Why are updates so large?

[APraxis]

before Oct 25 auto updates were less than 13mb per day, some days quite small.

then things got very bad...

Oct 25 82.39mb auto update 3.2.2.2018 1.0.188

Oct 26 58.50mb auto update

Oct 27 68.22mb full install pkg 3.2.2.2029 1.0.212 1.0.3103

Oct 28 49.33mb auto update 3.2.2.2029 1.0.212 1.0.3115

 

I use a cellular connection to the internet and have set a 2GB cap for internet traffic per month = 69mb per day.

MBAM is using up almost all of my daily allotment. If I do anything else, I'll be pushed into the next higher cost rate.

 

1) Why have the recent updates been so large?

2) Is this what I can now expect from MBAM every day?

If so I'll have to limit updates to once a week or find a different program that doesn't download this much in a daily update every day.

[Telos]

Malwarebytes may have updates available for individual program components, or for the full program. MBAM has two toggle switches which allow you to choose whether either or both upgrade modes can be integrated into your copy of Malwarebytes when they are available.  Click Install Application Updates to check for available program updates or upgrades. You can choose if you upgrade, and when. Upgrades only happen with your consent.

Users of Malwarebytes Premium and Malwarebytes Premium Trial have the ability to automatically check for protection updates, and to specify when those checks will be performed. The date range is adjustable between fifteen (15) minutes and fourteen (14) days, the increment depending on the range (minutes/hours/days). We recommend that you do not allow the rules database to become dated, as much damage can be caused by zero-day infections — those threats that are too new to be adequately protected against by anti-virus software. The default for this feature is on. You may also have Malwarebytes display a notification in the corner of your screen if protection updates are more than 24 hours old.

[bdubrow]

Hello, APraxis--

Are you still seeing large database updates?

There was a known issue from Oct. 24 - 25 where Malwarebytes 3 was pulling full versions of the database instead of the smaller incrementals.  But this was corrected as of Wednesday afternoon.  The other larger updates you had were our component update packages, e.g. going from 1.0.188 to 1.0.212. These are actually program updates, not database updates, so they'll typically be a little larger.  You're now on the latest version 1.0.212 so shouldn't see another one of those come through.

If you are still seeing larger than expected updates, we'd be happy to take a look at your service log.  You can grab it from: mbamservice log from C:\ProgramData\Malwarebytes\MBAMService\logs

Thanks!

[Canna]

That's odd.  Personally, every database update I've encountered took literally seconds to download and install.  Maybe you're referring to application updates?

[gonzo]

I would recognize @bdubrow as an authoritative voice on this issue.  She will be fully aware of any product updates, and has specifically mentioned two days worth of issues with signature updates.  As @canna said, signature updates are usually small and quick.  The dates you mention do coincide with dates that @bdubrow mentions however.

[hopper15]

2 hours ago, Canna said:

That's odd.  Personally, every database update I've encountered took literally seconds to download and install.  Maybe you're referring to application updates?

Every computer varies though. On my desktop database updates take around 15 seconds to complete.  On my laptop database updates take 2-3 minutes to complete.

[APraxis]

On 10/31/2017 at 9:37 AM, bdubrow said:

Hello, APraxis--

Are you still seeing large database updates?

There was a known issue from Oct. 24 - 25 where Malwarebytes 3 was pulling full versions of the database instead of the smaller incrementals.  But this was corrected as of Wednesday afternoon.  The other larger updates you had were our component update packages, e.g. going from 1.0.188 to 1.0.212. These are actually program updates, not database updates, so they'll typically be a little larger.  You're now on the latest version 1.0.212 so shouldn't see another one of those come through.

If you are still seeing larger than expected updates, we'd be happy to take a look at your service log.  You can grab it from: mbamservice log from C:\ProgramData\Malwarebytes\MBAMService\logs

Thanks!

Yesterday there was 19.85mb which may have been the 'signatures' (or whatever you call them) but OK, that makes sense and I'm glad that you fixed the problem.

However, I turned all Updates OFF and expected to see no internet activity yet today there was (small 12.68kb) activity. The log shows:

11/02/17    " 03:46:31.853"    14679    09ec    0a7c    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::Initialize    "UpdateControllerImplHelper.cpp"    260    "COMPONENT PACKAGE VERSION: 1.0.212, DB PACKAGE VERSION: 1.0.3148"

11/02/17    " 03:46:31.869"    14695    09ec    0a7c    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::ValidateDBManifest    "UpdateControllerImplHelper.cpp"    4102    "Signature successfully validated"
11/02/17    " 03:46:32.351"    15178    09ec    0a7c    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::ValidateDBManifest    "UpdateControllerImplHelper.cpp"    4106    "DB manifest successfully validated"
11/02/17    " 03:46:32.351"    15178    09ec    0a7c    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::CheckDbManifest    "UpdateControllerImplHelper.cpp"    4371    "Validated DB manifest - success"
11/02/17    " 03:46:32.351"    15178    09ec    0a7c    INFO    ServiceControllerImpl    ServiceControllerImplementation::StartUpdateController    "ServiceControllerImplementation.cpp"    1928    "Update Controller Started"

and the following which I'd guess is used to validate that I'm a licenced user:

11/02/17    " 03:46:33.243"    16068    09ec    0a7c    INFO    MWACControllerCOM    CMWACController::StartV2    "MWACController.cpp"    231    "Initializing MWAC Controller"
11/02/17    " 03:46:33.294"    16114    09ec    0a7c    INFO    MwacControllerImpl    mb::mwaccontrollerimpl::MwacControllerImpl::IsLicenseStateValid    "MWACControllerImplHelper.cpp"    494    "license state is: Licensed"

followed by lots of repeating of : "error connection refused" since I wasn't connected to the internet at THAT time.

and later when I clicked the manual Check Update:

11/02/17    " 06:15:17.500"    8940323    09ec    0c50    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::DoUpdate    "UpdateControllerImplHelper.cpp"    534    "DoUpdate - Starting check for updates (manual)"
11/02/17    " 06:15:17.500"    8940323    09ec    0c50    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::DoUpdate    "UpdateControllerImplHelper.cpp"    536    "Checking for: Installer=[No], SDK/Ctlr=[No], DB/CLS=[Yes]"
11/02/17    " 06:15:18.574"    8941400    09ec    0c50    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::GetInstalledPkgVersions    "UpdateControllerImplHelper.cpp"    1173    "DB/ClsEng package --> [mbam-c.dbcls.64bit], current version: [1.0.3148]"

-----

11/02/17    " 06:15:19.648"    8942460    09ec    0c50    INFO    UpdateControllerImpl    mb::updatecontrollerimpl::CUpdateControllerImpl::DoUpdate    "UpdateControllerImplHelper.cpp"    566    "Checked for updates - no updates available"

Since I've never had MBAM warn me of anything, I'm only going to check once per week. manually.

Thanks for your response...