tzetter

V09 still blocking pages

V08 still blocking pages

V07 released.still seeing blocked pages..

V05 still throwing up pop-ups constantly....

v05 just released but still seeing things blocked.

We are still seeing issues as well with the newest update on our Corp Edition. Even access to our own systems is being impacted.

We did the same thing after speaking with Microsoft engineers. Not a day's trouble since. They knew instantly what it was.

....crickets.... Awesome to see such responsiveness! The silence speaks loudly. About 900 licenses about to be thrown overboard in favor of something that doesn't break user's email. BUYER BEWARE.

Any idea why MB would be interfering with DNS requests to outlook.office365.com? We have quite a few users all of whom are seeing this disruption however they get no alert or warning MB is causing it. And it 100% IS MB causing it. If we turn off Malicious Website Protection they are automatically re-connected and working within 20 seconds consistently across all affected systems. The issue is the same as those reported here: https://forums.malwarebytes.org/index.php?/topic/171204-malwarebytes-stopping-outlook-2013-from-connecting-to-exchange-hosted-by-microsoft-office-365/ https://forums.malwarebytes.org/index.php?/topic/161172-issues-with-mbam/ If we remove MB completely all issues also disappear. We will likely open a ticket with MB but I'd like a public forum explanation of the role it is playing in these DNS requests and why it would even be involved with such a well-known address. TTL for outlook.office365.com is 5 min per Microsoft Support in case that matters. Strangely not all folks who have this same version suffer the issue so it's very puzzling why it's so inconsistent in terms of who it affects yet so consistent in the symptoms and resolution. (Outlook disconnected until system reboot, no access to the web Outlook client either until the reboot. Symptoms ALWAYS return to those affected).

I posted this in the False Positive forum section just now.

Auto Protect is detecting Acrobat.exe at launch and quarantining it as Tronjan.downloader.BD. This BREAKING pc's ALL OVER our company (AGAIN!). Log file: 2013/11/01 06:10:00 -0400 BEDROOM (null) MESSAGE Starting protection 2013/11/01 06:10:00 -0400 BEDROOM (null) MESSAGE Protection started successfully 2013/11/01 06:10:00 -0400 BEDROOM (null) MESSAGE Starting IP protection 2013/11/01 06:10:04 -0400 BEDROOM (null) MESSAGE IP Protection started successfully 2013/11/01 06:47:06 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 06:47:12 -0400 BEDROOM Travis MESSAGE Scheduled update executed successfully: database updated from version v2013.10.31.08 to version v2013.11.01.02 2013/11/01 06:47:12 -0400 BEDROOM Travis MESSAGE Starting database refresh 2013/11/01 06:47:12 -0400 BEDROOM Travis MESSAGE Stopping IP protection 2013/11/01 06:47:12 -0400 BEDROOM Travis MESSAGE IP Protection stopped successfully 2013/11/01 06:47:22 -0400 BEDROOM Travis MESSAGE Database refreshed successfully 2013/11/01 06:47:22 -0400 BEDROOM Travis MESSAGE Starting IP protection 2013/11/01 06:47:25 -0400 BEDROOM Travis MESSAGE IP Protection started successfully 2013/11/01 07:56:53 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 07:56:54 -0400 BEDROOM Travis MESSAGE Database already up-to-date 2013/11/01 09:11:37 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 09:11:42 -0400 BEDROOM Travis MESSAGE Scheduled update executed successfully: database updated from version v2013.11.01.02 to version v2013.11.01.03 2013/11/01 09:11:42 -0400 BEDROOM Travis MESSAGE Starting database refresh 2013/11/01 09:11:42 -0400 BEDROOM Travis MESSAGE Stopping IP protection 2013/11/01 09:11:43 -0400 BEDROOM Travis MESSAGE IP Protection stopped successfully 2013/11/01 09:11:51 -0400 BEDROOM Travis MESSAGE Database refreshed successfully 2013/11/01 09:11:51 -0400 BEDROOM Travis MESSAGE Starting IP protection 2013/11/01 09:11:53 -0400 BEDROOM Travis MESSAGE IP Protection started successfully 2013/11/01 10:04:53 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 10:04:54 -0400 BEDROOM Travis MESSAGE Database already up-to-date 2013/11/01 10:57:09 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 10:57:10 -0400 BEDROOM Travis MESSAGE Database already up-to-date 2013/11/01 11:45:38 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 11:45:43 -0400 BEDROOM Travis MESSAGE Starting database refresh 2013/11/01 11:45:43 -0400 BEDROOM Travis MESSAGE Stopping IP protection 2013/11/01 11:45:43 -0400 BEDROOM Travis MESSAGE Scheduled update executed successfully: database updated from version v2013.11.01.03 to version v2013.11.01.04 2013/11/01 11:45:44 -0400 BEDROOM Travis MESSAGE IP Protection stopped successfully 2013/11/01 11:45:46 -0400 BEDROOM Travis MESSAGE Database refreshed successfully 2013/11/01 11:45:46 -0400 BEDROOM Travis MESSAGE Starting IP protection 2013/11/01 11:45:49 -0400 BEDROOM Travis MESSAGE IP Protection started successfully 2013/11/01 13:01:43 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 13:01:44 -0400 BEDROOM Travis MESSAGE Database already up-to-date 2013/11/01 14:13:17 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 14:13:23 -0400 BEDROOM Travis MESSAGE Scheduled update executed successfully: database updated from version v2013.11.01.04 to version v2013.11.01.05 2013/11/01 14:13:23 -0400 BEDROOM Travis MESSAGE Starting database refresh 2013/11/01 14:13:23 -0400 BEDROOM Travis MESSAGE Stopping IP protection 2013/11/01 14:13:23 -0400 BEDROOM Travis MESSAGE IP Protection stopped successfully 2013/11/01 14:13:32 -0400 BEDROOM Travis MESSAGE Database refreshed successfully 2013/11/01 14:13:32 -0400 BEDROOM Travis MESSAGE Starting IP protection 2013/11/01 14:13:34 -0400 BEDROOM Travis MESSAGE IP Protection started successfully 2013/11/01 15:13:00 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 15:13:01 -0400 BEDROOM Travis MESSAGE Database already up-to-date 2013/11/01 16:09:22 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 16:09:28 -0400 BEDROOM Travis MESSAGE Scheduled update executed successfully: database updated from version v2013.11.01.05 to version v2013.11.01.06 2013/11/01 16:09:28 -0400 BEDROOM Travis MESSAGE Starting database refresh 2013/11/01 16:09:28 -0400 BEDROOM Travis MESSAGE Stopping IP protection 2013/11/01 16:09:28 -0400 BEDROOM Travis MESSAGE IP Protection stopped successfully 2013/11/01 16:09:37 -0400 BEDROOM Travis MESSAGE Database refreshed successfully 2013/11/01 16:09:37 -0400 BEDROOM Travis MESSAGE Starting IP protection 2013/11/01 16:09:40 -0400 BEDROOM Travis MESSAGE IP Protection started successfully 2013/11/01 17:09:31 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 17:09:37 -0400 BEDROOM Travis MESSAGE Scheduled update executed successfully: database updated from version v2013.11.01.06 to version v2013.11.01.07 2013/11/01 17:09:37 -0400 BEDROOM Travis MESSAGE Starting database refresh 2013/11/01 17:09:37 -0400 BEDROOM Travis MESSAGE Stopping IP protection 2013/11/01 17:09:37 -0400 BEDROOM Travis MESSAGE IP Protection stopped successfully 2013/11/01 17:09:40 -0400 BEDROOM Travis MESSAGE Database refreshed successfully 2013/11/01 17:09:40 -0400 BEDROOM Travis MESSAGE Starting IP protection 2013/11/01 17:09:42 -0400 BEDROOM Travis MESSAGE IP Protection started successfully 2013/11/01 17:52:21 -0400 BEDROOM Travis MESSAGE Executing scheduled update: Hourly | Silent 2013/11/01 17:52:22 -0400 BEDROOM Travis MESSAGE Database already up-to-date 2013/11/01 18:06:22 -0400 BEDROOM Travis DETECTION C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat.exe Trojan.Downloader.BD QUARANTINE 2013/11/01 18:08:18 -0400 BEDROOM Travis DETECTION C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat.exe Trojan.Downloader.BD QUARANTINE Acrobat.zip

Same here.

File did not attach the first time. _ISDel.zip

MBAM auto protect quarantined this file from this location: D:\Apps\Symantec Ghost Suite 2_5\Symantec Ghost Installer\Extras\3Com Boot Services\Install on my system. File attached.

File in question is attached. Artinsoft.VB6.DB.zip