Redkyte2005 Posted November 28, 2016 ID:1075145 Share Posted November 28, 2016 Hi guys, The default landing page for wikipedia.org is being blocked by Malwarebytes. I've double checked the management console to confirm that it definitely malwarebytes and not any of the other software or hardware in our environment. What the best work around for this? Thanks Link to post Share on other sites More sharing options...
Diglett Posted November 28, 2016 ID:1075146 Share Posted November 28, 2016 Same thing here: Link to post Share on other sites More sharing options...
coldone Posted November 28, 2016 ID:1075147 Share Posted November 28, 2016 Yepp same thing here consider me surprised opening my browser with only a session of allianz.de and wikipedia open. Link to post Share on other sites More sharing options...
LiquidTension Posted November 28, 2016 ID:1075148 Share Posted November 28, 2016 (edited) Hello, The block you are experiencing is not on the Wikipedia/Wikimedia domain, but rather the 91.198.174.192 IP address which is currently housing a Command and Control (C2) server for the Locky file encrypting ransomware. Malwarebytes Anti-Malware is blocking the IP address based on this. Unfortunately, Wikipedia/Wikimedia also makes use of this IP address. Therefore, this IP block may impact use of Wikipedia. If you wish to circumvent the block, you can add the IP address as an exclusion within Malwarebytes Anti-Malware. For Home users, this can be done as follows: Open Malwarebytes Anti-Malware. Click the SETTINGS tab. Click Web Exclusions. Click Add IP. Enter 91.198.174.192 and click OK. Once the Locky C2 server is cleaned up on the 91.198.174.192 IP address, the block will be removed. Edited November 28, 2016 by LiquidTension Link to post Share on other sites More sharing options...
Redkyte2005 Posted November 28, 2016 Author ID:1075155 Share Posted November 28, 2016 9 minutes ago, LiquidTension said: Hello, The block you are experiencing is not on the Wikipedia/Wikimedia domain, but rather the 91.198.174.192 IP address which is currently housing a Command and Control (C2) server for the Locky file encrypting ransomware. Malwarebytes Anti-Malware is therefore blocking the IP address based on this. Unfortunately, Wikipedia/Wikimedia also makes use of this IP address. If you wish to circumvent the block, you can add the IP address as an exclusion within Malwarebytes Anti-Malware. For Home users, this can be done as follows: Open Malwarebytes Anti-Malware. Click the SETTINGS tab. Click Web Exclusions. Click Add IP. Enter 91.198.174.192 and click OK. Once the Locky C2 server is cleaned up on the 91.198.174.192 IP address, the block will be removed. Thanks, that did the trick. Link to post Share on other sites More sharing options...
coldone Posted November 28, 2016 ID:1075156 Share Posted November 28, 2016 That's unfortunate thanks for the info. Link to post Share on other sites More sharing options...
ynysygwas Posted November 28, 2016 ID:1075167 Share Posted November 28, 2016 Many thanks to LiquidTension for the info. I'll survive without wikipedia until the problem is cleared. I vaguely remember there was something on breakfast news this morning about ransomware causing £2million worth of damage last year (I think. I was half asleep when I heard it!). Link to post Share on other sites More sharing options...
JPK Posted November 28, 2016 ID:1075169 Share Posted November 28, 2016 Sorry if the answer to this question is a bit obvious but just want a quick sanity check. Presumably in it self unblocking the affected IP address is not a problem as the C2 server is only issuing instruction to infected machines, not actually distributing Locky. However, should you be unlucky enough to be infected by the variant that is connecting back to this C2 server having unblocked the address you are going to be in trouble where as with the address blocked despite the malicious code running on a workstation you may be OK. Is that a reasonable summary? We have customers wanting to get to Wikipedia and I need to be sure that I am giving the correct advice before allowing access. Having been identified as a C2 server is there any guestimate at how long it may before this is taken down and the IP address allowed again? Days, weeks, months? Thanks. Link to post Share on other sites More sharing options...
LiquidTension Posted November 28, 2016 ID:1075174 Share Posted November 28, 2016 9 minutes ago, ynysygwas said: Many thanks to LiquidTension for the info. I'll survive without wikipedia until the problem is cleared. I vaguely remember there was something on breakfast news this morning about ransomware causing £2million worth of damage last year (I think. I was half asleep when I heard it!). You're very welcome. Unfortunately, the number is more likely in the billions now. 2 minutes ago, JPK said: Sorry if the answer to this question is a bit obvious but just want a quick sanity check. Presumably in it self unblocking the affected IP address is not a problem as the C2 server is only issuing instruction to infected machines, not actually distributing Locky. However, should you be unlucky enough to be infected by the variant that is connecting back to this C2 server having unblocked the address you are going to be in trouble where as with the address blocked despite the malicious code running on a workstation you may be OK. Is that a reasonable summary? We have customers wanting to get to Wikipedia and I need to be sure that I am giving the correct advice before allowing access. Having been identified as a C2 server is there any guestimate at how long it may before this is taken down and the IP address allowed again? Days, weeks, months? Thanks. Yes, that summary is correct. Adding the IP address as an exclusion and accessing the Wikipedia website will not result in exposure to Locky. However, if a machine is exposed to the online variant of Locky through other unrelated means, the exclusion will allow the malware to communicate with the C2 server and implement encryption. As for how long until the C2 server is cleared - I'm not able to speculate, I'm afraid. Link to post Share on other sites More sharing options...
UmnyeniKH Posted November 28, 2016 ID:1075197 Share Posted November 28, 2016 Thankfully I found this as I am experiencing the same thing. I have an additional question, though. I keep getting the popup even though I am not visiting Wikipedia. I might be browsing Reddit and it tells me that it's been blocked. Any insight into that? Thank you. Link to post Share on other sites More sharing options...
LiquidTension Posted November 28, 2016 ID:1075200 Share Posted November 28, 2016 12 minutes ago, UmnyeniKH said: Thankfully I found this as I am experiencing the same thing. I have an additional question, though. I keep getting the popup even though I am not visiting Wikipedia. I might be browsing Reddit and it tells me that it's been blocked. Any insight into that? Thank you. We can look further into other blocks as they may be unrelated. I've sent you a PM with instructions. Link to post Share on other sites More sharing options...
Griffin_UK Posted November 28, 2016 ID:1075203 Share Posted November 28, 2016 (edited) I was experiencing the same problem this morning - but just updated my database to v2016.11.28.11 and the block on Wikipedia associated IPs has disappeared I assume this is intended. If so, nice work guys. :-) Edited November 28, 2016 by Griffin_UK Link to post Share on other sites More sharing options...
jaredjeya Posted November 28, 2016 ID:1075206 Share Posted November 28, 2016 10 minutes ago, Griffin_UK said: I was experiencing the same problem this morning - but just updated my database to v2016.11.28.11 and the block on Wikipedia associated IPs has disappeared I assume this is intended. If so, nice work guys. :-) I can confirm that fixed it for me too, I was a little worried I'd been infected with something when Wikipedia of all places was blocked. Link to post Share on other sites More sharing options...
TejSingh Posted November 28, 2016 ID:1075223 Share Posted November 28, 2016 I am already sitting at v2016.11.28.11 but does not work for me Link to post Share on other sites More sharing options...
TejSingh Posted November 28, 2016 ID:1075225 Share Posted November 28, 2016 I am already sitting at v2016.11.28.11 but does not work for me Link to post Share on other sites More sharing options...
LiquidTension Posted November 28, 2016 ID:1075230 Share Posted November 28, 2016 Hello TejSingh, The IP block is still in effect. In order to circumvent the block, you will need to add 91.198.174.192 as an IP exclusion. Link to post Share on other sites More sharing options...
TejSingh Posted November 28, 2016 ID:1075234 Share Posted November 28, 2016 Ok Thanks, Any idea until when this block will stay. Link to post Share on other sites More sharing options...
UmnyeniKH Posted November 28, 2016 ID:1075246 Share Posted November 28, 2016 Another question. If we were vulnerable to Locky... would Malwarebytes not pick it up? I run BitDefender and MalwareBytes. I assume one of the two would get it, right? Link to post Share on other sites More sharing options...
LiquidTension Posted November 28, 2016 ID:1075248 Share Posted November 28, 2016 43 minutes ago, TejSingh said: Ok Thanks, Any idea until when this block will stay. The IP block will be removed once the Locky C2 server is dealt with. 15 minutes ago, UmnyeniKH said: Another question. If we were vulnerable to Locky... would Malwarebytes not pick it up? I run BitDefender and MalwareBytes. I assume one of the two would get it, right? Malwarebytes Anti-Malware Premium will indeed protect you from Locky variants. The blocking of C2 servers is another method of protection against the effects of (online) file encrypting ransomware. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted November 28, 2016 Staff ID:1075269 Share Posted November 28, 2016 Blocked for Locky C2. Link to post Share on other sites More sharing options...
Neph Posted November 28, 2016 ID:1075275 Share Posted November 28, 2016 5 hours ago, UmnyeniKH said: Thankfully I found this as I am experiencing the same thing. I have an additional question, though. I keep getting the popup even though I am not visiting Wikipedia. I might be browsing Reddit and it tells me that it's been blocked. Any insight into that? Thank you. Are you possibly using Firefox and the tiles for quickly accessing websites through the "New Tab" tab? If so, that's the "problem". As long as there is a "New Tab" tab open and you move your mouse cursor over Wikipedia tile, the message will pop up (only on the first try though) - I guess that's because of the preview image. For me it even does it sometimes while I'm currently browing a different website in the same Firefox window but move the cursor over where my Wikipedia tile would be. If you're using a different browser, it's still possible that any of the "quick access"/bookmark buttons (I know that they exist in IE and Chrome) cause the message to pop up too. Link to post Share on other sites More sharing options...
LiquidTension Posted November 28, 2016 ID:1075299 Share Posted November 28, 2016 Hello everyone, The Locky C2 server on 91.198.174.192 has been dealt with. With the latest definitions update, the block will no longer occur. Link to post Share on other sites More sharing options...
UmnyeniKH Posted November 28, 2016 ID:1075302 Share Posted November 28, 2016 (edited) 9 minutes ago, LiquidTension said: Hello everyone, The Locky C2 server on 91.198.174.192 has been dealt with. With the latest definitions update, the block will no longer occur. Which definitions update is it? My MalwareBytes premium shows I have v2016.11.28.17 with no available updates. Am I good? Edit: Wikipedia loaded so I must be? Edited November 28, 2016 by UmnyeniKH Link to post Share on other sites More sharing options...
Sherakaja Posted November 29, 2016 ID:1075420 Share Posted November 29, 2016 My partner and I have each our own computer with the same Malwarebytes software on it. But on his computer Malware blocked Wikkipedia, but my computer didn't. How is that possible? Should I worry when I go to Wikkipedia? Link to post Share on other sites More sharing options...
LiquidTension Posted November 29, 2016 ID:1075429 Share Posted November 29, 2016 11 hours ago, UmnyeniKH said: Which definitions update is it? My MalwareBytes premium shows I have v2016.11.28.17 with no available updates. Am I good? Edit: Wikipedia loaded so I must be? Correct. 1 hour ago, Sherakaja said: My partner and I have each our own computer with the same Malwarebytes software on it. But on his computer Malware blocked Wikkipedia, but my computer didn't. How is that possible? Should I worry when I go to Wikkipedia? Please confirm both machines are running the same Malwarebytes Anti-Malware definitions. To do this, hover your cursor over the blue Malwarebytes Anti-Malware Notification Area icon (next to the clock) and check the Database version. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now