Malware or not? + discussion about running 2 AVs together

[Nico@FMA]

I just did edit my post above... so proof enough I would say.

 

[illumination]

Posted by Dickevans on Norton community.



Posted by 4FE on Norton community.

Both senior staff members.

Another topic: Link

Symantec info about other AV

Bleeping computer topic

And another 74.800 results about Norton conflict with Mbam.

Posted by:
Sandro_cm
Super Spyware Scolder

In the Norton Forums.

I've posted some comments here about configuring MBAM PRO so that it doesn't interfere with NIS real-time protection.
If you're referring to the compatibility warning some users were seeing with NIS 20.3.0.36 (NIS 2013) and MBAM (see here), that issue was eventually resolved and I haven't seen any posts in the forum mentioning a similar bug with NIS 21.x (NIS 2014).

 

[Nico@FMA]

Posted by:
Sandro_cm
Super Spyware Scolder

In the Norton Forums.

Well there you go the posts say: disable realtime Mbam protection.

That's my point.
You can run Mbam next to Norton if you keep Mbam passive.

 

[Nico@FMA]

Alright here some screenshots....

Screen one from Peter Web Nortons developer

The Pro version of Malwarebytes DOES conflict with Norton because of the real time scanning capabilities. You can only have one real time scanner software installed at one time or the two will fight for the system resources at the same time, sometimes reducing protection.
This thread is following the notification that the free version of MBAM is being shown as a conflict, when in fact it has been fine until recently.

That says it all.

So use Mbam in PASSIVE mode then you are OK. Use it in ACTIVE mode and you will learn the hard way.

 

[illumination]

Alright here some screenshots....

Screen one from Peter Web Nortons developer



That says it all.

So use Mbam in PASSIVE mode then you are OK. Use it in ACTIVE mode and you will learn the hard way.

It says the two will fight for system resources, it does not mention that he tried it with exclusions set, which in my other posts from malwarebytes states, that it should run with all Av's with no problem, although some may need to set exclusions to prevent this fight over system resources. We could argue this all day, just as they do over in Norton's Forum, it is full of these arguments going back and forth.

Theory and experience show two different results. Too many are doing it, as opposed to the ones saying it can not be done.

 

[Nico@FMA]

It says the two will fight for system resources, it does not mention that he tried it with exclusions set, which in my other posts from malwarebytes states, that it should run with all Av's with no problem, although some may need to set exclusions to prevent this fight over system resources. We could argue this all day, just as they do over in Norton's Forum, it is full of these arguments going back and forth.

Theory and experience show two different results. Too many are doing it, as opposed to the ones saying it can not be done.

Well that same goes for murder and bank robbery, sometimes you get away with it and sometimes you get caught.
Does that mean its correct? No.

That being said everyone has his own opinions and everyone is entitled to their own comments and experiences.
So if running both works for you then please by all means go for it and have fun.
But please refrain from advising others to do the same thing as you are doing, because they might not be as lucky.

I am aware that theory and real-world are 2 different things and sometimes you can step away from rules and practices.
But by doing so you accept the risk that you will render both AV programs useless the moment you are getting hit by a nasty virus.
Now if you do want to accept that risk then go for it, I will not stop you.
But please take my word for it as a professional running multiple AV as a combo while both being in active modus is BEGGING for problems.

Granted most sophisticated AV programs have certain modules build in that try to avoid conflicts and try to keep the system running.
So you as a user might not notice that there is something wrong (In the old days they just crash ur OS.)
But fact is if you are getting a nasty pest into your pc then your system will suffer and you are going to experience problems.

Alright I can only try to make you understand and I can only make a effort to educate you, if you choose not to believe me then I am perfectly fine with it, and if you think that I might be right... well brilliant I am fine with that to.
I am not trying to force my knowledge upon you.

So do what you think is best.

 

[illumination]

Well that same goes for murder and bank robbery, sometimes you get away with it and sometimes you get caught.
Does that mean its correct? No.

That being said everyone has his own opinions and everyone is entitled to their own comments and experiences.
So if running both works for you then please by all means go for it and have fun.
But please refrain from advising others to do the same thing as you are doing, because they might not be as lucky.

I am aware that theory and real-world are 2 different things and sometimes you can step away from rules and practices.
But by doing so you accept the risk that you will render both AV programs useless the moment you are getting hit by a nasty virus.
Now if you do want to accept that risk then go for it, I will not stop you.
But please take my word for it as a professional running multiple AV as a combo while both being in active modus is BEGGING for problems.

Granted most sophisticated AV programs have certain modules build in that try to avoid conflicts and try to keep the system running.
So you as a user might not notice that there is something wrong (In the old days they just crash ur OS.)
But fact is if you are getting a nasty pest into your pc then your system will suffer and you are going to experience problems.

Alright I can only try to make you understand and I can only make a effort to educate you, if you choose not to believe me then I am perfectly fine with it, and if you think that I might be right... well brilliant I am fine with that to.
I am not trying to force my knowledge upon you.

So do what you think is best.

This forum is full of members claiming to be experts. As you can see from below my Avatar, i have been around this forum for a bit. I trust advice only from certain members, ones i know that actually test theories and practices, not just claim to know from reading an article or two.I myself test instead of just assuming. I have been in both malwarebytes forum and norton both, and read many members accounts of using both together with no issue. These things you have shown me here today, are from staff at Norton, claiming it should not be done, with no proof of confliction. I advise people only when i know something is ok to do. As long as the OP in questions heeds the "set exclusions" advice.

While we are on this subject, you are in no way staff at this forum, and in no position to "tell" people what they should post or not post. Have a problem with my advice, take it up with staff.. Matter of fact, go to Umbra, im sure he would love this read as a testing and review expert that has run more combo's of software then anyone i know.

 

[Nico@FMA]

This forum is full of members claiming to be experts. As you can see from below my Avatar, i have been around this forum for a bit. I trust advice only from certain members, ones i know that actually test theories and practices, not just claim to know from reading an article or two.I myself test instead of just assuming. I have been in both malwarebytes forum and norton both, and read many members accounts of using both together with no issue. These things you have shown me here today, are from staff at Norton, claiming it should not be done, with no proof of confliction. I advise people only when i know something is ok to do. As long as the OP in questions heeds the "set exclusions" advice.

While we are on this subject, you are in no way staff at this forum, and in no position to "tell" people what they should post or not post. Have a problem with my advice, take it up with staff.. Matter of fact, go to Umbra, im sure he would love this read as a testing and review expert that has run more combo's of software then anyone i know.

Ohhh noes I am no staff, but ill bet that the present staff will agree with me that giving others advise that goes against common practices should be avoided unless you know what you are doing. If you read my words correctly then I did not TELL you to do anything, I merely asked.

But please refrain from advising others to do the same thing as you are doing, because they might not be as lucky.

Remember my topic: Mousclick matters? I suggest you read it because I actually explained why running multiple AV's/AS's is bad.

That said I am not claiming to be a expert, I am probably the dumbest person on this forum and I have no clue what I am talking about.
So are my clients and business contacts they are so dumb to hire me to give advise and such.
As you can see I am no expert and all the forum posts I made make no sense, they are baseless and totally irrelevant.

In regards to Norton claiming things, the same can be said about Malwarebytes as Malwarebytes claims it CAN work next to Norton and Norton claims it cannot run in active mode parallel to each other.
Who is right who is wrong? Does it really matter that you NEED to exclude Mbam from Norton?
I mean that by definition means that Norton cannot deal with Mbam if Mbam is in active mode.
Hence why everyone is suggesting that if you want to run both then keep Mbam in passive mode.

Anyway having a discussion is ok, sharing idea's and debating issues and all kinds of things is exactly what this forum is made for.
The sense of community when solving problems and such both on a individual level and as a collective is great.
So if my advise can help you then brilliant, if it does not then its fine to and if you want to challenge me or any member in a convo please do so and if I can I will either agree, disagree or show you. And I hope you grant me the same privilege.

Cheers

 

[illumination]

Ohhh noes I am no staff, but ill bet that the present staff will agree with me that giving others advise that goes against common practices should be avoided unless you know what you are doing. If you read my words correctly then I did not TELL you to do anything, I merely asked.

But who are you to judge what advice i give, and if it is correct. Lets us ask the present staff for an opinion on this matter.

 

[Nico@FMA]

But who are you to judge what advice i give, and if it is correct. Lets us ask the present staff for an opinion on this matter.

Alright... lets see what the staff is saying about this.

 

[Dubseven]

n.nvt has right.
Okay, there is a little exemple.

What we know?
A file can't by written in or changed when this file is opened in "read" by a program.
Exemple, when you open a program and try to remove the file, you can't.


Here is a exemple of what happens with Norton and MBAM in same PC :

[New file created]
MBAM or Norton try to read the file and isolate the file when reading.

This time we will say that Norton came first,
So norton isolate the file to begin reading the file for searching infected codes, MBAM can't access the isolated file, so MBAM can't detect this file because can't read it.

Norton take some time (9 seconds ago ~) to scan the file as reputation, so 9 seconds after, the file is un-isolated but MBAM don't know this and MBAM will not scan this file again because he don't know if it always isolated or not.


Also, two anti-virus in one system can be a problem with removing infections.
If a malware is running and MBAM and NORTON detect it, the file in the quarantine of norton and / mbam has a risk to be "corrupt" or must wait the reboot to remove the file.

So, MBAM + Norton real time = bad idea.


Result : Problem on detections, problem on quarantine, high ram/cpu usage, two licences..
One alone AV can do better than two same time..

 

[illumination]

n.nvt has right.
Okay, there is a little exemple.

What we know?
A file can't by written in or changed when this file is opened in "read" by a program.
Exemple, when you open a program and try to remove the file, you can't.


Here is a exemple of what happens with Norton and MBAM in same PC :

[New file created]
MBAM or Norton try to read the file and isolate the file when reading.

This time we will say that Norton came first,
So norton isolate the file to begin reading the file for searching infected codes, MBAM can't access the isolated file, so MBAM can't detect this file because can't read it.

Norton take some time (9 seconds ago ~) to scan the file as reputation, so 9 seconds after, the file is un-isolated but MBAM don't know this and MBAM will not scan this file again because he don't know if it always isolated or not.


Also, two anti-virus in one system can be a problem with removing infections.
If a malware is running and MBAM and NORTON detect it, the file in the quarantine of norton and / mbam has a risk to be "corrupt" or must wait the reboot to remove the file.

So, MBAM + Norton real time = bad idea.

So you are telling me, that if one is scanning the other has to wait, still do not see the problem with this. There is a risk that either one by themselves could corrupt a file upon removal.

Im still waiting for a valid reason as to why a program, that is NOT an anti virus and was designed to be a companion program, should not be used as one.

 

[Dubseven]

Im still waiting for a valid reason as to why a program, that is NOT an anti virus and was designed to be a companion program, should not be used as one.

No reason, if your computer is good and you think that is best for you. But, you must keep quick-scanning your computer all week-end to prevent the un-detected isolated files to be detected.

 

[Koroke San]

Also, two anti-virus

MBAM is not an antivirus

 

[illumination]

No reason, if your computer is good and you think that is best for you. But, you must keep quick-scanning your computer all week-end to prevent the un-detected isolated files to be detected.

Explain why you would have to keep scanning all weekend, are you saying if Norton realtime is on, it would prevent Mbam from being able to detect? I would actually like to see someone from the forum do a video on this, as i believe this is incorrect.

 

[Nico@FMA]

So you are telling me, that if one is scanning the other has to wait, still do not see the problem with this. There is a risk that either one by themselves could corrupt a file upon removal.

Im still waiting for a valid reason as to why a program, that is NOT an anti virus and was designed to be a companion program, should not be used as one.

Listen I will repeat myself Mbam can run next to Norton IF you turn off the active protection used by Mbam.
So use Mbam as a second opinion program by passive on demand scanning.
For this Mbam is GREAT.

If you turn on Mbam then as Dubseven explained you will get issues.
Now let me repeat another thing: Mbam does detect, remove and block malware and so is Norton.
So its only common sense that even tho they might use different techniques that it will conflict specific if both detect the same malware.

Lets assume Norton detects Malware W32/Dropper-example Trojan then Norton will deal with it according to your settings and config.
And if possible it will undo the damage and correct previous settings, and if needed it will recommend or even force you to reboot.

Malwarebytes on the other hand has detected the same file (probably different name) and will deal with it in their unique way.

This might work out for some malwares, but when you get a nasty Trojan or malware which requires more sophisticated removal procedures then your system will be caught in the middle and both AV programs will fight over it.

Bleeping computer
Kaspersky blog
Bitdefender blog
MSDN Blog
Symantec Info

Just 5 VERY well known and respected webpages that will proof everything I have said.
So take your pick...

 

[illumination]

I may get into trouble for this, but do not care at this point, as seeing is believing correct?

 

[Nico@FMA]

MBAM is not an antivirus

The world's most popular malware protection*
Malwarebytes Anti-Malware Free uses industry-leading technology to detect and remove all traces of malware, including worms, Trojans, rootkits, rogues, dialers, spyware, and more. Or, consider the constant protection of Malwarebytes Anti-Malware PRO to help automatically prevent malware from reinfecting your PC.
*According to OPSWAT, Malwarebytes Anti-Malware is the most popular security product installed by users.[/QUOTE]

.

Uhhmmm Malware = Is a general name for Virusess, Trojans, Rootkits and other pests

 

[Dubseven]

@Get in my Inbox by the member to post it :

 

[illumination]

@Get in my Inbox by the member to post it :

already been posted... But all good... it is not about reality here, it is whether we remain right or wrong correct? Let the video speak for itself.