NOTICE - On May 4 2020, Malwarebytes for Windows version 3.8.3 reached its End of Life. For more information, see Malwarebytes for Windows version 3 End of Life notice. For the latest version of this support article, see Real-Time Protection in Malwarebytes for Windows v4.
The Protection tab in Malwarebytes for Windows controls how the program protects your device. You can view this section by clicking Settings, then the Protection tab. The settings within this tab are grouped in categories and you can configure each. A screenshot is below, along with descriptions of each setting available in this tab.
Malwarebytes offers four different types of real-time protection. These features are available only to users of the Premium and Premium Trial versions. Note that Premium Trial users who do not convert to a Malwarebytes Premium subscription will lose all real-time protection features at the end of their trial.
- Web Protection: This feature blocks web pages suspected of malicious activity. We do not recommend turning this feature off because your online safety may be compromised. Note that this option is disabled if you are using the Malwarebytes Free version.
- Exploit Protection: This feature guards against attempted exploits of vulnerabilities in legitimate programs. When you launch apps, exploit protection also launches as a shield. This protection detects and blocks attacks that go undetected by other security apps. By default, this setting is On for Malwarebytes Premium and Trial users. Click the Manage Protected Applications button to see a new window that displays all of your exploit protected apps.
You can toggle protection on or off for individual apps in this window. You can also add an app to protect by clicking the Add button. This opens a new window to add a new app to exploit protection.
You can create an app name in the Application name field, and click Browse... to select the app you want to add for the Application file field. Use the drop-down menu to select a Program type. If you are unsure of the type of program, select Other. This same screen is used to edit existing entries. Additionally, Malwarebytes Premium and Trial users can modify advanced exploit protection settings. Click the Advance Settings button to view the following window and configure finer details of exploit protection.
Use the check boxes to enable or disable protections for specific protection layers. Use the tabs to change views between different protection categories. We recommend only changing these advanced settings when requested by a Malwarebytes Support representative. Incorrect settings may result in impaired protection.
- Malware Protection: This feature protects against malware present in codes and files that try to launch on your device. These files may have been downloaded, imported from a USB drive, or received as an email attachment. We do not recommend turning this setting off unless requested by a Malwarebytes Support representative. Malwarebytes Premium and Trial users can use this feature, and the setting is On by default. This feature is disabled for the Malwarebytes Free version.
- Ransomware Protection: This feature provides Malwarebytes Premium and Trial users protection against the threat of ransomware. By default, this setting is On and we recommend not disabling this protection layer. This protection is not available for users of Windows XP, Windows Vista, or the Malwarebytes Free version.
This set of options allows you to configure the Malwarebytes rules used for scanning your device.
- Scan for rootkits: A specific set of rules used during scans to determine if a rootkit is on your device. Rootkits are malicious software that can be placed on a device and has the ability to modify operating system files and hide its presence. Toggling this setting on will make scans more intensive and effective, but increases the time to complete them. By default, this setting is Off.
- Scan within archives: When enabled, Malwarebytes scans two levels deep within archive zip, rar, 7z, cab and msi files. If disabled, the archive is excluded from scans. By default, this setting is On.
- Use signature-less anomaly detection for increased protection: This signature-less technology supplements existing detection methods to use machine learning to identify malicious files.
Potential Threat Protection
Malwarebytes detects non-malicious, but probably annoying, software called Potentially Unwanted Programs and Potentially Unwanted Modifications. Potentially Unwanted Programs appear in the form of toolbars and other software which are installed on your computer as part of a bundle. Potentially Unwanted Modifications are usually related to the Windows registry. For both of these types, this feature offers three settings for how you want Malwarebytes to handle them during scans:
- Ignore Detections: Malwarebytes will not flag or alert you regarding these items.
- Warn User: You will be alerted to these items when scanned. You may choose to ignore it, create an exclusion, or treat it as malware.
- Always detect PUPs/PUMs (recommended): The detection will always be treated as malware.
Malwarebytes Premium and Malwarebytes Trial users have the option to automatically check for protection updates and to set the interval when the checks occur. You can adjust the interval between every 15 minutes and 14 days. You can set the increment to minutes, hours, and days. The default for this feature is On. You may also have Malwarebytes display a notification in the corner of your screen if protection updates are more than 24 hours old.
These settings define how Malwarebytes behaves when your computer starts. You may launch several applications at startup, and they may initiate processes which require Malwarebytes launch timing to be adjusted. Descriptions for each setting are follows:
- Start Malwarebytes at Windows startup: If this setting is disabled, Malwarebytes will not start with Windows. No real-time protection layers will start when Windows starts, but be started manually by launching Malwarebytes.
- Delay Real-Time Protection when Malwarebytes starts: There may be times when the startup of system services used by Malwarebytes conflicts with services required by other applications at boot time. When this is the case, turn this setting on. You may also adjust the delay timing. The delay setting is adjustable from 15-180 seconds, in increments of 15 seconds.
- Enable self-protection module: This setting controls whether Malwarebytes creates a safe zone to prevent malicious manipulation of the program and its components. Checking this box introduces a one-time delay as the self-protection module is enabled.
- Enable self-protection module early start: When enabled, the self-protection module will enable earlier in the computer's boot process. This changes the order of services and drivers associated with your computer's startup.
Malwarebytes Premium and Malwarebytes Trial users can specify if malware is automatically quarantined when detected. By default, this setting is On. If the setting is toggled off, a notification will display in the lower right corner of the screen for each detection, and you must specify to ignore the detection once, ignore always (added to Exclusions) or quarantine.
Return to Malwarebytes for Windows guide v3