False positive on 67.195.145.141 & 67.195.145.142

[GordonWayneWatts]

Help! MalWareBytes is going crazy on me!! ... I just sent an email to support as follows for a false positive --and other problems too:

-----Original Message-----

From: Gww1210@aol.com

Date: Wed, 18 May 2011 07:45:52 EDT

Subject: Re: Reference #14717383: Your Malwarebytes' Anti-Malware Consumer License(s) ...

To: cs@cleverbridge.com, support@malwarebytes.org

CC: Gww1210@aol.com, gww1210@gmail.com, Gww12102002@yahoo.com

Help! MalWareBytes is going crazy on me!!

As you can see from both the MalWareBytes-screen-shot.JPG attachment (and from my email address), I am a PAID customer... and this is not the 1st time MWB has gone crazy on me ... as you can see from the email below, I had to call CleverBridge and get a reactivation after MWB just stopped working in real-time ... I wonder of the 2 incidencts are related... but it gets worse.

See the next screen shot, MalWareBytes-ScreenShot-problem.JPG email attachment in which MWB blocks access to MY website, which is NOT malicious... you see I'm trying to click a referral link on Facebook.

And, I KNOW it's MY website that set off the alarm, as I explain in the notes on that screen shot: My page loads when I turn MWB off --and the IP address is an indicator too.

See, however, MalWareBytes-still-a-problem.JPG which shows it blocks access even if I don't click from Facebook... LOL But it 'gets better'...

When I clock from my AOL browser (see e.g., MalWareBytes-screen-2nd-problem.JPG), however, it loaded the page!! -- (which it shouldn NOT have done if it had the alarm go off, and the alarm DID go off ... see the screen shot).

HELP!! My page is NOT 'malicious.'

Besides, if it were, MWB should've blocked it in AOL too.

I do NOT want people telling me that their anti-virus program blocked my webpage and that my webpage is 'bad' -- it is NOT. HELP!! Please tell your program to cut it out!

Thx... full contact data at very bottom in email byline signature.

In a message dated 5/16/2011 10:14:24 A.M. Eastern Daylight Time, cs@cleverbridge.com writes:... {{snipped for brevity}}

---

PS: FWIW, here is the code to which I refer in my email...

<!-- text below generated by server. PLEASE REMOVE --><!-- Counter/Statistics data collection code --><script language="JavaScript" src="http://l.yimg.com/d/lib/smb/js/hosting/cp/js_source/whv2_001.js"></script><script language="javascript">geovisit();</script><noscript><img src=" alt="setstats" border="0" width="1" height="1"></noscript>

[MysteryFCM]

There's still open cases on these IPs, but not enough to warrant the continued blocking, so both have been unblocked for the next update.

[GordonWayneWatts]

G'Day, Mate - Thx 4 fixing this problem: MWB now allows my website to be shown.

However, there is one little concern: Since two (2) different IP's were implicated, then this shows that the script in question calls up 'dynamic' (e.g., revolving, rotating, changing) IP's, as opposed to static or dedicated IP addresses.

This means that a whole *block* of IP addresses might need to be unblocked in MWB --if it has not already been done.

Otherwise, I appreciate your assistence, MysteryFCM. You da man, Big Dawg!

Gordon Wayne Watts

LAKELAND, Florida, U.S.A.

There's still open cases on these IPs, but not enough to warrant the continued blocking, so both have been unblocked for the next update.

[MysteryFCM]

There's no script involved here. I blocked the two IPs manually due to a plethora of abuse.