RTP detection (incoming connection) but I'm behind a firewall

[jschorn]

I keep getting inbound connections blocked on various ports, always referencing svchost.exe (in proper directory) but I don't know what is causing this because I'm behind a firewall.  How can Malwarebytes be blocking an attempt on port 1410 when the firewall would never forward that port?  I do have RDP open and forwarded but on custom (high) port.

Here are details:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 7/6/20
Protection Event Time: 4:03 PM
Log File: c4006963-bfc3-11ea-b4ce-64006a70aff0.json

-Software Information-
Version: 4.1.2.73
Components Version: 1.0.972
Update Package Version: 1.0.26497
License: Premium

-System Information-
OS: Windows 10 (Build 18362.900)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\System32\svchost.exe, Blocked, -1, -1, 0.0.0

-Website Data-
Category: Compromised
Domain: 
IP Address: 45.141.84.17
Port: 7736
Type: Inbound
File: C:\Windows\System32\svchost.exe

(end)

[AdvancedSetup]

Hello @jschorn and

 

There isn't too much you can do about an Inbound block. Typically these are bots doing automated scans looking for vulnerable systems. They normally go away on there own within a few hours, in some cases a day or so. If it does continue you can add the IP to your firewall to block it.

If you like though we can do some scans to make sure there is nothing on your computer that might be reaching out to cause it. Just let me know

Thanks

 

 

[jschorn]

Thanks, but what I don't understand is how would that inbound attempt even be made?  The PC is behind a corporate firewall.   So I'm totally confused.  And no other PC is getting that on the corporate network.

[AdvancedSetup]

I'm not sure as I don't work there and I don't know what their actual setup is like. Firewalls don't always block everything.

Maybe it's even a false positive but we'd need to do some scans to see what is going on for sure.

 

[AdvancedSetup]

We actually just released a new beta today that has additional notification support for RTP blocks.

Not sure it would tell us much more but worth a try updating to the beta as they often have many other fixes too

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks