WHich Comes First Firewall or Malwarebytes

[hunter405]

I am getting a few "Malwarebytes has blocked potentially dangerous web site" pop ups. I have established a rule in the WIndows 7 firewall to clock the identified IPs, but atill seeing the pop ups. I thought the firewall would block these IPs before Malwarebytes sees them? I don't see any real problems with this as long as the sites are not getting through, but the pop ups are a little bothersome. I am wondering if the firewall is not blocking them, if Malwarebytes scans incoming traffic before the firewall or if both the firewall and Malwarebytes see and monitor all incoming traffic?  Thanks - Roger

[AdvancedSetup]

In general your firewall should see them first but I suppose it's possible that our kernel driver is loading before your firewall.

 

What firewall are you using?

What OS are you using?

What other security products are you using?

 

Not that anything is wrong but if you can post back some logs I'll take a look and see if there is anything specifically going wrong or signs of an infection.

 

 

Please read the following and post back the 3 requested logs as well as the protection logs for the past week in a zip file if possible.
 
Diagnostic Logs
 
Thank you
 

[hunter405]

Hi Ron,

 

Thanks for the reply. I don’t think there is a problem, just trying to keep my pc protected but eliminate unnecessary notifications by blocking known problem IPs in the firewall before MB.

 

I am currently running Windows 7 Professional SP1 with the included Windows Firewall with Advanced Security and MS Security Essentials. I have Spy Bot-Search & Destroy installed, primarily for scans as needed.  Spy Bot internet protection: "Full" is checked.  This is newer version of Spy Bot and I am not sure if this means it is actively scanning or how it got turned on.  I will figure this out. For now just letting you know what is running.

 

Requested logs attached in zip file.  Only have 5 days of protection logs. I don’t see any way in history settings to change the number of days logs are saved.

 

I am thinking of replacing MSE and the Windows Firewall with Comodo Internet Security Pro 7.  I understand Malwarebytes works well with this suite?  Also, if Spy Bot is actively running, I plan to turn it off and just keep it for scans if indicated.

 

Thanks,

 

Rogerrogerslogs.zip

[AdvancedSetup]

No obvious infections found and the IP blocks are incoming so aside from a firewall or MBAM block not much one can do about them.

 

It's possible the IP configuration is not set correctly in the firewall to block it.

 

Yes, any other antivirus has got to be better than MSE now days. I do not have any personal knowledge with Comodo antivirus but from what I can tell it should work fine.

[hunter405]

Pretty sure I have the IP blocks set correctly, but who knows for sure.  Anyway, I think firewall/av upgrade for me is due.

 

Thanks again

[AdvancedSetup]

You're quite welcome. Take care