Unable to connect to Malwarebytes server

I have three computers on the same network. All running Win 10 Pro.
About 2 weeks ago two of the computers stopped getting updated from MWB. I tried manually updating but get an error message saying that it couldn't connect to the update server.
I'm not sure if this coincided with the Windows anniversary update but all three computers have been updated.
I can't work out why 1 computer will connect but not the other 2.
I have tried turning off windows firewall but that didn't help.
I have tried connecting through a VPN. Same result.
I can't even access the free download on MWB site. It appears that all of their servers are blocked on these 2 computers.
Using the sticky at the top of this forum I used the third computer to get the update. I installed it on this computer hoping that the new version might fix the problem but it still can't access the update server.

This has me completely stumped.

Any help would be greatly appreciated.

Thanks

Hi:

There are many possible reasons for updating issues.
To name a few: incorrect system date/time, software conflict (especially AV or firewall), system configuration issues or damage, networking problems, license validation issues, update server/CDN issues, even malware.

We would need a bit more information in order to tease this out to determine a likely cause and solution.

It sounds from your post as if you may have updated the system(s) to Win10 AU with MBAM installed?
If so, the OS upgrade may have caused minor corruption with MBAM.
(This is why MS and most of the major security software vendors suggest temporarily uninstalling your AV and security apps before upgrading to AU...)

So, the first thing to try would be a proper clean reinstall of MBAM.
The instructions are HERE.

Let's work on ONE computer at a time, to minimize confusion.

Notes:

• If you run MBAM Premium, please have your license info (Key +/- ID) handy before you start. You will need the info to activate the program to Premium after reinstalling.
• If you run MBAM Premium, please DEACTIVATE your account before you start (dashboard > my account > deactivate).
• Please follow the instructions carefully, including rebooting when prompted by the removal tool (important!) and again after the reinstall.

Please let us know if that resolves your issue.

We'll go from there,

MM

Thank you for your reply.
I have followed those instructions. I used mbam-clean to remove MWB.
Re-installed. It still can't access the update server.
I don't believe it is a problem with MWB itself. I can't access any downloads from them even in my browser. I had to use the other computer, the one that is updating, to download the mbam clean.

I have compared the time on the two computers that are not updating and the clocks are about 1-2 seconds apart. I don't know if that is an issue.

Once again thank you for the reply.

Hi:

I assume you rebooted twice (once when prompted by the removal tool and again after reinstalling)?

If so, and it's still not working, the next quick thing to try:

1) Please open a command prompt and type in the following:


nslookup data-cdn.mbamupdates.com <enter>


>>>What do you get?

2) Then type in the following:


ping data-cdn.mbamupdates.com <enter>


>>>What do you get?
----------------------

<enter> = press the ENTER key

If you can please post a screen shot of both outputs, that would help.

Thanks,
MM

Ok.

Here are the screenshots. The ping failed completely.

This is the ping from the computer that will update

Hi:

Thanks for that.

I just tried it on my own Win10 box, which is updating normally, and had no trouble with the ping.

There are a few similar reports now at the MBAM support forum (although the OPs have not yet posted their test results). So it's not clear if their underlying problem is the same or not.

It's possible that there may be a problem with part of the cdn that handles MBAM updates.

For the moment, I suggest the following:

1. If you do not already have one, create an account at the MBAM forum and start a new post HERE, including if you wish a link back to this thread here at tenforums (or at least the same command prompt screen shot you posted here).
   
   1. That is probably the most efficient way to alert the folks at Malwarebytes support, so that they can investigate a possible network/cdn issue.
   
   
2. Alternatively, you could read this pinned post HERE and then please ATTACH all 3 logs to your next reply here in this thread.
   
   1. The 3 logs will be: FRST.txt, Addition.txt and CheckResults.txt
   2. They *may* point to something else as the underlying cause, perhaps a software conflict from your AV/firewall, etc..
   3. The same 3 logs will also be helpful at the MBAM forum, if you end up over there.
   
   

Thanks,

MM

That's odd, @MoxieMomma did you spot that in the screen shot nslookup says the ip address is 205.185.208.98 but the ping that fails is pinging a totally different address 54.230.89.168 ? That one is apparently an Amazon address.

54.230.89.168 Information
We found that the organization for IP address 54.230.89.168 is Amazon Technologies in Seattle, Washington, United States.

http://54.230.89.168.ipaddress.com/

One possibility could be that some malware has added this as a redirect in the HOST table to compromise Malwarebytes' ability to find it.

Edit: The 54.230.89.168 IP shown in your first screen shot is very different from the one in your other shot and in my own attempt to reproduce the issue (205.185.208.98)

I'm not yet sure what to make of that. It does seem to suggest a possible cdn issue, but I am not expert enough to know for sure.

But my suggestions would be the same:

1. The most efficient thing to do would probably be to report directly at the Malwarebytes support forum.
2. But if you want to post the 3 requested diagnostic logs here first or instead, I'll be happy to take a look at them.

MM

Bree said:

That's odd, @MoxieMomma did you spot that in the screen shot nslookup says the ip address is 205.185.208.98 but the ping that fails is pinging a totally different address 54.230.89.168 ? That one is apparently an Amazon address.


http://54.230.89.168.ipaddress.com/

One possibility could be that some malware has added this as a redirect in the HOST table.

Yes, we were posting at the same time.
Great minds think alike.

My suggestions are the same, for now.

P.S. AmazonAWS itself is not worrisome. Malwarebytes uses them for their cdn. And that IP checks out OK.