Malwarebytes Tips

The way to install and use this (warning: software functionality not thoroughly tested)

To install this you need to grab the installer and run it in an XP bottle that has Visual Basic 6 runtime installed. Avoid CNET if you can. Use Filehippo instead.

This is how I used this. Mount the drive or partition you want to scan, then map it to a drive by using wine's config utility:



Configure MBAM to ignore drive C: and anything else that is not the actual scanning target. Select the Perform full scan option and leave selected only the target drive. It will still try to scan memory and the registry and it will come up with some bogus registry entries. It's not the registry entries that we should care about but the actual files that it finds.

Here's a screenshot I took after scanning a folder in which I placed two files I had downloaded from sites listed on malware domain list:



And this is a screenie took after telling MBAM to move the files to quarantine:



The point of the exercise to not to have protection for your linux system. It's to get a second opinion scanner to complement something like Avast AV for Linux.

For those that have time or care to experiment further, you could create a virtual machine in virtualbox and infect it, then use vdfuse to mount the virtual drive (which is usually a VDI) file, map that to a wine bottle as above and use mbam to scan. After carefully looking at the files it found and moving those to quarantine, boot the virtual machine up (after unmounting the VDI that was previously mounted)  and see if it's clean or if it even boots up.

Feel free to rate after testing. Since this is too early for me, I did not give it a rating even if it runs and appears to work fine.

by Silviu Cojocaru on 2013-07-31 16:01:43
Important Information Tips are provided by the CrossOver Community and Advocates. They are not intended to be used for official CodeWeavers Support. For that, please visit our official support pages.
CodeWeavers or its third-party tools process personal data (e.g. browsing data or IP addresses) and use cookies or other identifiers, which are necessary for its functioning and required to achieve the purposes illustrated in our Privacy Policy. You accept the use of cookies or other identifiers by clicking the Acknowledge button.
Please Wait...
eyJjb3VudHJ5IjoiVVMiLCJsYW5nIjoiZW4iLCJjYXJ0IjowLCJ0enMiOi02LCJjZG4iOiJodHRwczpcL1wvbWVkaWEuY29kZXdlYXZlcnMuY29tXC9wdWJcL2Nyb3Nzb3Zlclwvd2Vic2l0ZSIsImNkbnRzIjoxNzM4NzIzMjIwLCJjc3JmX3Rva2VuIjoiM3l1M2t4NUJYeG1nWTZHTCIsImdkcHIiOjB9