Excluding Malwarebytes from scans

[Lateral]

Hi guys

I'm running Windows XP, Avast Internet Security (latest version of everything) and Malwarebytes.

Avast is detecting MBAM as a threat during scans.

Can somebody please tell me how to exclude it?

Thanks
Regards
Greg

[Lisandro]

Settings > Exclusions
Add the MBAM folder with *
C:\<pathtoMBAM>\*

[iroc9555]

You can also follow this guide. It is for Avast! 6 but it also works for Avast! 7 and latest MBAM.

Look for section K:

http://forums.malwarebytes.org/index.php?showtopic=10138&st=0&p=417798&#entry417798

[Lateral]

Thanks guys

[DavidR]

The question is also what type of scan (quick; full; or custom scan with memory selected, etc. ?) and what is the information on the detection ?

Reason why if the detection is in memory these exclusions won't make any difference.

I have MBAM Pro on both my win7 and XP Pro systems and no exclusions for it with no problem. I only have the c:\windows\temp\_avast_ folder added to the MBAM Ignore List.

[Lateral]

Hi David,

The Avast Memory Scan is picking up the mbamservice,exe service and showing multiple viruses.

I have attached a screenshot of the scan results.

Thanks again for your help.

Regards
Greg

[CraigB]

It has been mentioned many times before that choosing scan memory in custom scans is really pointless as if any infection is found in memory then it's already to late, you will constantly recieve these false positives to do with other security application malware signitures on your system so i suggest that you remove the scan memory option from your custom scans or just use the default full scans.

[Lateral]

Thanks Craigb

[CraigB]

Thanks Craigb

NP's

[DavidR]

<snip>
The Avast Memory Scan is picking up the mbamservice,exe service and showing multiple viruses.

I have attached a screenshot of the scan results.

Thanks again for your help.
<snip>

I though that would be the case (so the exclusions wouldn't have made any difference in this instance), as it isn't actually detecting MBAM as the mbamservice,exe is the process responsible (not infected) responsible for loading unencrypted signatures into memory and it is these unencrypted virus signatures which are detected.

Personally an avast! Quick scan (on default settings) is more than adequate as that will be looking at the areas/files most at risk of infection.

- With a resident on-access antivirus like avast, the need for frequent on-demand scans is much depreciated. For the most part the on-demand scan is going to be scanning files that would be otherwise be dormant or inert. If they were active files then the on-access file system shield would be scanning them before being created, modified, opened or executed.

I have avast set to do a scheduled weekly Quick scan, set at a time and day that I know the computer will be on. If for some reason my system wasn't on, no big deal I will catch up on the next scheduled scan.

[Lateral]

Thanks Guys!

I really appreciate the help..

Can you perhaps look at my other post regarding another issue I have?

http://forum.avast.com/index.php?topic=97980.0

Thanks again
Regards
Greg

[DavidR]

You're welcome.

[kodl]

........."choosing scan memory in custom scans is really pointless". Why in the hell you designed Avast with pointless feature?

[Lisandro]

........."choosing scan memory in custom scans is really pointless". Why in the hell you designed Avast with pointless feature?

Because when the virus is on memory it's too late... on demand scanning of memory is too late.
Memory should be scanned by avast resident (on access).

[DavidR]

........."choosing scan memory in custom scans is really pointless". Why in the hell you designed Avast with pointless feature?

Avast and most other AVs and security programs have scanned memory for donkeys years, it is historic and I think no one likes to remove it because of this historic nature of it.

But the memory scan incorporated into the Quick and Full System scan isn't at such a deep/thorough level as the memory scan done in a custom scan and it is this that can detect other security software's unencrypted virus signatures loaded into memory (because that is what the user has asked it to do).