MalwareBytes AntiMalware v1.31

"Andy Walker" wrote in message

> Heather wrote:
>
>>"Dustin Cook" wrote in message
>>
> <snip>
>
>>Yes to both, son.
>
> Is it true that Dustin was put up for adoption because he was a
> colicky baby?

Nah, he was a "perfect baby"......just ask his Mum, lol.
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

PAJ wrote in


> On Fri, 5 Dec 2008 13:59:28 -0500, "Heather"
> wrote:
>
>>Hey Dustin......I had put this latest version on here yesterday. Today
>>it won't update.....saying I am not connected to the internet or check
>>my firewall, etc. My XP firewall is on and I am connected via cable.
>>Is this a bug in the program??
>
> Mine has had this problem for over 2 weeks.
> Auto update usually fails. if I go straight back in and run the update
> manually it mostly works. When it does fail manually (rarely) it is
> always set to the securitywonks site.
>

securitywonks has been having occasional issues, and I suspect most of the
failures can be attributed to that mirror. For the time being, I'd
recommend before hitting the button, that you make sure the selected mirror
is malwarebytes.org.


--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

"Heather" wrote in
@news.motzarella.org:

> "Andy Walker" wrote in message
>
>> Heather wrote:
>>
>>>"Dustin Cook" wrote in message
>>>
>> <snip>
>>
>>>Yes to both, son.
>>
>> Is it true that Dustin was put up for adoption because he was a
>> colicky baby?
>
> Nah, he was a "perfect baby"......just ask his Mum, lol.

Oh... No, she wouldn't lie for me...
Nice joke btw.


--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

"Dustin Cook" wrote in message


Hey Dustin,

Do you have any insight to this posters problem?:

"Just found something out about Malwarebytes that I don't like,
and maybe it can be fixed. It's a minor annoyance, but it is an
annoyance,
nonetheless. It seems that if you don't leave I.E., or I assume O.E.,
or
WMP in an online state when they were last used, Malwarebytes can't
access
the Internet. However, if I open I.E., go online with it, then close
it,
then I can hit the Update button and get a connection to the update
site.
I've looked for an "Ignore offline state", or something like it, and the
only thing I can find related to I.E. is terminating it before removal.
I
don't use I.E. I hate I.E. I use Firefox, because it doesn't give a
rip
what state that online/offline "switch" is flipped. If it can't
connect, it
can't connect. Neither Ad-Aware nor Spybot cared one way or another,
either. Got any ideas, or am I just going to have to put up with this?"

TIA,
-jen
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

That's an interesting bug. I was able to duplicate it by selecting in IE to
work offline. Also if you go to settings in MBAM and select terminate IE
before removal it will toggle IE back online and you will then be able to
update. Should be a simple fix, just have MBAM use Explorer to update
instead of Internet Explorer.



--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/




"jen" wrote in message

> "Dustin Cook" wrote in message
>
>
> Hey Dustin,
>
> Do you have any insight to this posters problem?:
>
> "Just found something out about Malwarebytes that I don't like,
> and maybe it can be fixed. It's a minor annoyance, but it is an
> annoyance,
> nonetheless. It seems that if you don't leave I.E., or I assume O.E., or
> WMP in an online state when they were last used, Malwarebytes can't access
> the Internet. However, if I open I.E., go online with it, then close it,
> then I can hit the Update button and get a connection to the update site.
> I've looked for an "Ignore offline state", or something like it, and the
> only thing I can find related to I.E. is terminating it before removal. I
> don't use I.E. I hate I.E. I use Firefox, because it doesn't give a rip
> what state that online/offline "switch" is flipped. If it can't connect,
> it
> can't connect. Neither Ad-Aware nor Spybot cared one way or another,
> either. Got any ideas, or am I just going to have to put up with this?"
>
> TIA,
> -jen
>
>
>
>
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

"jen" wrote in


> "Dustin Cook" wrote in message
>
>
> Hey Dustin,
>
> Do you have any insight to this posters problem?:

Yep. Our updater is really an Internet Explorer window; so if IE is
toggled to offline, so is our updater.

Also, if IE is configured to use a proxy and it's not operational for
some reason, our updater will fail.

I have requested this be changed in a future release so that we are not
dependant on Internet Explorer for anything... However, that's still a
ways away.

So, the jest of it is this: If Internet Explorer won't surf, our updater
won't run.

The other applications mentioned aren't simply asking internet explorer
to access the net, so they don't care what it's specific settings are.


--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

"The Real Truth MVP" wrote in


> That's an interesting bug. I was able to duplicate it by selecting in
> IE to work offline. Also if you go to settings in MBAM and select
> terminate IE before removal it will toggle IE back online and you will
> then be able to update. Should be a simple fix, just have MBAM use
> Explorer to update instead of Internet Explorer.

It's not a bug.

We use Internet Explorer for the updating. If you have configured internet
explorer for offline mode, well; our updater is offline then too.



--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

"Dustin Cook" wrote in message

> "jen" wrote in
>
>
>> "Dustin Cook" wrote in message
>>
>>
>> Hey Dustin,
>>
>> Do you have any insight to this posters problem?:
>
> Yep. Our updater is really an Internet Explorer window; so if IE is
> toggled to offline, so is our updater.
>
> Also, if IE is configured to use a proxy and it's not operational for
> some reason, our updater will fail.
>
> I have requested this be changed in a future release so that we are
> not
> dependant on Internet Explorer for anything... However, that's still a
> ways away.
>
> So, the jest of it is this: If Internet Explorer won't surf, our
> updater
> won't run.
>
> The other applications mentioned aren't simply asking internet
> explorer
> to access the net, so they don't care what it's specific settings are.

Thanks a million, Dustin!

-jen
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

jen wrote:

>Thanks a million, Dustin!
>
>-jen

Which is it; Jen or Dustin?

--
Andy - who is playing off the comma, which would normally proceed the
name of the "Thanker"...
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

This message is not archived
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

Dustin Cook, my dear, dear friend, there was this time, oh, 12/13/2008
5:23 PM or thereabouts, when you let the following craziness loose on
Usenet:
> "jen" wrote in
>
>
>> "Dustin Cook" wrote in message
>>
>>
>> Hey Dustin,
>>
>> Do you have any insight to this posters problem?:
>
> Yep. Our updater is really an Internet Explorer window; so if IE is
> toggled to offline, so is our updater.
>
> Also, if IE is configured to use a proxy and it's not operational for
> some reason, our updater will fail.
>
> I have requested this be changed in a future release so that we are not
> dependant on Internet Explorer for anything... However, that's still a
> ways away.
>
> So, the jest of it is this: If Internet Explorer won't surf, our updater
> won't run.
>
> The other applications mentioned aren't simply asking internet explorer
> to access the net, so they don't care what it's specific settings are.
>
>

Can't for the life of me think of why you'd make your updater dependent
on IE instead of just grabbing the default.

Surely you don't need anything IE-specific to send definition updates?

Cool that you've requested the change, but it should be the smallest of
tweaks to the code (assuming, again, that your updating service isn't
*dependent* on IE for some reason).

By the way, certain variants of the AV2008/AV2009 bug are now blocking
MalwareBytes from being installed on infected machines. Normal
workarounds (changing the name of the installation file, trying to
install in Safe Mode, etc) seem ineffective. I'm sure you're aware of
this already, but thought I'd mention it.

Cheers.
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

"Kyle T. Jones" wrote in


> Dustin Cook, my dear, dear friend, there was this time, oh, 12/13/2008
> 5:23 PM or thereabouts, when you let the following craziness loose on
> Usenet:
>> "jen" wrote in
>>
>>
>>> "Dustin Cook" wrote in message
>>>
>>>
>>> Hey Dustin,
>>>
>>> Do you have any insight to this posters problem?:
>>
>> Yep. Our updater is really an Internet Explorer window; so if IE is
>> toggled to offline, so is our updater.
>>
>> Also, if IE is configured to use a proxy and it's not operational for
>> some reason, our updater will fail.
>>
>> I have requested this be changed in a future release so that we are
>> not dependant on Internet Explorer for anything... However, that's
>> still a ways away.
>>
>> So, the jest of it is this: If Internet Explorer won't surf, our
>> updater won't run.
>>
>> The other applications mentioned aren't simply asking internet
>> explorer to access the net, so they don't care what it's specific
>> settings are.
>>
>>
>
> Can't for the life of me think of why you'd make your updater
> dependent on IE instead of just grabbing the default.

That's a question I will have to forward along to Marcin. I don't develop
the windows code.

> Surely you don't need anything IE-specific to send definition updates?

Oh, no. A simple http GET works.

> By the way, certain variants of the AV2008/AV2009 bug are now blocking
> MalwareBytes from being installed on infected machines. Normal
> workarounds (changing the name of the installation file, trying to
> install in Safe Mode, etc) seem ineffective. I'm sure you're aware of
> this already, but thought I'd mention it.

We are aware of this. It's actually a TDSS rootkit variant that typically
gets installed along with AV2008/2009 that is blocking us. Once the
driver is disabled however, we own it pretty quick.


--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
 >> Stay informed about: MalwareBytes AntiMalware v1.31 

This message is not archived
 >> Stay informed about: MalwareBytes AntiMalware v1.31