jmcleod83 Posted August 31, 2016 ID:1059396 Share Posted August 31, 2016 since this week i am noticing this pop up on my App/DC server and in the threats view of Malwarebytes. Blocked web site 8/31/2016 11:23:40 AM Type: outgoing, Port: 137 122.228.198.140 Anti-Malware "my internal Server Name" internal domain.local "server local ip" 00-26-55-FF-A4-E8 Blocked web site 8/31/2016 11:23:32 AM Type: outgoing, Port: 62707, Process: dns.exe 122.228.198.140 Anti-Malware "my internal Server Name" internal domain.local "server local ip " 00-26-55-FF-A4-E8 the server in question is an app server and a domain controller/dns server. what could be causing this?? Link to post Share on other sites More sharing options...
Lazz Posted August 31, 2016 ID:1059413 Share Posted August 31, 2016 Hi jmcleod83. It's likely a client PC using this server as a DNS server is trying to access a site we block. Since Anti-Malware is installed on the DNS server, the block occurs there and not on the client PC and is attributed to DNS.exe. Link to post Share on other sites More sharing options...
jmcleod83 Posted August 31, 2016 Author ID:1059427 Share Posted August 31, 2016 thank you Lazz, that makes sense. is there any way to find what client is the culprit? could it be any device on the network that may not have Malwarebytes installed, for example an iPhone or tablet? Link to post Share on other sites More sharing options...
Lazz Posted August 31, 2016 ID:1059429 Share Posted August 31, 2016 You're welcome. I'm not 100% sure if it could be due to a computer without Malwarebytes installed as I have not tested that case, but it seems theoretically possible. But unfortunately there is not a way to see which client is the culprit in the console, since Malwarebytes stops it before it even gets to the client. Link to post Share on other sites More sharing options...
jmcleod83 Posted August 31, 2016 Author ID:1059431 Share Posted August 31, 2016 So then is it a concern for me to find the client, or leave as is because Malwarebytes is doing its job? Link to post Share on other sites More sharing options...
Lazz Posted August 31, 2016 ID:1059433 Share Posted August 31, 2016 It is safe to allow Malwarebytes to do it's job, however if you wish to stop the behavior at it's source there is one possible way to find the client. If you were to stop the website blocking on the DNS server, and the block occurs again, you would see which client it appears on, if indeed it was a client with Malwarebytes installed. Of course, this does temporarily lower the protection of the DNS server, so this is not advisable. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now