

- MALWAREBYTES OFFLINE UPDATE DEFINITIONS MANUAL
- MALWAREBYTES OFFLINE UPDATE DEFINITIONS FULL
- MALWAREBYTES OFFLINE UPDATE DEFINITIONS PORTABLE
- MALWAREBYTES OFFLINE UPDATE DEFINITIONS SOFTWARE

I did this in a batch file with the help of wget. So with this information, we can script something up that will automatically put the latest database version integer in to the /data/rules.ref request. If it finds that /version.check returns a later version, it fires off a GET request to /data/rules.n.ref So it checks the local definitions database against /version.check. I did a bit more digging around in Wireshark in an attempt to find the URL used to download the actual definitions file… I found this: Going on to that page will return an integer which represents the latest database version (definitions file) – go on, give it a try:
MALWAREBYTES OFFLINE UPDATE DEFINITIONS FULL
Okay so this gives us the full URL used for the ‘version.check’ page.

Hmmm… looked tasty, so I inspected the packet in more detail: I came across several URLs in the output, one of which was:
MALWAREBYTES OFFLINE UPDATE DEFINITIONS SOFTWARE
I used Wireshark to see exactly what was going on when an update was performed in the actual software interface.
MALWAREBYTES OFFLINE UPDATE DEFINITIONS PORTABLE
MALWAREBYTES OFFLINE UPDATE DEFINITIONS MANUAL
They even say the that the manual update will always be way out of date.UPDATE 05/2015: See version 2 of the script where I have written it in PowerShell. It would be bad if they did not provide a way to do it manually, but they do and the steps are in the FAQ section. You can also download a manual update from here - NOTE: This manual update will always be way behind in version level compared to updates from within the program.Īs far as I am concerned, the manuel way of just coping the files from one computer to another is just as effective as using the downloaded rules.exe file. Note: Starting with Malwarebytes Anti-Malware 1.60, you must also copy the file nf located within the Configuration folder which is in the same folder as rules.ref listed above.
