官方这段话说得蛮清楚了:Malwarebytes Anti-Malware is a complementary but essential program which detects and removes zero-day malware and "Malware in the Wild". This includes malicious programs and files, such as virus droppers, worms, trojans, rootkits, dialers, spyware, and rogue applications that many antivirus programs do not detect or cannot fully remove. That being said, there are many infections that Malwarebytes Anti-Malware does not detect or remove which any antivirus software will, such as file infectors. It is important to note that Malwarebytes Anti-Malware works well and should run alongside antivirus software without conflicts. In some rare instances, exclusions may need to be set for your specific antivirus product to achieve the best possible system performance. 关于怎么做到的,下面这段可以参考:
MBAM does not target script files. That means MBAM will not target JS, HTML, VBS, BAT, CMD, PDF, PHP, etc. It also does not target documents such as; DOC, DOCx, XLS, XLSx, PPT, PPS, ODF, etc. As an adjunct anti malware solution, MBAM leaves that to the traditional anti virus application to deal with. Until MBAM, v1.75 MBAM could not access files in archives but with v1.75 came that ability so it can unarchive a Java Jar (which is a PKZip file) but it won't target the .CLASS files within. Same goes with CHM files (which is a PKZip file) but it doesn't target the HTML files within. MBAM v1.75 specifically will deal with; ZIP, RAR, 7z, CAB and MSI for archives. And self-Extracting; ZIP, 7z, RAR and NSIS executables (aka; SFX files). MBAM specifically targets binaries that start with the first two characters being; MZ. They can be; EXE, CPL, SYS, DLL, SCR and OCX. Any of these files type can be renamed to be anything from TXT, JPG, CMD and BAT and they will still be targeted just as long as the binary starts with 'MZ'. 概括的说,就是根据文件类型来区分,如果危害文件隐藏了真实文件类型,MBAM也会通过二进制代码的开头来辨别出来。事实上,现在传统杀软也大都可以查杀木马等威胁的,不过一方面没有MBAM擅长,毕竟后者是专门做这个的,比如很多杀软查了杀不掉,MBAM就可以清除掉,但这不是最重要的,重要的是另一方面,从样本区的实际体验可以发现,很多其他杀软不报的木马,特别是网马和fakeAV之类的,MBAM都报了,而且不是误报,例如我看到过很多次几乎所有其他杀软扫出来都是干净文件,但MBAM先报了,过了一段时间后,其他杀软才入库,说明MBAM在查杀引擎上肯定有独到的技术的,只不过不为我们熟知而已。 |