Jump to content

eshah

Members
  • Posts

    3
  • Joined

  • Last visited

Reputation

0 Neutral
  1. @Portos, Thank you. But this doesn't answer my question. The questions is how is the traffic Malwarebytes report it is blocking not logged in the Windows Firewall logs, when both Dropped as well as Allowed traffic is being logged? There are only 3 possible explanations I can think of: 1) MWB is examining the incoming traffic PRIOR to the Windows Firewall (which is contrary to what I read elsewhere) 2) Windows Firewall logs are unreliable and are not logging everything. Of course this is unlikely! 3) MWB is reporting is incorrect (wrong IP address, etc.) Again, this is unlikely!
  2. Sorry, I meant to say "In Windows Firewall, I have enabled logging "allowed" as well as "blocked" traffic"
  3. I am seeing Malwarebytes reporting blocking a compromised web site. Below is what it exports. I have enabled logging "allowed" as well as "blocked" traffic. Yet, I cannot find the listed IP address in the logs. I remember reading somewhere on MWB website that Malwarebytes only sees traffic that goes thru the Windows Firewall. If so, how is it possible that MWB is reporting blocking traffic that the Firewall logs do not have any records of? MWB export data: Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 5/26/21 Protection Event Time: 11:09 AM Log File: 5422de84-be34-11eb-8157-5404a604de73.json -Software Information- Version: 4.2.0.82 Components Version: 1.0.1070 Update Package Version: 1.0.40940 License: Premium -System Information- OS: Windows Server 2012 R2 CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Windows\System32\svchost.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Compromised Domain: IP Address: 121.186.193.60 Port: 3389 Type: Inbound File: C:\Windows\System32\svchost.exe (end)
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.