Malwarebytes is primarily a scanner that scans for and removes malicious software, including rogue security software, adware, and spyware. Malwarebytes scans in batch mode, rather than scanning all files opened, reducing interference if another on-demand anti-malware software is also running on the computer. Malwarebytes is available in both a free and a premium paid version. The free version can be run manually by the user when desired, whereas the paid version can perform scheduled scans, automatically scan files when opened, block IP addresses of malicious web sites, and scan only those services, programs and device drivers that are currently in use. On December 8, 2016, Malwarebytes Inc. released version 3.0. This includes protection against malware, ransomware, exploit, and malicious websites. In November 2019, version 4.0 was released, featuring a new user interface and the Katana scanning engine.
Reception
In 2010, PC World Preston Gralla wrote that "Using Malwarebytes' Anti-Malware is simplicity itself".
Mark Gibbs of Network World gave Malwarebytes Anti-Malware 4 stars out of 5 in January 2009 and wrote that "It does the job and only the lack of a detailed explanation of what it has found stops it from getting 5 out of 5".
PC Magazine gave Malwarebytes Anti-Malware 3.5 stars out of 5 in May 2010, saying that although it was good at removing malware and scareware, it fell short on removing keyloggers and rootkits. However, the free version got 4.5 stars out of 5 and an Editor's Choice award for free removal-only antivirus software in 2013-2014.
Dispute with IObit
On November 2, 2009, Malwarebytes accused IObit, a Chinese company that offers similar products, of incorporating the database of Malwarebytes Anti-Malware into its security software IObit Security 360. IObit denied the accusation and stated that the database is based on user submissions, and sometimes the same signature names that are in Malwarebytes get placed in the results. They said that they did not have time to filter out the signature names that are similar to Malwarebytes. IObit also stated that Malwarebytes did not have convincing proof, and promised that the databases were not stolen. After the declaration from IObit, Malwarebytes replied that they are not convinced of the argument from IObit. Malwarebytes claims to have served DMCA infringement notices against CNET, Download.com and Majorgeeks in order to have the download sites remove the IObit software. IObit said that as of version 1.3, their database has been updated to address those accusations of intellectual property theft made earlier by Malwarebytes.
Security vulnerabilities
On February 2, 2016, Project Zero announced four vulnerabilities in the Malwarebytes flagship product, including lack of server-side encryption for update files and lack of proper payload signing within encrypted data; the combination of which allowed an attacker to recompile the encrypted payload with exploits. Malwarebytes responded one day before disclosure in a blog article detailing the extreme difficulty in executing these attacks, as well as revealing that the announced server-side and encryption issues were resolved within days of private disclosure and were not outstanding at the time Project Zero published their research. Malwarebytes also published information on how to protect current users until a patch was released. This event also resulted in the establishment of a formal bug bounty program by Malwarebytes, which offers up to $1,000 per disclosure, depending on severity and exploitability.
