Jump to content

Twisted_Code

Members
  • Posts

    4
  • Joined

  • Last visited

Posts posted by Twisted_Code

  1. Ever since a certain piece of malware hit the Modded Minecraft community last June, I've been intermittently (though more frequently in the past week) getting "MaliciousInboundSocket" when trying to use AuthMe, a Minecraft mod for refreshing your authentication session with Microsoft/Mojang's account servers. I get wanting to protect me from more malware of this type, and I guess there MIGHT be cases where localhost-localhost sockets are malicious, but this is obviously not one of those cases.

    Quote

    Malwarebytes
    www.malwarebytes.com

    -Log Details-
    Protection Event Date: 3/6/24
    Protection Event Time: 6:47 AM
    Log File: 595f76aa-dbaf-11ee-83cb-7c10c940f9d3.json

    -Software Information-
    Version: 4.6.8.311
    Components Version: 1.0.2259
    Update Package Version: 1.0.81836
    License: Premium

    -System Information-
    OS: Windows 10 (Build 19045.3930)
    CPU: x64
    File System: NTFS
    User: System

    -Exploit Details-
    File: 0
    (No malicious items detected)

    Exploit: 1
    Exploit.JavaMaliciousInboundSocket, , Blocked, 150, 392684, 0.0.0, , 

    -Exploit Data-
    Affected Application: Java
    Protection Layer: Application Behavior Protection
    Protection Technique: Java malicious inbound socket detected
    File Name: 
    URL: 

    (end)

    I've looked around a bit in my Malwarebytes control panel for a way to add an exclusion for my own IP address, as GENERALLY I don't have malware already on my system (I am USUALLY careful, e.g. checking code signing certs before installing things), and the specific attack I think this detection is meant to block didn't work that way anyway. However, thus far I have not found a way to do this, and have to fall back on temporarily disabling RTP when I got to use the affected callback.

    Note: operative words are in bold. I am well aware these are, even for me, only "generally" true; if I were infallible and immune to social engineering, I probably wouldn't need your software, thanks for making it <3.

  2. 1 minute ago, Porthos said:

    That is exactly what I am talking about. I am discussing during game play.

    I'm not sure I understand... are you saying that it thinks Don't Starve Together is trying to treat that other server as part of a torrent network? Doesn't steam exclusively handle downloads on behalf of games running under it?

  3. 4 hours ago, Porthos said:

    As for why Malwarebytes blocks Steam, Epic and other games, this is because Steam is Torrent based software, are what are known as Peer-to-Peer (P2P) applications meaning it connects to many different servers/IP addresses (this is how files are downloaded through Torrent based software) and because of this, sometimes Torrent based software will connect to a server that is also known for hosting malicious content.  This is because servers/IP addresses are often shared by multiple sites, so while what you are Playing/downloading through Torrent based software may be perfectly safe, some of the sites hosted on some of the IP addresses that Torrent based software connects to may be malicious.  Such connections are not a threat however, and you may exclude Torrent based software from the Web Protection component in Malwarebytes to stop the blocks from happening without compromising your protection (your web browser and other critical web facing programs will still be fully protected from malicious websites and other malicious content).  To do so, add the game exe to your exclusions using the method described under the Exclude an Application that Connects to the Internet section of this support article.

    that didn't seem to address my question. I'm talking about connecting to game servers within a game that's already downloaded. The game has a list of public game servers. Your reply seemed to be about something else. (Although, for what it's worth, I did not know steam used a torrent/swarm-style download network, so I still learned something new.)

  4. Why do I get connection blocked warnings while browsing public game server lists on Don't Starve Together? Someone else posted a thread about this a while back, and I was wondering WHY it happens, since I don't quite feel comfortable saying "oh this seemingly severe warning is normal. don't worry about it". I assume it's because the server list causes those IP addresses to be pinged (an outbound connection), but if that's all it is, is there any way I can suppress the warning without disabling the protection? I get maybe 10 or 15 of these per refresh from this game.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.