IT_Guy Posted November 20, 2017 ID:1184697 Share Posted November 20, 2017 (edited) Just had an endpoint try to access 255.255.255.255:68 using netsvcs and was blocked. The machine scans clean, any idea why/what this was? Edited November 20, 2017 by djacobson changing topic name back to original Link to post Share on other sites More sharing options...
MarkFleming Posted November 20, 2017 ID:1184717 Share Posted November 20, 2017 I'm getting the same... I'm guess that's probably a DHCP broadcast prior to being issued an address. Looks like a false positive? Link to post Share on other sites More sharing options...
Old_Bodger Posted November 20, 2017 ID:1184720 Share Posted November 20, 2017 I've been seeing the same thing and it came on suddenly, probably around 1700UT. MB is placing the blame on svchost.exe of all things. Anyone else? Link to post Share on other sites More sharing options...
IT_Guy Posted November 20, 2017 Author ID:1184726 Share Posted November 20, 2017 Yeah a whole bunch of my endpoints JUST started doing this. At least it's not isolated. Hopefully this isn't blocking my machines from getting a DHCP address. Link to post Share on other sites More sharing options...
CHall Posted November 20, 2017 ID:1184729 Share Posted November 20, 2017 Multiple endpoints getting it here. Most are port 68, one endpoint is port 17500. Started at 2:20pm. Link to post Share on other sites More sharing options...
maze Posted November 20, 2017 ID:1184734 Share Posted November 20, 2017 Same problem here.. Seems weird. a false positive of course but still weird! Link to post Share on other sites More sharing options...
deanb1234 Posted November 20, 2017 ID:1184759 Share Posted November 20, 2017 Same problem here, spreading throughout the enterprise. Link to post Share on other sites More sharing options...
cclouser Posted November 20, 2017 ID:1184799 Share Posted November 20, 2017 Same here on same ports Link to post Share on other sites More sharing options...
spnkzss Posted November 20, 2017 ID:1184821 Share Posted November 20, 2017 Ditto. Every machine online right now, and the calls are coming in. Link to post Share on other sites More sharing options...
IT_Guy Posted November 20, 2017 Author ID:1184829 Share Posted November 20, 2017 Just now, spnkzss said: Ditto. Every machine online right now, and the calls are coming in. Oh man are they ever, I'm going home until tomorrow. Link to post Share on other sites More sharing options...
deanb1234 Posted November 20, 2017 ID:1184835 Share Posted November 20, 2017 Response from a support engineer at MWB " it is an FP on our side. We are currently working on getting this fixed. You can put that in the exclusion list in the meantime while we get this fixed." Link to post Share on other sites More sharing options...
spnkzss Posted November 20, 2017 ID:1184860 Share Posted November 20, 2017 So, when I make a change to something, I have a test environment that I deploy it to first. Then I deploy "global". It might be a good idea for Malwarebytes to at least consider please. Link to post Share on other sites More sharing options...
kmerolla Posted November 20, 2017 ID:1184945 Share Posted November 20, 2017 No kidding. This is getting old. Link to post Share on other sites More sharing options...
djacobson Posted November 20, 2017 ID:1184961 Share Posted November 20, 2017 We do regression testing of the signatures before they are pushed, but sometimes you just can't predict how it will be in the wild of the real world. Add the 255.255.255.255 IP to be ignored under your Exclusions -> New -> Website on cloud or your Policy -> your policy -> Edit -> Ignore List in your console. Link to post Share on other sites More sharing options...
djacobson Posted November 20, 2017 ID:1184984 Share Posted November 20, 2017 Signatures with the 255.255.255.255 FP fix are confirmed and released now. Link to post Share on other sites More sharing options...
CHall Posted November 20, 2017 ID:1184993 Share Posted November 20, 2017 Gotta be honest, I don't know what I'd do without this forum and all you, the community, communicating here. When my phone started ringing from users reporting in, this is the first place I came to and was immediately relieved that we weren't under attack or something. Thanks all. Keep it going. Link to post Share on other sites More sharing options...
TeamHorner Posted November 20, 2017 ID:1185096 Share Posted November 20, 2017 Have a user that when they attempt to open a PDF attachment from an outside vendor or try to forward the message they are getting a Malwarebytes blocked message for Outboundconnection (255.255.255.255:68) I have done a scan on the system and there are no infections. They have no browsers open, the e-mail is just plain text, yet they get the message. Link to post Share on other sites More sharing options...
KDawg Posted November 20, 2017 ID:1185098 Share Posted November 20, 2017 Hello, Thank you for the report. This was a false positive that we had on address 255.255.255.255. We have currently fixed this in the latest database. To make sure your clients are on the latest database, please follow these steps: 1. Log into the cloud console and navigate to the endpoints tab. 2. From there, select all the endpoints affected and click on the 'actions' button in the upper right. 3. Select the 'check for protection updates' button and your clients will reach out to our servers to get the latest update. We do apologize for the inconvenience with this block. If you continue to run into issues, please reply back to this e-mail. Many Thanks, Link to post Share on other sites More sharing options...
djacobson Posted November 20, 2017 ID:1185107 Share Posted November 20, 2017 Merged topics but it took on the wrong topic name, sorry about that guys. Link to post Share on other sites More sharing options...
spnkzss Posted November 20, 2017 ID:1185120 Share Posted November 20, 2017 Now we've all been bitching a bit in the past, but I want to say @djacobson that I appreciate the MUCH improved communication, so thank you. Link to post Share on other sites More sharing options...
TonyCummins Posted November 20, 2017 ID:1185142 Share Posted November 20, 2017 My endpoints will not update and now im starting to see pcs unable to renew dhcp HELP ! Link to post Share on other sites More sharing options...
djacobson Posted November 20, 2017 ID:1185184 Share Posted November 20, 2017 @TonyCummins, do you have the ignore in place? Also try and give the endpoint communication service a restart. MBEndpointAgent. You can do a net stop, net start on the service remotely if needed. Let me know if that helps. Link to post Share on other sites More sharing options...
djacobson Posted November 20, 2017 ID:1185190 Share Posted November 20, 2017 You're welcome @spnkzss, we're trying! It's also getting easier now that I have more folks tagging in to help me in the biz section. Plus great feedback on the announcement thread request, with all the views on it, it looks to be really helping. If any of you guys have other requests for the forum, better ways to help through this medium or things you'd like to see, I'll do my best to make it happen! Link to post Share on other sites More sharing options...
TonyCummins Posted November 20, 2017 ID:1185191 Share Posted November 20, 2017 Yes..manual exclusion in place. How can i do a net stop / start if the endpoint is offline and is not getting an IP ?? Link to post Share on other sites More sharing options...
djacobson Posted November 21, 2017 ID:1185198 Share Posted November 21, 2017 It'll need to be done locally unfortunately. I take it this machine may be far from you @TonyCummins? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now