Report: Blocked website

[Ultradiv]

Hi all,

in 4.2.0 when the system blocks inbound sites, what is the data in the "File" field?

[exile360]

Greetings,

That is the program attempting the connection (for outbound blocks), or the program that the incoming connection is attempting to reach (for incoming blocks).  It looks like your email client triggered a block, possibly due to the content of a message or due to one of its mail servers being blocked.

If you believe the block to be a false positive, please review the information in this topic as well as this topic, then create a new thread in the Website Blocking FP area by clicking here.

I hope this helps, and if there is anything else we might help with please let us know.

Thanks

[Ultradiv]

Thanks for the explanation.
So, this is an inbound block.
There is no email client on the machine.
So that IP is the source of a connection trying to run ~\smartermail.exe do I have that correct?

[exile360]

No, the IP isn't trying to run smartermail.exe; smartermail.exe is already running and that IP is attempting to connect to it.

[Ultradiv]

Thanks exile360, I really appreciate your answers.
I am getting hundreds if not thousands of these "attempts" everyday, is the MB (superb) system detecting these inbound connections outside of the firewall (windows own) or inside?

[exile360]

Web Protection in Malwarebytes operates at the same level as the Windows Firewall in the network stack.  If you're getting a lot of these then it could be a sign of infection or your network may require hardening to prevent the connection attempts.  If you don't use smartermail.exe, I'd recommend uninstalling it and that should eliminate the blocks/connection attempts, or you can try blocking the program with the Windows Firewall to see if that eliminates them.