Scheduled update failed

[mynorgeek]

I own a couple Pro licenses.

I don't run MBAM in real-time, but I have the program configured to update daily at 3 AM and scan afterwards on a couple computers.

I opened the program today and was met with a pop-up dialog saying the database (6567) was more than one day out of date.

I checked the logs and found that the last attempted daily update failed.

The log entry says:

ERROR Scheduled update failed: WinHttpSendRequest failed with error code 12007

I was able to update manually to database version 6582.

I'll know tomorrow morning if the scheduled 3 AM update failed again.

In the meantime, I thought I would report this condition here in the forum.

I've never encountered this before, as the scheduled daily update has always performed as configured.

Edit in: After manually updating, I ran a quick scan on both computers and no infections present. Also running the other security apps in my signature, and have made no recent changes EXCEPT for switching over to Norton DNS service from ClearCloud DNS right around the time that this issue appeared.

[mynorgeek]

I was able to update manually to database version 6582.

I'll know tomorrow morning if the scheduled 3 AM update failed again.

Reporting back... the scheduled 3 AM update did not happen.

There was no log entry like the one that appeared yesterday that said, "ERROR Scheduled update failed: WinHttpSendRequest failed with error code 12007".

There is only the log entry for the scheduled scan that did take place.

The last update was the one I performed manually yesterday to version 6582.

I'm not going to try anything else until I hear back.

[exile360]

It sounds like you may need to set exclusions in your new DNS software for mbamservice.exe, that is likely the cause of the issues. Also, if you're now using a proxy and you weren't before, you'll need to configure that in the Updater Settings tab located in the Settings tab of Malwarebytes' Anti-Malware so that it matches your system's proxy settings.

[mynorgeek]

It sounds like you may need to set exclusions in your new DNS software for mbamservice.exe, that is likely the cause of the issues. Also, if you're now using a proxy and you weren't before, you'll need to configure that in the Updater Settings tab located in the Settings tab of Malwarebytes' Anti-Malware so that it matches your system's proxy settings.

Like you, I suspected Norton DNS service because it coincided with the MBAM updating issue. However, there is no software for me to set an exclusion in... "setting up" Norton DNS on WinXP simply involved going to the General tab of Internet Protocol (TCP/IP) Properties, selecting Use the following DNS server addresses, then entering the two Norton DNS IP addresses 198.153.192.1 and 198.153.194.1. I could switch back to ClearCloud DNS (was using it steadily for a couple of months) very easily and see if it fixes this problem. The only thing that made me question if it really was Norton DNS is that I can manually update with no problem. Also, not using a proxy.

Thanks for the reply, Exile.

[mynorgeek]

I have changed back to ClearCloud DNS, so Norton DNS is no longer in the picture, and I've reset the updates to take place hourly... so I should be able to report back before long if the DNS service change made a difference. Plus I'll search around the Norton DNS forum to see if anyone has come across this blocking behavior with MBAM auto updates.

[mynorgeek]

I've had one auto-update occur since removing Norton DNS service and reverting to ClearCloud.

I will continue to monitor it, but I believe this is the cause.

I've posted on the Norton Community forum and submitted a false detection report to Symantec.

[exile360]

Thanks for the update and for testing this, and also thank you very much for reporting the issue to Symantec. I hope they are able to resolve the problem quickly.

Please let us know how it goes with them.

Thanks

[mynorgeek]

Well, so far there's been no response to the post I put up on the Norton Community forum. And I filled out a false detection submission form here, but I could tell right away that it wasn't designed for Norton DNS service, and the email response I got back was disappointing...

We are writing in relation to your submission through Symantec's on-lineSecurity Risk / False Positive Dispute Submission form. The informationyou have provided is not related to a Symantec product detection or False Positive detection.

So, I'm not real enthusiastic about getting it fixed.

Maybe the Norton Community forum post will draw some viewers who can make a change.

In the meantime, I'm good with ClearCloud DNS and my scheduled MBAM auto-updates are back on track like they used to be.

PS- I did reply to Symantec's email and tried to give them more detail.

[mynorgeek]

Thanks for the update and for testing this, and also thank you very much for reporting the issue to Symantec. I hope they are able to resolve the problem quickly.

Please let us know how it goes with them.

Thanks

The problem has been fixed. I'm back to using Norton DNS and have temporarily scheduled MBAM to auto-update hourly. Nothing is being blocked, no error messages in the MBAM log, and all is well once again.

[exile360]

Excellent, so Symantec replied and fixed the issue?

[mynorgeek]

Excellent, so Symantec replied and fixed the issue?

They replied, but it was in regards to what they deemed an invalid submission (?).

So I wrote back with more detail, and never heard another peep.

Who knows... maybe they fixed something, or maybe it was all just a big coincidence.

But it's working now.

[exile360]

Well, either way, I'm glad they're playing nicely together now, that's always good news .

Thanks again for the follow up.