IP Protection Needs a Help Summary

[calintexas]

First off, thank you guys for continuously working to improve your product and make life easier for all of us.

The details of what the IP Protection feature does and how it works is coming out between your product announcements and the responses to various forum questions. I (and I think others) would appreciate having the information summarized in one place (especially what the warning pop up is telling us). What I think I know so far:

IP Protection (Warning Message);

*Stops me from going to sites at specific IP addresses (or ranges of IP addresses) that have infected (or suspected of being infected) content.

*Warns me if I go to a site that has links (on the page) to IP addresses with infected (or suspected) content. I can still view the site, but should be aware that there could be a malicious link on the page.

Again, thank you. If a detailed explanatin is already out there, please point me to it.

[MysteryFCM]

In short;

What does IP Protection do?

IP Protection provides an additional layer of security for your computer, by preventing access to known malicious IP addresses and IP ranges, for example, NetDirekt, which is host to the Internet Service Team.

How does it do this?

When you ask your browser to connect to a website, Windows uses DNS or the HOSTS file (depending on configuration), to convert that domain name into it's corresponding IP address (e.g. example.com <> 1.2.3.4). MBAM intercepts the packet communications, to determine whether or not the IP address is known for malicious activity, and if so, blocks the communication.

How does it inform you?

MBAM informs you a malicious IP has been blocked by presenting a bubble notification at the bottom of the screen (next to the system tray).

What does this notification mean?

This notification means quite simply, that an IP address has been blocked. It does NOT necessarily mean you are infected, it simply means a program on your computer (e.g. your browser, IM program, P2P program etc), tried accessing a malicious IP address. If this notice was presented when you were not actually doing anything on the machine, then I suggest having your computer looked at.

I received a notification on a safe site, why?

If a notification is presented on a safe site, and the site loads, it is likely the site was loading content that is hosted on an IP known for malicious activity. In this case, the site itself will be displayed perfectly fine, with the malicious content being blocked.

If however, the site does not load, it is likely the site is also hosted on the same malicious IP address.

[calintexas]

Perfect, thank you. This all may have been obvious to you guys, but it sure wasn't to me. Please put the detail explanation in a "sticky" on the forum. I also recommend that it be added to the MBAM application help files.

[calintexas]

Perfect, thank you. This all may have been obvious to you guys, but it sure wasn't to me. Please put the detail explanation in a "sticky" on the forum. I also recommend that it be added to the MBAM application help files.

OOH,OOH! You've already Pinned it. Thanks again.

[MysteryFCM]

My pleasure