18 replies to this topic

[hresh]

When I click on 'Check for updates", it says, "Looking for malwarebytes.org/securitywonks.net" and stays stuck there forever.

I searched the forums and found someone with the same problem, but the solution given by Nosirrah doesn't work for me. I deleted the entire "c:\windows\system32\drivers\etc" folder to be sure.

http://www.malwarebytes.org/forums/index.p...amp;#entry30139


My laptop was recently infected by vertumonde, so I downloaded Malwarebytes and scanned. It seems to have found them and cleaned it up (shows no infections on second scan), but I still can't update

[Larry38]

hresh, on Dec 14 2008, 09:49 PM, said:

When I click on 'Check for updates", it says, "Looking for malwarebytes.org/securitywonks.net" and stays stuck there forever.

I searched the forums and found someone with the same problem, but the solution given by Nosirrah doesn't work for me. I deleted the entire "c:\windows\system32\drivers\etc" folder to be sure.

http://www.malwarebytes.org/forums/index.p...amp;#entry30139


My laptop was recently infected by vertumonde, so I downloaded Malwarebytes and scanned. It seems to have found them and cleaned it up (shows no infections on second scan), but I still can't update

Are you using the program interface and the drop down that has Malwarebytes and SecurityWonks or the tray icon?
Use the interface and set it to Malwarebytes.org.

[hresh]

Thanks for the quick reply! Yes I'm using the program interface, and setting the update mirror to either of the sites results in the same problem... It doesn't update and stays stuck at "looking for malwarebytes.org" or "looking for securitywonks.net".

[Larry38]

hresh, on Dec 14 2008, 11:17 PM, said:

Thanks for the quick reply! Yes I'm using the program interface, and setting the update mirror to either of the sites results in the same problem... It doesn't update and stays stuck at "looking for malwarebytes.org" or "looking for securitywonks.net".

I would try this first. Uninstall Malwarebytes, reboot then install a fresh version of Malwarebytes with a new installer and try again, just as a process of elimination. Post back and let us know if you still have problems.

[hresh]

Okay, I reinstalled just now... But still can't seem to connect. I'm pretty sure my internet connection is fine, because I tried it on my home PC and it updates smoothly. But it doesn't on my laptop. By the way the laptop was the infected computer, so has it got something to do with that vundo trojan?

[GT500]

hresh, on Dec 14 2008, 06:22 PM, said:

Okay, I reinstalled just now... But still can't seem to connect. I'm pretty sure my internet connection is fine, because I tried it on my home PC and it updates smoothly. But it doesn't on my laptop. By the way the laptop was the infected computer, so has it got something to do with that vundo trojan?

Possibly. Please download and run the offline database installer located here, then try another scan with Malwarebytes' Anti-Malware, and let me know if it finds anything new.

BTW: Can you visit Malwarebytes.org in your favorite web browser on the affected computer?

[hresh]

Hi. I downloaded the new database you provided and scanned, but it says my computer is clean...


Malwarebytes' Anti-Malware 1.31
Database version: 1498
Windows 5.1.2600 Service Pack 3

12/15/2008 10:23:00 AM
mbam-log-2008-12-15 (10-23-00).txt

Scan type: Quick Scan
Objects scanned: 55552
Time elapsed: 4 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



And I am now logged on to malwarebytes.org using the 'infected' computer using firefox, which I regularly use. I don't use IE on this computer.
I still could not update using the 'check for updates' button in the program. What's happening?!

[GT500]

Interesting.

Try downloading LSP-Fix, and see if it lists any problems. I don't think it will find any problems, but lets cover all of our bases.

[hresh]

LSP-Fix says no problems found....

[GT500]

I had a feeling that would be the result.

Do you know how to check proxy settings in Internet Explorer? It's quite possible that some malware set up a proxy in Internet Explorer, which MBAM would be using as well.

[Hunter]

Ditto here, slow like molasses and he same goes for www. malwarebytes.org/forums/. It takes a least a couple of minutes to reach this site. The problem started after having updates from 1497 to 1501.
There are more people having problems, see : http://www.wilderssecurity.com/showthread....065#post1367065
It have a feeling it's on on MBAM site or some network problem. All other sites I can reach within an eye blink, including but not limited to other security sites, AV sites, online AV/AS scanners, just name it: no problem whatsoever.

[hresh]

Okay, I seemed to have found the solution to my problem. It is to make sure the 'work offline' option in Internet Explorer is unchecked. I confirmed this by rechecking 'work offline'.. and guess what.. it stays stuck at "looking for .."

Simple, huh? But it sure drove me nuts, I think mainly because I never use Internet explorer: it's not my default browser. (I use firefox)
So IE was hidden away in work offline mode, and thanks to GT500 I was able to find it..

Once again thank you guys for replying.... I really appreciate it.

And you guys at malwarebytes.org doing a great job with this amazing software, cheers!

[GT500]

Hunter, the website was having some trouble last night. It appears to be fine at the moment. Are you still having trouble?

I feel I should mention that Malwarebytes.org uses at least 5TB per month of bandwidth, but the server is on a gigabit pipe, so you should still be able to get to the site and update.

hresh, I glad you found your problem. I once had a similar problem where I had set up a proxy in Internet Explorer. When the proxy didn't work, I didn't bother turning it off, because I don't use IE. This prevented MBAM from updating because MBAM draws it's connection settings from IE.

[Hunter]

I can reach the site now without any delay. Thanks GT500.

[diligentinquirer]

This post is to advise others concerning this op's situation as it has recently occurred to me, and to address a troubleshooting subject in this thread.

I have had success in solving the same problem as did this OP, but as identified in post 13 "This prevented MBAM from updating because MBAM draws it's connection settings from IE." From that info, ultimately, I made sure I was connected to broadband rather than the dialup I had started with. That new connection solved the same prob as the op (hresh) experienced.

But in post 6: "Possibly. Please download and run the offline database installer located here". I did so as did this op, and now having fixed the original problem and having updated successfully, can I now eliminate this offline installer data that is now in my puter?

Other that the "mbam-rules" exe that was downloaded, I have these two progs: MBAM-RULES.EXE-2D1A6A97.pf and also MBAM-RULES.TMP-37A54F85.pf.

Hoped I helped someone else on this prob, and hope I can find out if its safe to delete these two ".pf" files. Thanks Much, Diligent

[exile360]

Greetings .

Yes, you can safely remove the installer file. As for the .pf files, those are just leftovers in the Windows prefetch, they can be left alone and Windows will take care of them itself .

[diligentinquirer]

exile360, on May 18 2009, 06:27 PM, said:

Greetings .

Yes, you can safely remove the installer file. As for the .pf files, those are just leftovers in the Windows prefetch, they can be left alone and Windows will take care of them itself .

Thanks exile360. Appreciate your assistance. My Best, Diligent. (Happy)

[Birds]

"You have the latest database version" was the only response I got for a week when I attempted to update. However, the Listed Update Date, Database Version, and Fingerprints loaded never changed.

Removing rules.ref resulted in a message that the file was missing and an offer to download it. But the same file version that had been deleted was written back in, but with today's date.

It turned out that Internet Explorer was set to work offline. I'm posting because this appears to be a slightly different symptom of this IE setting than was so very nicely handled by the previous posts on "MBAM draws it's connection settings from IE" and the application of this principle to the Work Offline setting in IE.

Although I never use IE (and generally prohibit it from outbound communication), now I'll pay more attention to its settings.

Thanks VERY much for great information.

[AdvancedSetup]

Thanks Birds. Item #8 in the FAQ deals with that. http://www.malwareby...showtopic=10138