Clearing Malwarebytes log
=========================

Malwarebytes (Threat Down) creates and stores logs related to web events locally at ``C:\ProgramData\Malwarebytes\MBAMService\MwacDetections``. These files are not automatically removed.
When malwarebytes is running on a Windows server hosting a website using IIS this can result in an excessive quantity of logs created every day. To resolve this issue, run this script once per day to remove those logs.

To stop the malwarebytes service we have to use the `Endpoint Agent Command-line tool <https://support.threatdown.com/hc/en-us/articles/4413799324691-Use-the-Endpoint-Agent-Command-line-tool-with-Nebula>`_ . 
In order for this work `tamper protection <https://support.threatdown.com/hc/en-us/articles/4413799066643-Tamper-protection-policy-settings-in-Nebula>`_ must be turned off. 
On the cloud you can disable this under ``Configure - Policies - [policy name] - Tamper protectio - Uninstall and Command Line Protection``.

Once this is done you can schedule this script to run using task scheduler.

clear_malwarebytes_log.bat ::

    Rem Stop MalwareBytes Endpoint agent and Malwarebytes service services
    "C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe" -stopmbamservice 

    Rem sleep for 30 seconds, allow the service to fully shut off
    timeout 30

    Rem change directories and remove files in that directory
    cd C:\ProgramData\Malwarebytes\MBAMService\MwacDetections
    del /Q .\*.json

    Rem Start MalwareBytes Endpoint agent and Malwarebytes service services. MBEndpointAgent will also start the MBAM service.
    "C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe" -startmbamservice 


You can see this on githut here: `https://github.com/Jamous/clear_malwarebytes_log <https://github.com/Jamous/clear_malwarebytes_log>`_