How Malwarebytes Detects Malware
Detections carry different levels of certainty depending on which engine produced them. That context is useful when you decide whether to delete or restore.
The four techniques
- Signatures — exact fingerprints of known samples; highest certainty
- Heuristics — structural analysis of packing, imports and obfuscation
- Behavior monitoring — watching running processes for malicious patterns
- Anomaly detection — machine-learning comparison against known-good and known-bad models
Reading detection names
Names are structured, typically as category.Family.Variant. Prefixes such as Trojan, Adware, PUP, Ransom or RiskWare tell you the category, and that determines urgency: Ransom means act now, PUP means review the path first.
Why false positives occur
Heuristics and anomaly models judge structure and behavior, not identity. Packed indie software, game mods, automation scripts and system utilities can look statistically similar to malware. Restore from quarantine if you are confident about the file's origin, add an exclusion, and report it to the vendor.
Frequently asked questions
Does it detect zero-day malware?
Behavior and anomaly layers can, because they do not require a prior sample. No product detects everything.
Malware-Bytes.net is an independent information resource about malware protection for Windows. We are not Malwarebytes, and this site is not the official Malwarebytes website or support channel. Malwarebytes is a trademark of Malwarebytes Inc.