Possible false positives - few sites hxxp:\\ 34.230.127.91

[Mark_Albrosco]

Morning - MWB Detection gave a blocked website result for the following sites:

1. </34.230.127.91/> on port 56230 launched from AvastBrowser.exe - VirusTotal results for a scan of the IP address returned "Clean" for all engines.
2. </199.80.54.74/> on port 57938 launched from msedge.exe - VirusTotal results for a scan of the IP address returned 1 engine registered a "malware" result.
3. </192.243.59.20/> on port 62961 launched from msedge.exe - VirusTotal results for a scan of the IP address returned 1 engine registered a "suspicious" result
4. </gz06x5tqlj.com/> launched from msedge.exe - VirusTotal results for a scan of the IP address returned 1 engine registered a "malware" result / 1 engine registered a "suspicious" result

See images attached.

[Dashke]

Hello Mark,

I will be moving your topic to an appropriate forum as there are indications that your system is infected with adware.

[Mark_Albrosco]

Kevin - thanks for this feedback.

We're using EPP Cloud, so the first set of steps will need to be scheduled from the management console.

I will try and get those logs to you later today.

The person is doing video editing/rendering using free online tools on certain sites; those sites however have pop-up ads and it is these that are being blocked by MWB end point protection.

[Maurice Naggar]

Just a pointer, given the fact of having EPP Cloud, then this case properly belongs at the Business Support section for EndPoint Protection.

[kevinf80]

@Maurice Naggar Thanks for the heads, can you move this to the correct section of the forum....

Regards,

Kevin..

[Maurice Naggar]

it is moved there already.