Are 3 installed on-demand scanners too many?

There is a portable version of Spybot:

http://portableapps.com/apps/security/spybot_portable

No installation. It has a weak updater though. If outdated, it pops up a warning, and upon clicking it, opens/redirects your default browser to the .exe.

Takes seconds to get going and the scan is truly under a minute, but not as fluid as HMP for example.

 

Sure surprised me, a trustworthy third-party portable edition not mentioned in main website, guess I'll take a look then.

Edit:
Not my cup of tea. Slow scan with no quick option. Shows tons of registry entries with low threat level. On scrolling, flashes non-existent red entries. No custom scanning (right-click menu unavailable). Not truly portable, adds to ProgramData and probably registry. No new features for me.

 

This... But the more things you install on your box the more sluggish it can become period, so it's not entirely, 100% true. But if they're not real-time the threat of conflict is almost non-existent, as is footprint.

If you use VT Hash Check it eliminates the need for hardly any other real-time scanner, as it uses about every engine in the book. I only use MBAM Free as well because you can do a full scan with it, unlike with VTHC. And use Hitman Pro also for full scans. And those are the only 3 scanners I use.

 

VirusTotal has a file size limit of 64 MB. I also use Metascan Online for its 80 MB limit, but that still doesn't cover everything, especially if you're offline. They're only practical for scanning individual files, and cannot clean the system.

Hitman Pro doesn't support full scans, its Default Scan is only a bit more thorough than Quick Scan. I believe it has an upload limit as well.

 

I'm using WSAC realtime and my on-demand are:

-Emsisoft Emergency Kit.
-HitmanPro.
-MBAM.

 

I would say that it all depends on how you see it. For me it would be too many.

 

From doing a little reading it looks like real-time AV's and scanners hook into the kernel and when intercepting data can get in each other's way. It seems that the fewer installed programs that are hooking the better.

I will stick with Webroot SecureAnywhere running real-time, and will now use HitmanPro as a portable scanner, uninstalled. W-S listed two others that don't require installing that I'll use: Norton Power Eraser and F-Secure Online Scanner.

So that leaves Malwarebytes Anti-Malware, which requires an installation. I don't want to go without MBAM so my choice is to use it installed as an on-demand scanner, or install it every week or so before imaging and then uninstall it. Both WSA and MBAM are supposed to be able to work well with other running AV security programs but I don't know how they avoid the hooking issue.

 

Noted, Noob.

 

Actually, this is still not quite right. The fewer the running programs, the better. A pure on-demand app that's not running will not conflict with anything.. So, again, you can have dozens of those if you like, just not running at the same time.

 

So if MBAM is installed as an on-demand scanner, the hooks aren't used except during a manual scan?

 

If you are using MBAM Free, which is purely on-demand, then it will not conflict with anything when it's not running. If you're using MBAM Pro, which is resident in memory and running at system startup, then that could conflict with other programs...

 

well said Kerodo. Yes some research is required to see which on-demand scanners truly are on demand and dont have anything running when GUI is closed.

some examples are;
mbam free
eset desktop scanner
hitman pro (used in portable mode)
dr.web cureit
MalAware
emsisoft emergency kit
comodo cleaning essentials
f-secure easy clean
norton power eraser
vipre rescue scanner
mcafee stinger
the above programs unload any hooks/drivers when they are not being run.

the below programs might leave a process running or leave drivers hooked even when not being run;
superantispyware free
panda activescan cleaner
sophos virus removal tool

not sure about the following;
kaspersky virus removal tool
trend micro housecall


all of which are available in my antimalware toolkit sig

 

There really is no problem here- if any scanner drops either a Startup reg key or Service that can't be stopped in the Programs GUI, it is a simple matter to do it yourself either in msconfig (or even better via WinPatrol) or by looking for and Disabling a particular service.

 

There was something running even with the free version of MBAM. I'm going to take this to the MBAM forums to see how to handle it. One solution that wouldn't be too much trouble is to install MBAM every few weeks for a scan and then uninstall it with RevoPro.

 

I'm not sure installing WinPatrol to deal with a few hooks isn't counter-productive. But you are right, there probably isn't really a problem here, other than my being a little obsessive about having just enough security. After all, that's my Wilders name. I'm going to do some reading to learn how to use your suggestion of msconfig.

 

Very helpful list, thank you. I'm glad you pointed to the link in your signature, it was already bookmarked in my security folder, but I'd forgotten it was there and something that would help with this issue.

Which I'm still not sure is an issue. Just how often do hooks get in the way? I don't know, especially with two programs like WSA and MBAM that are designed to work with other security programs.

Today it dawned on me that this idea about using portable-type scanners and using them less frequently comes from having had some experience now with WSA and trusting it so that getting constant second and third opinions from installed scanners doesn't seem as important.

edit: Webroot tells me there are no conflicts running WSA and MBAM together.