Is the IP-protection gone? How do i test the web protection?

[sten2]

I have just installed the Malwarebytes Premium version. I have a lifetime license.In earlier versions of MBAM there was a feature called IP-protection. When one visited possible dangerous website it gave a warning. For example many Chinese sites like www.shoudian.org MBAM gave a warning. Is the IP-protection gone in the new Premium version? Is there a way to test the web protection? Is there any link to a site that tests the MBAM web protection?

[dcollins]

http://iptest.malwarebytes.org/

This site should be blocked if your Web Protection is enabled

[TempLost]

18 hours ago, dcollins said:

http://iptest.malwarebytes.org/

This site should be blocked if your Web Protection is enabled

Devin, I still get the attached page in Google Chrome when I attempt to go to that site - I don't get any message from Malwarebytes 3.0

Windows 7 Home Premium SP1 x64
Malwarebytes Premium 3.0.6.1469 Component Version 1.0.75
Avast Free 17.1.2288
CryptoPrevent 8.0 Premium
Tweaking.com Windows Repair Pro 3.9.26 (incorporating Registry Backup 3.5.3) 
Casper 10 Backup

 

[dcollins]

Would you mind performing the following steps so we can get some more information?

1. Turn off Web Protection under Settings -> Protection
2. Verify you can visit http://iptest.malwarebytes.org
3. Close the browser
4. Turn on Event Log Data Under Settings -> Application
5. Turn on Web Protection under Settings -> Protection
6. Try to go to http://iptest.malwarebytes.org using only one browser, and verify the page does not load properly 
7. Turn off Event Log Data under Settings -> Protection
8. Navigate to C:\ProgramData\Malwarebytes\MBAMService\
   • Note that the ProgramData folder may be hidden so you will need to either type in the path manually or turn on the option to show hidden folders and files
9. Right click the logs folder and choose Send to -> Compressed (Zipped) folder
10. This should create a file named logs.zip on your desktop. Please attach that zip file in your response

Thanks!

[TempLost]

45 minutes ago, dcollins said:

Would you mind performing the following steps so we can get some more information?

1. Turn off Web Protection under Settings -> Protection
2. Verify you can visit http://iptest.malwarebytes.org
3. Close the browser
4. Turn on Event Log Data Under Settings -> Application
5. Turn on Web Protection under Settings -> Protection
6. Try to go to http://iptest.malwarebytes.org using only one browser, and verify the page does not load properly 
7. Turn off Event Log Data under Settings -> Protection
8. Navigate to C:\ProgramData\Malwarebytes\MBAMService\
   • Note that the ProgramData folder may be hidden so you will need to either type in the path manually or turn on the option to show hidden folders and files
9. Right click the logs folder and choose Send to -> Compressed (Zipped) folder
10. This should create a file named logs.zip on your desktop. Please attach that zip file in your response

Thanks!

Hi Devin.

I carried out your instructions as above.

After turning off Web Protection, and attempting to visit http://iptest.malwarebytes.org - I saw the page below.with the message that IP Protection was disabled on my machine.

After turning Web Protection back on, I saw the same page.

Zipped log folder attached as requested.

 

logs.zip

[dcollins]

Thanks for the logs, we're trying to track this down. While doing so, can you please confirm that you're using iptest.malwarebytes.org and not iptest.malwarebytes.com? 

[TempLost]

2 minutes ago, dcollins said:

Thanks for the logs, we're trying to track this down. While doing so, can you please confirm that you're using iptest.malwarebytes.org and not iptest.malwarebytes.com? 

I'm using iptest.malwarebytes.org.

[Firefox]

@dcollins here is an example of the log that your looking for.

I went to the iptest site and it was not getting blocked via MBAM v2 and the website was stating that IP protection was disabled.  I exited MBAM from the tray and then re-opened MBAM v2.

Went to the website once and I got no blocks and got the same IP Protection is disabled, clicked on refresh and now it starts blocking.  Later in the day, it stops blocking once again.

protection log for iptest site.txt

[Firefox]

And here is a 2nd PC (this is my home computer) the only way to start getting the blocks and show on the IP test site that its one and working is to exit MBAM v2 and re-open it. But after a while it goes back to not blocking and shows on the ip test site as disabled.

 

protection log ip blocks test page 2nd PC.txt

[dcollins]

Thanks for the updates @Firefox, we're still researching to see what's happening here. Out of curiosity, have you tested these sites prior to the past 48 hours and noticed any issues like this?

[Firefox]

The only reason I started testing is because the OP mentioned the issue and wanted to see if my V2 computers were doing the same thing... so no I had not tested them in the past 48 hours.

[dcollins]

No worries, thanks for checking. Just trying to see if this is a new issue, or something that's been overlooked for awhile. Thanks again

[Firefox]

Your welcome, if you need further testing or logs let me know....

[Firefox]

So I wanted to test a theory and see what happens...

On my home computer that had v2 installed and I was not getting the proper block notification and was told by the test site that protection was off, I decided to upgraded it to v3.

I downloaded the latest version of v3 and did an in place upgraded to v3 (as this is what most users would do)  So now I am running v3 on my home computer.

Now when I try to go to the test site http://iptest.malwarebytes.org/ I get a message in IE that states the page can not be found. Also going to a known site that should be blocked also gives me error that the site can not be found (instead of blocking the site and giving me a notification)

On my Win10 VM where I have v3 installed and testing it blocks do work as intended.

@dcollins, let me know if you need any logs on this computer (v2 to v3 upgrade) where the blocks are not working before I try a clean re-install....

[Firefox]

@dcollins so should I go ahead and do a clean re-install to see if it fixes my not getting block notifications (since this was an upgrade from v2 to v3) where the blocks were not working in v2 either?

I suppose that a clean re-install would probably fix the issue on my home computer...

[dcollins]

@Firefox we're still researching, so I can't say for sure. But it can't hurt.

[Firefox]

OK, I will probably do a clean re-install on the home computer sometime tonight to see if it corrects the issues... I will let you know...

[Firefox]

@dcollins I did a clean re-install of version 3.

I uninstalled from the control panel
Ran the mbam-cleanup tool
rebooted
Installed and activated v3 and it now gives an IP block notification and I get the proper page in IE. Although going to some known blocked sites still yields a page can not be found

Still have no clue why it was not working properly in v2 and v3 upgrade

[Firefox]

This mornings test:

Win7 Ultimate 64bit (all updates installed - all cache cleaned in all browsers)
MBAM was installed after running the mbam-clean tool

All three browsers did not yield a MBAM block notification in the system tray.. going to http://iptest.malwarebytes.org/

IE -> shows page can not be displayed
Opera -> Shows website however it says my IP protection is disabled on your machine
Firefox -> shows server not found

I disabled Web Protection and I am able to get to http://iptest.malwarebytes.org/ on all three browsers with message that IP protection is disabled

I enabled Web Protection and I get same results when its enabled:

IE -> shows page can not be displayed
Opera -> Shows website however it says my IP protection is disabled on your machine
Firefox -> shows server not found

So does this mean that even though my Web Protection is ON, its really not doing its job??????? (granted trying to go to a blocked site I get page can not be found, but I would like to know that I actually got blocked, and I want to see such blocks in the notification area and it get logged).

 

[dcollins]

We are still internally working on this error, trying to figure out what the exact cause is. I can't say for certain that you're Web Protection is working unless the notification pops up. But there is no workaround at this time.

[Firefox]

@dcollins does your post above mean you have been able to replicate the issue?

[dcollins]

3 hours ago, Firefox said:

@dcollins does your post above mean you have been able to replicate the issue?

Only sporadically

[Firefox]

1 hour ago, dcollins said:

Only sporadically

That's interesting, as I am seeing this on more than a handful of computers... with v2 and v3....

[dcollins]

I would recommend uninstalling and then re-installing the latest version of whatever software version you're using (IE: 2.x users can install the latest 2.x and 3.x users can install the latest 3.x) and see if that resolves your issue. It worked for at least one customer so far

[sten2]

On ‎3‎/‎22‎/‎2017 at 2:52 PM, Firefox said:

This mornings test:

Win7 Ultimate 64bit (all updates installed - all cache cleaned in all browsers)
MBAM was installed after running the mbam-clean tool

All three browsers did not yield a MBAM block notification in the system tray.. going to http://iptest.malwarebytes.org/

IE -> shows page can not be displayed
Opera -> Shows website however it says my IP protection is disabled on your machine
Firefox -> shows server not found

I disabled Web Protection and I am able to get to http://iptest.malwarebytes.org/ on all three browsers with message that IP protection is disabled

I enabled Web Protection and I get same results when its enabled:

IE -> shows page can not be displayed
Opera -> Shows website however it says my IP protection is disabled on your machine
Firefox -> shows server not found

So does this mean that even though my Web Protection is ON, its really not doing its job??????? (granted trying to go to a blocked site I get page can not be found, but I would like to know that I actually got blocked, and I want to see such blocks in the notification area and it get logged).

 

I agree and get the same results. So far i have not seen that the IP protection or the Web protection really works. Furthermore, i find it surprisingly that the Chameleon is not compatible with the MB 3.0. When downloading the Chameleon and trying to open it, it launches the old  MB 2.0 version.