Can I find out what program was blocked by MWB?

[Blackberry445]

Hello

Love your product, very happy with its performance.

I do have a question. On one of our "pro" installations I found out that an outgoing web attempt was blocked by MWB as "potentially dangerous website." The IP address was logged and the time of the attempt but nothing in the log tells me what software or user attempted to make this connection.

Is there anywhere in MWB logs to find out more info on why this happened?

Thanks for any help in advance!

[Firefox]

Please provide following details, so that someone may be able to assist you:

• What is your current version of windows (XP, Vista, or Win7)?
  
• Is your windows OS 32-bit or 64-bit?
  
• Is this in your home or company?
  
• What is your OS Service Pack?
  
• What version (if any) of MBAM are you running (current is 1.51.2.1300) and is it the Free or Pro version?
  
• What MBAM database version do you have now (current as of now is 8034)?
  
• What brand and version of antivirus software do you have?
  
• What firewall software do you use if any?
  
• Do you use any P2P (Peer to Peer) software such as Bittorrent, Utorrent or Skype?
  
• Has your computer been infected recently, or is it currently showing any other abnormal behavior (browser redirects, IP blocks, etc.) to suggest an infection?
  

[daledoc1]

In addition to posting the info requested by Firefox, you might find the Use TCPView to Determine what Process is Connecting to a Malicious IP Address section of the FAQ - Section G provides some tips on how to find out what process is attempting the IP connections.

HTH,

daledoc1

[Blackberry445]

Please provide following details, so that someone may be able to assist you:

• What is your current version of windows (XP, Vista, or Win7)?
  XP SP3
  
• Is your windows OS 32-bit or 64-bit?
  32-bit
  
• Is this in your home or company?
  home
  
• What is your OS Service Pack?
  current
  
• What version (if any) of MBAM are you running (current is 1.51.2.1300) and is it the Free or Pro version?
  Consumer, Pro, same as shown here
  
• What MBAM database version do you have now (current as of now is 8034)?
  same
  
• What brand and version of antivirus software do you have?
  Norton 360 V5 plus SuperAntySpyware (both kept current)
  
• What firewall software do you use if any?
  Norton
  
• Do you use any P2P (Peer to Peer) software such as Bittorrent, Utorrent or Skype?
  Skype
  
• Has your computer been infected recently, or is it currently showing any other abnormal behavior (browser redirects, IP blocks, etc.) to suggest an infection?
  No
  

I did some research and the IP address involved is probably Skype. It's in Holland so at first that made me suspicious. But I've seen similar IP addresses linked to Skype in other posts. It would have been helpful if your log kept info on what program was having its IP activity blocked. I did notice you have a setting to record info from P2P programs so I checked that ON. Let's see if the log starts capturing "skype.exe" as the source of the blocked attempts.

Thanks I will update in a day or so.

[exile360]

It would have been helpful if your log kept info on what program was having its IP activity blocked.

Unfortunately on Windows 2000 and Windows XP we do not have that capability, however, in Windows Vista and Windows 7 we do thanks to the newer API's in those Windows versions that allow it.

[Blackberry445]

Thanks for your help.

[exile360]

You're welcome, if you need anything else, please don't hesitate to contact us again.

Thanks