Malwarebytes essential

Проверка системы в Malwarebytes Anti-Malware

Во вкладке «Проверка», вы можете выбрать вид сканирования: «Полная проверка», «Выборочная проверка», «Быстрая проверка» (в платной версии). Для запуска проверки, после выбора способа проверки, нажмите на кнопку «Начать проверку».

После этого начнется процесс сканирования вашего компьютера на наличие вредоносных программ. Проверка компьютера идет в определенном порядке, по очереди проверяются различные разделы операционной системы, происходит проверка установленных на компьютере приложений.

При помощи кнопок «Пауза» и «Отменить», вы можете приостановить проверку компьютера, или совсем отменить проверку системы на вирусы.

После завершения проверки, вы получите сообщение о результате сканирования. Если программа Malwarebytes Anti-Malware что-то обнаружила на вашем компьютере, то вы увидите сообщение об этом в области уведомлений.

В главном окне программы будет отображена информация о найденных объектах.

Вы можете сохранить результаты проверки в буфер обмена, текстовой, или XML файл, при помощи ссылки «Сохранить результаты».

Внимательно ознакомьтесь с обнаруженными угрозами. Например, не все найденные в Malwarebytes Anti-Malware нежелательные программы, на самом деле, являются нежелательными на вашем компьютере. Это могут быть обычные программы, которые вы установили на свой компьютер. Поэтому, снимите флажки с тех пунктов, которые, по вашему мнению, относятся к тем приложениям, которые не следует удалять с компьютера.

Вам также может быть интересно:

• Zemana AntiMalware Free — облачный антивирусный сканер
• Лучшие антивирусные сканеры, не требующие установки на компьютер
• Лучшие бесплатные антивирусы

Далее вы можете удалить обнаруженные угрозы при помощи кнопки «Удалить выбранное».

После этого, будет открыто окно с предупреждением о том, что для полного удаления угроз, необходима перезагрузка компьютера.

Удаленные в Malwarebytes Anti-Malware данные будут помещены в карантин.

Во вкладке «История», в разделе «Карантин», будут отображены данные, помещенные в карантин. При помощи соответствующих кнопок «Восстановить», «Удалить», или «Удалить всё», вы можете совершить действия с соответствующими данными, помещенными в карантин. Для этого отметьте нужную запись, а затем совершите требуемое действие.

Данные, удаленные из карантина, будут навсегда удалены с вашего компьютера.

В разделе «Логи программы» вы можете получить данные о результатах сканирования. Логи можно будет экспортировать: копировать в буфер обмена, сохранить в текстовый файл, или в XML файл.

How does anti-malware work?

The old school method of signature-based threat detection is effective to a degree, but modern anti-malware also detects threats using newer methods that look for malicious behavior. To put it another way, signature-based detection is a bit like looking for a criminal’s fingerprints. It’s a great way to identify a threat, but only if you know what their fingerprints look like. Modern anti-malware takes detection a step further so it can identify threats it has never seen before. By analyzing a program’s structure and behavior, it can detect suspicious activity. Keeping with the analogy, it’s a bit like noticing that one person always hangs out in the same places as known criminals and has a lock pick in his pocket.

This newer, more effective cybersecurity technology is called heuristic analysis. “Heuristics” is a term researchers coined for a strategy that detects threats by analyzing the program’s structure, its behavior, and other attributes.

Each time a heuristic anti-malware program scans an executable file, it scrutinizes the program’s overall structure, programming logic, and data. All the while, it looks for things like unusual instructions or junk code. In this way, it assesses the likelihood that the program contains malware. What’s more, a big plus for heuristics is its ability to detect malware in files and boot records before the malware has a chance to run and infect your computer. In other words, heuristics-enabled anti-malware is proactive, not reactive.

Some anti-malware products can also run the suspected malware in a sandbox, which is a controlled environment in which the security software can determine whether a program is safe to deploy or not. Running malware in a sandbox lets the anti-malware look at what the software does, the actions it performs, and whether it tries to hide itself or compromise your computer.

Another way heuristic analytics helps keep users safe is by analyzing web page characteristics in order to identify risky sites that might contain exploits. If it recognizes something fishy, it blocks the site.

In brief, signature-based anti-malware is like a bouncer at the nightclub door, carrying a thick book of mug shots and booting anyone that matches. Heuristic analysis is the bouncer who looks for suspicious behavior, pats people down, and sends home the ones carrying a weapon.

“Heuristics is a term researchers coined for a strategy that detects viruses by analyzing the program’s structure, its behavior, and other attributes.”

Mobile spyware

Also, it’s not just consumers that mobile spyware criminals target. If you use your smartphone or tablet in the workplace, hackers can turn their attack to your employer organization through vulnerabilities in mobile devices. Moreover, your corporation’s incident response team may not detect breaches that originate through a mobile device.

Spyware breaches on smartphones commonly occur in three ways:

• Unsecured free wi-fi, which is common in public places such as airports and cafes. If you log onto an unsecured network, the bad guys can see everything you do while connected. Pay attention to warning messages your device may give you, especially if it indicates that the server identity cannot be verified. Protect yourself by avoiding such unsecured connections.
• Operating system (OS) flaws, which open up exploits that could let attackers infect a mobile device. Smartphone manufacturers frequently release OS updates to protect users, which is why you should install updates as soon as they are available (and before hackers try to infect out-of-date devices).
• Malicious apps, which hide in seemingly legitimate applications, especially when they are downloaded from websites or messages instead of an app store. Here it’s important to look at the warning messages when installing applications, especially if they seek permission to access your email or other personal information. Bottom line: It’s best to stick to trusted sources for mobile apps and avoid any third-party apps.

Getting help if you have been scammed

Getting scammed is one of the worst feelings to experience. In many ways, you feel like you have been violated and are angry to have let your guard down. Perhaps you are even shocked and scared, and don’t really know what to do now. The following tips will hopefully provide you with some guidance.

If you already let them in

• Revoke remote access (if unsure, restart your computer). That should cut the remote session and kick them out of your PC.
• Scan your computer for malware. The miscreants may have installed password stealers or other Trojans to capture your keystrokes. Use a program such as Malwarebytes to quickly identify and remove threats.
• Change all your passwords. (Windows password, email, banking, etc.)

In some cases (i.e., you did not pay or called them names), scammers will seek revenge on your machine. Here are some things they might try and what to do to recover from them:

Master password lock out

There are various “hacks” to reset that password. One method is to use a Linux boot CD to mount Windows and then use the chntpw utility. It is described in this Ask Ubuntu page.

Missing software drivers

First, try to do a System Restore. If it fails, you should be able to reinstall them by going to the manufacturer’s website and downloading the appropriate driver.

Missing files

First, try to do a System Restore. If it is not available, check for backups you may have made and stored somewhere else. As a last resort, there are programs that can scrape your hard drive and attempt to recover the missing files.

If you already paid

• Contact your financial institution/credit card company to reverse the charges and keep an eye out for future unwanted charges.
• If you gave them personal information such as date of birth, Social Security Number, full address, name, and maiden name, you may want to consult the FTC’s website and report identity theft.

How do I protect myself from spyware?

The best defense against spyware, as with most malware, starts with your behavior. Follow these basics of good cyber self-defense.

1. Don’t open emails from unknown senders.
2. Don’t download files unless they come from a trusted source.
3. Mouse-over links before clicking on them and make sure you’re being sent to the right webpage.
4. Use a reputable cybersecurity program to counter advanced spyware. In particular, look for cybersecurity that includes real-time protection.

A quick note about real-time protection. Real-time protection automatically blocks spyware and other threats before they can activate on your computer. Some traditional cybersecurity or antivirus products rely heavily on signature-based technology—these products can be easily circumvented by today’s modern threats.

You should also look out for features that block the delivery of spyware itself on your machine, such as anti-exploit technology and malicious website protection, which blocks websites that host spyware. The premium version of Malwarebytes has a solid reputation for spyware protection.

Digital life comes with ubiquitous dangers in the daily online landscape. Fortunately, there are straightforward and effective ways to protect yourself. Between a cybersecurity suite and commonsense precautions, you should be able to keep every machine you use free from spyware invasions and their malicious intent.

See all our reporting on spyware at Malwarebytes Labs.

Настройки Malwarebytes Anti-Malware

Для выбора настроек антивируса, необходимо будет перейти во вкладку «Настройки». Во вкладке «Настройки», в левой колонке расположены несколько разделов, с помощью которых вы можете самостоятельно настроить антивирус, если вас не устраивают настройки по умолчанию.

Следует учитывать то, что антивирус Malwarebytes Anti-Malware уже оптимально настроен по умолчанию.

В разделе «Исключения» вы можете настроить параметры, для исключения конкретных папок или файлов, при обнаружении вредоносных программ. Malwarebytes Anti-Malware не будет проверять данные папки и файлы, добавленные в исключения, во время сканирования вашего компьютера на вирусы. В исключения будут добавлено все содержимое данной папки (подпапки, файлы и прочее).

С помощью кнопок «Добавить файл» и «Добавить папку» можно будет добавить необходимые данные в исключения, а с помощью кнопки «Удалить», вы можете удалить данную папку или файл из исключений.

В разделе «Веб исключения», можно будет добавить IP адреса, домены, или программы для исключения при проверке Malwarebytes Anti-Malware. При помощи кнопок «Добавить IP», «Добавить домен», «Добавить процесс» можно будет добавить конкретные данные в веб исключения, а при помощи кнопки «Удалить», удалить эти данные из веб исключений.

Данная опция доступна только для платной версии программы.

В разделе «Обнаружения и защита» настраивается настройка обнаружения и поведение защиты Malwarebytes Anti-Malware. По умолчанию, эти настройки уже оптимально настроены. Опытные пользователи могут подкорректировать данные настройки по своему усмотрению.

Здесь можно будет активировать пункт «Проверять на наличие руткитов» для боле полной проверки своего компьютера.

В разделе «Настройки обновления» можно будет настроить настройки обновления Malwarebytes Anti-Malware на своем компьютере.

При помощи вкладки «Настройки истории» вы можете получить доступ к логам программы, если вам будут необходимы эти данные для последующего анализа.

В разделе «Политика доступа» можно будет управлять уровнями доступа к различным параметрам и функциям Malwarebytes Anti-Malware. Данная функция работает в платной версии антивируса.

В разделе «Расширенные настройки» можно будет изменить настройки поведения защиты Malwarebytes Anti-Malware. Без особой необходимости, что-либо изменять в этом разделе, не рекомендуется, так как эти настройки предназначены для опытных пользователей.

Данные настройки будут доступны в платной версии антивирусной программы.

Раздел «Планировщик задач» служит для создания и настройки задач для Malwarebytes Anti-Malware. Вы можете использовать эти функции в платной версии программы.

После ознакомления с настройками приложения, можно будет запустить проверку своего компьютера на вирусы.

What are the most common forms of malware?

Here are the most common offenders in the rogues’ gallery of malware:

• Adware is unwanted software designed to throw advertisements up on your screen, most often within a web browser. Typically, it uses an underhanded method to either disguise itself as legitimate, or piggyback on another program to trick you into installing it on your PC, tablet, or mobile device.
• Spyware is malware that secretly observes the computer user’s activities without permission and reports it to the software’s author.
• A virus is malware that attaches to another program and, when executed—usually inadvertently by the user—replicates itself by modifying other computer programs and infecting them with its own bits of code.
• Worms are a type of malware similar to viruses. Like viruses, worms are self-replicating. The big difference is that worms can spread across systems on their own, whereas viruses need some sort of action from a user in order to initiate the infection.
• A Trojan, or Trojan horse, is one of the most dangerous malware types. It usually represents itself as something useful in order to trick you. Once it’s on your system, the attackers behind the Trojan gain unauthorized access to the affected computer. From there, Trojans can be used to steal financial information or install other forms of malware, often ransomware.
• Ransomware is a form of malware that locks you out of your device and/or encrypts your files, then forces you to pay a ransom to regain access. Ransomware has been called the cybercriminal’s weapon of choice because it demands a quick, profitable payment in hard-to-trace cryptocurrency. The code behind ransomware is easy to obtain through online criminal marketplaces and defending against it is very difficult. While ransomware attacks on individual consumers are down at the moment, attacks on businesses are up 365 percent for 2019. As an example, the Ryuk ransomware specifically targets high-profile organizations that are more likely to pay out large ransoms. For more, check out the Malwarebytes Labs Ransomware Retrospective.
• Rootkit is a form of malware that provides the attacker with administrator privileges on the infected system, also known as “root” access. Typically, it is also designed to stay hidden from the user, other software on the system, and the operating system itself.
• A keylogger is malware that records all the user’s keystrokes on the keyboard, typically storing the gathered information and sending it to the attacker, who is seeking sensitive information like usernames, passwords, or credit card details.
• Malicious cryptomining, also sometimes called drive-by mining or cryptojacking, is an increasingly prevalent malware usually installed by a Trojan. It allows someone else to use your computer to mine cryptocurrency like Bitcoin or Monero. So instead of letting you cash in on your own computer’s horsepower, the cryptominers send the collected coins into their own account and not yours. Essentially, a malicious cryptominer is stealing your resources to make money.
• Exploits are a type of malware that takes advantage of bugs and vulnerabilities in a system in order to give the attacker access to your system. While there, the attacker might steal your data or drop some form of malware. A zero-day exploit refers to a software vulnerability for which there is currently no available defense or fix.

What is spyware?

No big surprise—spyware is sneaky. It finds its way on to your computer without your knowledge or permission, attaching itself to your operating system. You might even inadvertently permit spyware to install itself when you agree to the terms and conditions of a seemingly legitimate program without reading the fine print.

Whatever way spyware manages to get on your PC, the method of operation is generally the same—it runs quietly in the background, maintaining a secret presence, collecting information or monitoring your activities in order to trigger malicious activities related to your computer and how you use it. And even if you discover its unwelcome presence on your system, Spyware does not come with an easy uninstall feature.

Block spyware from tracking your activity

Remove and prevent spyware from stealing your sensitive data. Try Malwarebytes Premium free for 14 days.

“Spyware runs quietly in the background, collecting information.”

How does malware affect my business?

As noted in the Malwarebytes Labs Ransomware Retrospective, ransomware attacks on businesses went up 365 percent from Q2 2018 to Q2 2019.

So why are cybercriminals bullish on business attacks? The answer is simple: businesses present a broader attack surface and more bang for the buck. In one noteworthy example, the Emotet banking Trojan hobbled critical systems in the City of Allentown, PA, requiring help from Microsoft’s incident response team to clean up and racking up remediation costs to the tune of $1 million.

In another example, the SamSam ransomware brought the City of Atlanta to its knees by taking down several essential city services—including revenue collection. Ultimately, the SamSam attack cost Atlanta $2.6 million to remediate.

And that’s just the clean-up costs. The costs involved with a data breach and the resulting cases of identity theft are through the roof. The Ponemon Institute’s 2019 Cost of a Data Breach Report pegs the current average cost at $3.92 million.

On the high end, the settlement costs from the 2017 Equifax data breach, which started with a simple and easy to protect against SQL injection, are reportedly around $650 million.

The majority of malware attacks on businesses as of late have been the result of TrickBot. First detected in 2016, the Trickbot banking Trojan has already gone through several iterations as its authors strengthen its evasion, propagation, and encryption abilities.

Considering the tremendous cost associated with a malware attack and the current rise of ransomware and banking Trojans in particular, here’s some tips on how to protect your business from malware.

• Implement network segmentation. Spreading your data onto smaller subnetworks reduces your attack surface—smaller targets are harder to hit. This can help contain a breach to only a few endpoints instead of your entire infrastructure.
• Enforce the principle of least privilege (PoLP). In short, give users the access level they need to do their jobs and nothing more. Again, this helps to contain damages from breaches or ransomware attacks.
• Backup all your data. This goes for all the endpoints on your network and network shares too. As long as your data is archived, you can always wipe an infected system and restore from a backup.
• Educate end users on how to spot malspam. Users should be wary of unsolicited emails and attachments from unknown senders. When handling attachments, your users should avoid executing executable files and avoid enabling macros on Office files. When in doubt, reach out. Train end users to inquire further if suspicious emails appear to be from a trusted source. One quick phone call or email goes a long way towards avoiding malware.
• Educate staff on creating strong passwords. While you’re at it, implement some form of multi-factor authentication—two-factor at a bare minimum.
• Patch and update your software. Microsoft releases security updates the second Tuesday of every month and many other software makers have followed suit. Stay in the loop on important security updates by subscribing to the Microsoft Security Response Center blog. Expedite the patch process by launching updates at each endpoint from one central agent, as opposed to leaving it up to each end user to complete on their own time.
• Get rid of end of abandonware. Sometimes it’s hard to get rid of old software that’s past its expiration date—especially at a large business where the purchasing cycle moves with the urgency of a sloth, but discontinued software is truly the worst-case scenario for any network or system administrator. Cybercriminals actively seek out systems running outdated and obsolete software so replace it as soon as possible.
• Get proactive about endpoint protection. Malwarebytes, for example, has multiple options for your business with Endpoint Protection, Endpoint Security, and Endpoint Protection and Response. And for small businesses looking to protect up to 20 devices, check out Malwarebytes for Teams.

Mac spyware

Spyware authors have historically concentrated on the Windows platform because of its large user base when compared to the Mac. However, the industry has seen a big jump in Mac malware since 2017, the majority of which is spyware. Although spyware authored for the Mac has similar behaviors as the Windows variety, most of the Mac spyware attacks are either password stealers or general-purpose backdoors. In the latter category, the spyware’s malicious intent includes remote code execution, keylogging, screen captures, arbitrary file uploads and downloads, password phishing, and so on.

“The industry has seen a big jump in Mac malware in 2017, the majority of which is spyware.”

In addition to malicious spyware, there’s also so-called “legitimate” spyware for Macs. This software is actually sold by a real company, from a real website, usually with the stated goal of monitoring children or employees. Of course, such software is a two-edged sword, as it’s very often misused, providing the average user with a way of accessing spyware capabilities without needing any special knowledge.

What’s the difference between antivirus and anti-malware?

For the most part, antivirus software and anti-malware software are the same things. They both refer to computer security software designed to detect, protect against, and remove malicious software. Contrary to what the name might suggest, antivirus software protects against more than viruses — it just uses a slightly antiquated name to describe what it does.

Anti-malware software is also designed to protect against viruses; it just uses a more modern name that encompasses all kinds of malicious software, including viruses. That being said, anti-malware can stop an online viral infection from happening and remove infected files. However, anti-malware isn’t necessarily equipped to restore files that have been changed or replaced by a virus. Both antivirus software and anti-malware fall under the broader term «cybersecurity.”

All about malware

You know how every year the medical community campaigns for everyone to get a flu shot? That’s because flu outbreaks typically have a season—a time of year when they start spreading and infecting people.

In contrast, there are no predictable seasonal infections for PCs, smartphones, tablets, and enterprise networks. For them, it’s always flu season. But instead of suffering chills and body aches, users can fall ill from a kind of machine malady—malware.

Each type of malware infection has its own methods of attack—from stealthy and sneaky to subtle like a sledgehammer. But if knowledge is power, as a preventative inoculation against infection, we offer here a short cybersecurity course on malware, what it is, its symptoms, how you get it, how to deal with it, and how to avoid it in the future.

Who do spyware authors target?

Unlike some other types of malware, spyware authors do not really target specific groups or people. Instead, most spyware attacks cast a wide net to collect as many potential victims as possible. And that makes everyone a spyware target, as even the slightest bit of information might find a buyer.

“Spyware attacks cast a wide net to collect as many potential victims as possible.”

Information obtained through stolen documents, pictures, video, or other digital items can even be used for extortion purposes.

So, at the end of the day, no one is immune from spyware attacks, and attackers usually care little about whom they are infecting, as opposed to what they are after.

History of spyware

As with much Internet discourse, it’s difficult to pin down exactly where “spyware” as a word and a concept originated. Public references to the term date back to Usenet discussions happening in the mid-90s. By the early 2000s, “spyware” was being used by cybersecurity companies, in much the same way we might use the term today; i.e. some sort of unwanted software program designed to spy on your computer activity.

In June 2000, the first anti-spyware application was released. In October 2004, America Online and the National Cyber-Security Alliance performed a survey. The result was startling. About 80% of all Internet users have their system affected by spyware, about 93% of spyware components are present in each of the computers, and 89% of the computer users were unaware of their existence. Out of the affected parties, almost all, about 95%, confessed that they never granted permission to install them.

At present, and in general, the Windows operating system is the preferred target for spyware applications, thanks largely to its widespread use. However, in recent years spyware developers have also turned their attention to the Apple platform, as well as to mobile devices.

Функционал

Бесплатная версия утилиты позволяет:

• выполнять сканирование дисков для полной проверки безопасности работы системы,
• обновлять базы сигнатур, получая таким образом данные о новейших вирусах,
• обнаруживать даже стойкие угрозы и удалять их без влияния на системные ресурсы,
• добавлять обнаженные угрозы в карантин с тем, чтобы можно было такие файлы восстановить в любое для пользователя время (актуально, если файл попал в число вредоносных по ошибке),
• составлять черный список для исключений,
• улучшать работу софта за счет дополнений, позволяющих удалить больше вредоносных программ. Среди таких софтов Chameleon, Malwarebytes Anti-Rootkit, StartupLite, Malwarebytes FileASSASSIN,
• Malwarebytes Chameleon — технология, которая позволяет запустить антивирусник даже в том случае, если он заблокирован под действием вредоносных ПО,
• проверять файлы по требованию.

Кроме того, имеется версия программы Premium, которая позволяет защищать компьютер в режиме реального времени, а также проводить сканирование по расписанию. Достоинства защиты системы в режиме реального времени в том, что система находит и блокирует угрозы еще при попытках их выполнения.

Кроме того, при такой защите программы-вымогатели не смогут зашифровать ваши данные, вы не попадете на зараженные веб-сайты, не окажетесь на вредоносных ресурсах. Программа также анализирует оперативную память устройства. Также здесь имеются настройки, которые пригодятся опытным пользователям. С их помощью вы можете обозначить действия для каждого конкретного файла и угрозы.

Еще можно запланировать заранее обновление программы и сканирование системы.

How do I get malware?

“Malware attacks would not work without the most important ingredient: you.”

Bottom line, it’s best to stick to trusted sources for mobile apps, only installing reputable third-party apps, and always downloading those apps directly from the vendor—and never from any other site. All in all, there is a world of bad actors out there, throwing tainted bait at you with an offer for an Internet accelerator, new download manager, hard disk drive cleaner, or an alternative web search service.

Even if you install something from a credible source, if you don’t pay attention to the permission request to install other bundled software at the same time, you could be installing software you don’t want. This extra software, also known as a potentially unwanted program (PUP), is often presented as a necessary component, but it often isn’t.

Another wrinkle is a bit of social engineering that a Malwarebytes expert observed in the UK. The scam hit mobile users by taking advantage of a common mobile direct-to-bill payment option. Users visited mobile sites, unwittingly tripping invisible buttons that charge them via their mobile numbers, directly billing the victims’ networks, which pass the cost onto their bill.

To be fair, we should also include a blameless malware infection scenario. Because it’s even possible that just visiting a malicious website and viewing an infected page and/or banner ad will result in a drive-by malware download. Malware distributed via bad ads on legitimate websites is known as malvertising.

On the other hand, if you’re not running an adequate security program, the malware infection and its aftermath are still on you.

How to protect against malware

In no particular order, here’s our tips on protecting against malware.

1. Pay attention to the domain and be wary if the site isn’t a top-level domain, i.e., com, mil, net, org, edu, or biz, to name a few.

2. Use strong passwords with multi-factor authentication. A password manager can be a big help here.

3. Avoid clicking on pop-up ads while browsing the Internet.

6. Don’t download software from untrustworthy websites or peer-to-peer file transfer networks.

7. Stick to official apps from Google Play and Apple’s App Store on Android, OSX, and iOS (and don’t jailbreak your phone). PC users should check the ratings and reviews before installing any software.

8. Make sure your operating system, browsers, and plugins are patched and up to date.

9. Delete any programs you don’t use anymore.

10. Back up your data regularly. If your files become damaged, encrypted, or otherwise inaccessible, you’ll be covered.

11. Download and install a cybersecurity program that actively scans and blocks threats from getting on your device. Malwarebytes, for example, offers proactive cybersecurity programs for Windows, Mac, Android, and Chromebook. Plus, our latest offering, Malwarebytes Browser Guard. It’s free and it’s the only browser extension that can stop tech support scams along with any other unsafe and unwanted content that comes at you through your browser.