Application Logs

As part of normal program operation, Malwarebytes Anti-Malware produces two different logs. The Protection Log is a daily log which itemizes critical events of real-time protection, as well as updates to the Malwarebytes rules database. The Scan Log is a event log which shows program configuration and results of each scan that has been executed on the computer which Malwarebytes is installed on. The Application Logs program screen is shown below.

This page allows the user to view and/or delete logs. By selecting a specific log, it may also be exported to other formats. Let's look at these more in depth...

Protection Log

The Daily Protection Log shows information in three main categories — updates, protection and scans. A single log is produced daily, beginning with the first activity which fits log criteria, and is updated throughout the day with subsequent activity. The Daily Protection Log is shown below.

Update entries are typically limited to updates to our rules databases (malware and rootkit), the intelligence behind all Malwarebytes protection. Entries will also be created for failed updates, which may at times be an indication of a system problem. Protection entries are related to status changes of real-time protection, as well as integration of updates into real-time protection. Scan entries are single-line summaries of scans which have taken place during the day. These are not meant to replace the more detailed Scan Log, which is described in the next section.

By clicking on the headers in the table, you will be able to sort information according to your needs. At the bottom of the Daily Protection Logs, you will also note output options. You may Copy to Clipboard, which allows log data to be imported directly into another document. You may also Export log data into a number of formats, as listed here:

• Text file (.txt) — A generic text file (in comma-delimited format) which may be used directly or input into a program of your choice.
• Extensible Markup Language (XML) file (.xml) — A file utilized by XML parsers (or other intermediate processing) to categorize and present data based on requirements of other applications.

Scan Log

A Scan Log is created each time that a scan is executed. Scan logs are stored in:

• Windows XP: C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Logs
• Other OS versions: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs

If you have installed Malwarebytes in a non-standard installation path, these locations will be different. Also, you may have elected to store logs in another location separate from the program installation path. You may confirm that by checking History Settings. Scan logs are (by default) stored in XML format.

Each time a scan is executed, a log is created. The above screenshot shows the Scanning History Log as it is viewed from within the Malwarebytes Anti-Malware user interface. The top portion provides a rundown of your system specifications and Malwarebytes Anti-Malware program settings. The bottom portion is a listing of any threats detected during execution of the scan. Please note that if no threats are detected during a scan, the upper part of this screen will expand to fill the full screen area.

The following information is presented on the Scanning History Log. All information except Detected Threats is in the top (scrollable) portion, while Detected Threats make up the bottom portion of the screen. Please note that the sections shown below do not exist in the log itself. They are presented here to help you understand the way that information is grouped.

• Scan Information
  • Scan Date: Date when scan was executed
  • Scan Time: Time when scan was completed
  • Logfile: Log file name, which includes year, month, day, hour, minute, and second in the filename. Times use a 24-hour clock, and are referenced to the start time of the scan.
  • Administrator: Whether the user running the scan was logged on with administrator rights
• Version Information
  • Version: Malwarebytes Anti-Malware program version
  • Malware Database: Malwarebytes rules database version
  • Rootkit Database: Malwarebytes Anti-Rootkit database version
  • License: License type (valid values are Free, Premium or Trial)
  • Malware Protection: Whether malware protection is enabled (valid values are enabled or disabled)
  • Malicious Website Protection: Whether malicious website protection is enabled (valid values are enabled or disabled)
  • Self-protection: Whether Chameleon self-protection is enabled (valid values are enabled or disabled)
• System Information
  • OS: Operating System version, which also may contain Service Pack information
  • CPU: CPU type (valid values are x86 and x64)
  • File System: File system used on the primary (OS) disk drive (valid values are NTFS, FAT and FAT32)
  • User: Windows user name associated with this scan
• Scan Details
  • Scan Type: Type of scan executed (valid values are Threat Scan, Custom Scan, Hyper Scan and Context Scan)
  • Result: Final scan result (valid values are cancelled, completed or failed)
  • Objects Scanned: Number of objects scanned
  • Time Elapsed: Elapsed time of scan, from start to finish
  • Remaining Categories: For each category, the number of items detected during the scan
• Object Types/Targets Scanned
  • Eight object types/targets are listed. Each may be enabled (included in scan) or disabled (excluded from scan)
• Detected Threats
  • Threats detected during scan execution, containing the following information:
    • Vendor: Name of threat, or threat family (as categorized by Malwarebytes Research team)
    • Type: Container in which the threat was detected (file, registry key)
    • Path: Location where the threat was found; This will be a directory/file name for file system-based threats, and key/value name/value data for registry-based threats
    • Action: What action was taken with regard to the detected threat
    • ID: This is the identifier that Malwarebytes Research team uses for the specific threat. This may be requested by Malwarebytes Technical Support if a question arises pertaining to blocking of a specific threat.

An Export button is shown at the bottom left corner of this screen. This allows you to make a copy of the log for use by other programs. You may export to your clipboard, text (TXT) file, or Extensible Markup Language (XML) file. The clipboard and text files are presented on a line-by-line basis, while the XML file is formatted according to XML standards.

Viewing or Deleting Logs

You may view any log file by clicking the log to select it, then clicking the View button. As mentioned previously, there are several output options for Protection Logs. A single format is available for Scan Logs, as chosen in History Settings. To delete logs, click the checkbox corresponding to those logs you wish to delete, then click the Delete button. To delete all logs at once, click the Delete All button. When deleting all logs, you do not need to select any specific logs to enable this action.

Please bear in mind that computers which have significant threat activity will also have logs of significantly larger size. You should periodically check how much disk space is being used for logs, so that logs do not impact normal operation of your computer.