deanb1234

Thanks Kevin! That's a strange one, the domain names were our local AD domains, I wonder why every machine is resolving that IP for active directory. Time Warner is our internet provider, I believe there may be some DNS configuration problems on our side. Thanks again

Wasn't this resolved in the latest update?

All of my endpoints started throwing errors blocking 198.105.244.228which appears to be a local broadcast address. Appears to be a false positive. Anyone else experiencing the issue?

Response from a support engineer at MWB " it is an FP on our side. We are currently working on getting this fixed. You can put that in the exclusion list in the meantime while we get this fixed."

Same problem here, spreading throughout the enterprise.

Thanks Dylan! I've sent these instructions over to our International IT to reach the Korean office. What's really strange is that my test machine is able to access the site fine, but the entire Korean office is blocked from accessing it. It will either throw the website block if web protection is enabled or the exploit block if it's disabled. Very strange.

Yep, I even put all of the machines in a group with Web Protection disabled and now their getting an error message about exploit protection blocking an exploit. Also while working with Ron on the server issue he saw in the logs that web protection was still trying to turn on even though the policy was disabled. This is happening to ALL the machines in Korea, but not on a test machine here in the states.

Hi Dylion, When the problem was occuring yes. I've since turned that feature off and have not received any more complaints. We did have one user that was getting the same error but turns out the hard drive was bad in that particular machine. Thanks, Dean

Just to clarify it is happening on x64 systems for us.

Hi Samuel, I'm unable to gather any logs either, we've turned the machines back over to the end users and it's very hard to get them to bring machines back to us. :-) The way we fixed it was to go into safe mode and copy the .sys file giving the error from a known good machine with the same version of Windows. That resolved it. When we get another machine I will make sure the help desk gathers the logs. Thanks, Dean

Thanks! Hopefully they find something!

Had this happen on two more workstations this morning? Any updates?

There was another thread on the same issue and the person was able to use IP addresses and that solved the issue, but unfortunately that doesn't work for my environment. The sites are still being blocked. Also that's not a valid solution if a site is load balanced and has multiple random IP's.

Same here, Rootkit scanning is enabled and this is found on a TON of machines in the environment.

Thanks Kevin. I put the exception in just as you said 2 hours ago and it's still blocking it. This is happening on a few sites on multiple computers. Korean users are unable to get to www.trusbill.or.kr. I've excluded it multiple different ways, including *.trusbill.or.kr and nothing. The exclusions were working and then a few days ago they stopped.