Wireless Network Printer Scanning Blocked

[Midwest_Engineer]

I have a new wireless printer installed on my local network.  Its scanning function is blocked -- the printer is not seen -- but printing works fine.  Disabling Malwarebytes, with no other changes, allows the scanning function to work in the same session.  The vendor (Brother) indicates which specific UDP ports need to be opened to enable the scanning function; these are different than the UDP ports needed for printing.  How can I configure MB to unblock these ports?  My regular antivirus (still running) does not block the scanning function.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
7. Click the Gather Logs button
   
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[exile360]

Greetings,

What happens if you just disable the Web Protection component in Malwarebytes?  Does the scanner work then?  To test, right-click on the Malwarebytes tray icon in the notification area near your system clock and click where it says Web Protection: On and click Yes when prompted by User Account Control.  Wait about 30 seconds for it to fully disable the component (it has to unload the driver and block databases from memory) then test to see if the scanner now functions.

Please let us know how it goes.

Thanks

[Midwest_Engineer]

Success... simply setting Web Protection to "Off" restores the scanner functionality for the wireless network printer.  What would be the recommended way to force a default to this setting on system reboot?

[exile360]

You can simply leave it disabled, but theoretically we should be able to accomplish this fix without completely disabling Web Protection.  I just wanted to verify that this module was indeed the cause.  If your scanner uses a specific executable to function then you should be able to exclude it from Web Protection to allow the scanner to function while Web Protection is active.  If you know what that file/process is called and where it is located (I assume it shows up in Task Manager whenever the scanner is active) then you should be able to exclude it according to the instructions under the Exclude an Application that Connects to the Internet section of this support article.

If you have trouble finding it, then please make certain your scanner is active and do the following:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
   

Please let us know how it goes, and if necessary please provide the requested ZIP file from the Malwarebytes Support Tool so that I may help you track down the correct process to exclude.

Thanks

[Midwest_Engineer]

I cannot identify the file / process that needs to be identified as an exclusion.  I did guess at c:\Program Files (x86)\Browny02\Br\BrYNSvc.exe and also C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe, but that was not sufficient.  Thus there must be some further process different from or in addition to either or both of these.  Perhaps you can identify it from the enclosed log files.  I would like to proceed with identifying specific exclusions (with your help) but without completely disabling Web Protection.

mbst-grab-results.zip

[exile360]

I'm just guessing as well unfortunately (I wish companies would label/specify the functions of individual executables/files better than they do) but I'd suggest trying to exclude each of these one at a time until you are successful and hopefully one of them does the trick:

C:\Windows\System32\BtwRSupportService.exe
C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
C:\Program Files (x86)\Brother\BrUtilities\BrLogRx.exe
C:\Program Files (x86)\Browny02\BrYNSvc.exe
C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe
C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
C:\Program Files (x86)\Brother\iPrint&Scan\USBAppControl.exe
C:\Program Files (x86)\Brother\iPrint&Scan\WorkflowAppControl.exe

The only other process I could see belonging to Brother was this one which appears to be their updater for their software so it isn't likely to do any good to exclude it:

C:\Program Files (x86)\Brother\SoftwareUpdateNotification\SoftwareUpdateNotificationService.exe

Hopefully excluding one of those resolves the issue.  Please let us know how it goes.

Thanks

[Midwest_Engineer]

I'm afraid that even with all of the Brother-related files excluded from detection, the scanner functionality will not work unless I set Web Protection to "Off".  FYI, the one System32 file seemed to be related to Bluetooth, not to Brother, and I did not exclude it.

 

[exile360]

OK, thanks for letting me know.  I was hoping we'd be able to find a solution but it seems likely that the Web Protection component is somehow interfering with the scanner's communication, possibly on a driver level and if that is the case it means we can't exclude it as driver's cannot be excluded from Web Protection.

In the meantime I guess you'll just have to disable Web Protection whenever you're going to use your scanner.  I will report this issue to the Developers and hopefully they will be able to resolve the issue in a future release.

[Midwest_Engineer]

OK, thank you.  Possibly of future help, Brother reports the following on their website under "Firewall ports needed to allow network communication with the Brother machine":

- Network Scanning:  internal/External UDP 54925

- Network PC-Fax Receiving:  Internal/External UDP 54926

- Network Printing and Remote Setup: Internal/External UDP 137 and UDP 161

It is, of course, quite possible that local network communication with the Brother machine requires opening ports that could also be used for malicious exploits.r

[exile360]

Malwarebytes doesn't block any specific ports so I'm sure that's not the issue.  It is probably interfering somehow on a programmatic level with the scanner's driver preventing it from communicating.  Thanks for the additional info though; it may help the Developers to track down the root cause of the issue.

[David H. Lipman]

As indicated "Success... simply setting Web Protection to "Off" restores the scanner functionality ". 

I suggest statically setting the IP address of the Brother MFP and add an exclusion for that IP address.

That would be far better than excluding all the various Brother software components.

 

 

Edited June 2, 2019 by David H. Lipman
Edited for content, clarity, spelling and grammar

[exile360]

Greetings,

This issue might be resolved by the new beta build of Malwarebytes, version 3.8.  You can learn more about it here.

If you decide you wish to give the beta a try then please open Malwarebytes and navigate to Settings>Application and scroll to the bottom of the tab where it shows the option to enable beta updates and select the option to do so and click Yes at the confirmation prompt then scroll back to the top of the same tab and click on the Install Application Updates button and allow it to download and install the new build, allowing it to restart your system if prompted to do so once the installation completes, making sure that you save anything you were working on before you do.

If you do try the beta, please let us know if it resolved the issue you were experiencing or not.

Thanks

[Midwest_Engineer]

Thank you for your follow-up.

I installed version 3.8.1.2950 and indeed found that it solved the problem with the scanner functionality.  Now I can leave Web Protection enabled and still be able to activate the wireless scanner from Windows, or alternatively initiate a scan from the device.

Nice job.  Again, thanks.

[exile360]

Excellent, I'm glad to hear it

If there's anything else we might assist you with please let us know.

Thanks