional path>: allows the user to save all log files to the specified file. If this file does not exist, Malwarebytes' Anti-Malware attempts to create it. Newest entries are appended to top of the file. If the path is blank, changes are reverted to default settings. This log does not show up on the Logs tab.

    Example:

    mbam.exe /logtofile C:\mbam_log_files\mbam-log.txt will save all future log files to the location C:\mbam_log_files\mbam-log.txt.

    Limitations: The path, in the above case C:\mbam_log_files, must exist. This option will not create folders if they don’t exist, only the log file.

    Note: Protection logs created by the protection module will always be saved to the same location
  • /debug <optional -silent>: allows the user to collect information to send as a bug report.

    Examples:
    • mbam.exe /debug will bring up a prompt to save the debug file.
    • mbam.exe /debug -silent will save debug file silently to <root-drive>\mbam-info.txt where <root-drive> is the hard drive where Windows is installed, also known as the System Drive.
  • /register: allows the user to register the program without displaying the main dialog box.

    Examples:

    mbam.exe /register 12345-67890 AAAA-BBBB-CCCC-DDDD will register the product using the license key passed in the parameters.

    Limitations: Protection must be enabled using the program user interface if it is to be enabled before the system restarts.
  • /developer: this command line parameter is used to execute the program in developer mode and will create a log with encrypted information on items detected in a scan. It is used for reporting false positives and allows the researchers to determine why an item is being detected. Example: mbam.exe /developer will start the program with detailed detection information.

    Note: When reporting a false positive, please be sure to use the /developer switch and provide the resulting log to the researchers.
  • /update <optional -silent>: allows the user to update the product and database.

    Examples:
    • mbam.exe /update will attempt to update the database or program, depending on settings.
    • mbam.exe /update -silent will attempt to update the database or program silently.
  • /scan <optional -quick or -full or -flash> <optional -silent> <optional -remove> < optional -terminate> <optional -reboot> <optional -log>: initiates a scan with the selected options.

    Parameters:
    • -quick: initiates a quick scan.
    • -full: initiates a full scan using saved drives in the registry.
    • -flash: initiates a flash scan of memory and heuristics only.
    • -terminate: closes the program after a scan completes and no threats were found (cannot be used with -silent). If an item is detected, the program remains open so that the user can decide whether or not to remove the detected threat(s).
    • -log: overrides the save log checkmark on the settings tab. If the Automatically save log after scan completes option is unchecked, a log file will still be saved when the –log parameter is used.
    • -silent: hides the GUI while scanning (does not need to be used with –terminate).
    • -reboot: reboots the computer if necessary, only valid if -silent is used.
    • -remove: automatically removes threats and saves a log file. Unless -silent is specified, GUI stays open.
    Examples:
    • mbam.exe /scan will run a default scan.
    • mbam.exe /scan -full will run a full scan.
    • mbam.exe /scan -flash -terminate will run a flash scan and terminate if no objects are detected.
    • mbam.exe /scan -quick -log -silent -remove -reboot will run a quick scan silently, save logs, automatically remove threats, and reboot if necessary.
    Limitations:
    • -terminate parameter cannot be used with the -silent parameter since the program will automatically terminate when the -silent parameter is used.
    • -reboot parameter is only valid if used with the -silent parameter.
  • /schedule <optional /update or /scan -quick or /scan -full or /scan –flash> <optional /realtime or /hourly or /daily or /weekly or /monthly or /once or /onreboot>: these items allow the user to choose the frequency for the scheduled update or scan to occur:
    • <optional /starting mm/dd/yyyy hh:mm:ss>: this item allows the user to set the time for the scheduled scan or update to start.
    • For /realtime omit this - the current time is assumed.
    • For /random - this item selects a random time to set the scheduled scan or update to occur. /random may only be used with /hourly or /daily and randomizes the Hour and Minute or Hour and Minute and Second respectively
    • <optional /every X where X is a number for the frequency of the scan or update to occur> <optional /recover X where X is the number of hours for the scan or update to attempt to run again if the computer was unavailable during the scheduled time>
    • <optional /wakefromsleep>: may be used with a scan or an update. Malwarebytes' Anti-Malware will attempt to wake the computer from sleep to perform the scheduled scan or update.

      Limitations: Not supported with /onreboot for scans or /realtime or /onreboot for updates.
    • <optional /flash executes a Flash Scan after a successful update

      Note: only used with /update>
    Examples:
    • /schedule /scan -quick -remove -terminate -log /daily /starting 08/10/2010 23:00:00 /every 1 /silent /wakefromsleep will schedule silent daily Quick Scan starting on August 10th, 2010 at 11:00PM that will repeat every 1 day, remove threats, reboot if necessary, force the creation of a scan log and will attempt to wake the computer from sleep to perform the scan.
    • /schedule /update /flash /realtime /every 5 will schedule an update to occur in real-time once every 5 minutes and set a Flash Scan to occur after each successful update.
  • /unschedule <optional /all or /all –update or /all –scan>.
    Note: You can remove individual scans or updates by not including the /all switch and specifying the exact switches used to create the scan or update
    • /all removes all scheduled scans and updates.
    • /all –update removes all scheduled updates.
    • /all –scan removes all scheduled scans.
    Examples:
    • /unschedule /scan -quick -remove -terminate -log /daily /starting 08/10/2010 23:00:00 /every 1 /silent will delete a scheduled silent daily Quick Scan that was set to start on August 10th, 2010 at 11:00PM that was set to repeat every 1 day, remove threats, reboot if necessary, and force the creation of a scan log.
    • /unschedule /update /flash /realtime /every 5 will delete a scheduled update that was to occur in real-time once every 5 minutes and with a Flash Scan set to occur after each successful update.


Contact Malwarebytes

In the event you would like to contact Malwarebytes, please use the following information to help us direct your request to the appropriate department for faster responses and services.

Support Helpdesk: Click to contact our support team

Community Forum: Click to visit our community forum