Can I put multiple IP addresses in one Exclusions entry

[stefanc]

I have a known-safe program that is consistently talking to a pool of about 200 different IP addresses, and MB will complain from time to time about any one of them.

Rather than enter each address separately, can I simply list them in bulk, separated with something like a comma or space? Either that or loaded into file somewhere?

I didn't see this particular question in my search, but I doubt I'm the only one who's asked this...

I've also tried to add the application (and any related executable I can find, AND the folder it lives in) as an exclusion - but I'm still getting alerts. MB must separate the application from the target website, and treat them independently as possible threats...?

Thanks!

[exile360]

Greetings

Unfortunately there is no way to add a bulk list of exclusions at this time, however you can instead exclude that particular application from web blocking if that helps.  This is particularly useful when the application's traffic is known to be safe (i.e. not a web browser) and typically connects to a wide range of IP addresses (in particular, Peer-to-Peer applications often cause this such as Skype, Bittorrent clients etc.).

To exclude the application, create an exclusion and select Exclude an Application that Connects to the Internet and browse to and select the application's main process that connects to the IP addresses in question.  That should allow you to prevent these blocks from occurring without having to create a ton of individual IP or domain exclusions (plus you get the added benefit of them still being blocked for other apps such as your web browser which might not be safe visiting some of the sites hosted on any of those IP addresses, which is likely why they're in our block list to begin with).

Please let me know if that works for you or not and if there's anything else we can help you with.

Thanks

[stefanc]

Well, I have added the program to the Exclusions - along with every related executable I can find, AND any folder the programs are running from - and I'm still getting the alert. If I keep going down that road I might as well just uninstall MWB! 

But in researching my question, I came across dozens of people asking about exactly that - why, if I've allowed the program am I still getting alerts?

Is there an easy answer for that? It seems - from the many times it's asked - that it doesn't get resolved. 

But, really, no way to bulk add? How about a config or .ini file somewhere, or using RegEdit? This seems like such a reasonable feature to add to MWB I'm surprised there isn't even a work-around...

Thanks,

S.

PS: thanks for the timely response!

Edited October 16, 2017 by stefanc

[exile360]

You need to make certain that you're adding it as a web exclusion for the associated processes.  I specify this because there is no way to exclude a folder from web protection, only malware protection and the other modules so I suspect that perhaps the exclusion is of the wrong type and that may be what's causing the blocks to continue.

That said, I do believe there was a known issue in the past with web exclusions not working properly, and if that's the issue you're encountering here, then that could also account for it.  So first, please verify that you selected the option Exclude an Application that Connects to the Internet (the third option listed when adding an exclusion) when you added the process(es) being blocked, then just to make sure that it isn't some kind of DNS caching issue causing the blocks to continue, please follow the instructions in this Microsoft support article and then restart your PC and try using the application again.  Hopefully this time the exclusions will work properly.

Also, if you wouldn't mind, please post back with your most recent protection log attached to your post.  You can find it here: C:\ProgramData\Malwarebytes\MBAMService\LOGS\MBAMSERVICE.LOG.  We can find out exactly which processes are being blocked so that we are certain to add the correct ones to exclusions.  Hopefully that will enable us to get this working for you so that you don't need to disable any protection components or add a ton of individual exclusions, which I know can be quite tedious.