×
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
spc3rd
Former Member
Message 1 of 9

Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

Good morning everyone,

     My inquiry concerns an odd discrepancy between what McAfee's Firewall Log (for INCOMING events) is recording and what Malwarebytes Pro is showing for the exact same IP address and time the event occurred.  (I just acquired MWB Pro yesterday). 

At intermittent times throughout the day, MWB Pro will display a dialog box over the Taskbar stating it has blocked a particular IP address and lists the type as OUTGOING..  When I check the McAfee Firewall INCOMING events log, it shows the exact same IP address and time the block occurred as the MWB does.  The only difference is McAfee records the event type as an INCOMING, whereas MWB records it as OUTGOING.  

*Please note:  the particular IP addresses involved (locations are in mainland China) have been repeatedly logged by McAfee's Firewall every day for the past 3 years (in the INCOMING event log)...even when I had 2 different computers than the one I have now.

I have already run full scans with both McAfee and MWB Pro and no issues were discovered.  Also ran the Microsoft Security Analysis Tool as well - no problems were found.  As far as I can tell, I have no Peer-to-Peer programs on this computer.

McAfee software:

Security Center:  version:   10.5   build:  10.5.239    affld:  636

          VirusScan:  version:  14.5    build:  14.5.130    DAT version:  6375

               Firewall:  version:  11.5    build:  11.5.141

My question is this: Which event TYPE is the correct one, INCOMING (McAfee) or OUTGOING (Malwarebytes)?

Thank you for your time and any enlightenment on this one!

Message was edited by: spc3rd on 6/14/11 7:55:01 AM EDT
1 Solution

Accepted Solutions
Hayton
Reliable Contributor
Reliable Contributor
Message 2 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

Which is correct? I don't know. But you're quite likely to get some odd occurrences if you're running both McAfee and the always-on real-time version of Malwarebytes. McAfee classes Malwarebytes Pro as an incompatible application, although the on-demand scanner presents no problems.

Now for the guesswork. If the IP addresses are in China, it's incoming - UNLESS you've got some malware on your system that is trying to call home to China for instructions. Most likely the MWB "outgoing" message is a mistake. What you should do is open up your firewall settings and specifically add those IP addresses to the Blocked list. That should remove the problem at source.

View solution in original post

8 Replies
Hayton
Reliable Contributor
Reliable Contributor
Message 2 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

Which is correct? I don't know. But you're quite likely to get some odd occurrences if you're running both McAfee and the always-on real-time version of Malwarebytes. McAfee classes Malwarebytes Pro as an incompatible application, although the on-demand scanner presents no problems.

Now for the guesswork. If the IP addresses are in China, it's incoming - UNLESS you've got some malware on your system that is trying to call home to China for instructions. Most likely the MWB "outgoing" message is a mistake. What you should do is open up your firewall settings and specifically add those IP addresses to the Blocked list. That should remove the problem at source.

spc3rd
Former Member
Message 3 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

Hi Hayton!

     Thanks very much for the info.  As an added measure I submitted a support request to MWB and the reply I received back indicated there was likely no problem with infection.  (I've noted a number of postings on the MWB site by other users who are experiencing the same issue I presented here too).  I will also try to add those IP addresses to the blocked list as you recommended.  (Since I've never done that on this current version of McAfee I have...it may take some time to figure out how to do it correctly).

* I also added several McAfee files/folders to the Ignore List in MWB, as well as, 3 MWB files to the Program Permissions list in McAfee's Firewall to hopefully minimize any conflicts.  (The list of files/folders to add were obtained on the MWB site).

Thanks again!

Message was edited by: spc3rd on 6/14/11 1:24:28 PM EDT
Peacekeeper
Message 4 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

I will reinterate what Peter mentioned running the real time version of Malwarebytes ie the paid version will clash with Mcafee. You get both trying to read the same file at the same time and that will likely cause issues.

The free version sits fine with Mcafee provided Mcafee is installed first.

newjack
Former Member
Message 5 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

Hey Hayton, Just received the 2011 version.Under which tab can you block incoming connections from?I only found the parental block for I.p addresses and a my connections tab.Unless I did not see it.

                                                                                                                                                                                                                           Thanks

Peacekeeper
Message 6 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

Web and email protection/firewall/netguard is one way Help should give youi a pointer but mine seems to be DOA at this time.

newjack
Former Member
Message 7 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

HI Tony, I was curious if there was a way I did not notice.I know that In past versions if you had an incoming ip trying to constantly conect to your computer.You could block that Address.I know that the firewall protects from that.But sometimes you`ll see the same suspect IP trying for days to connect to all sorts of ports.

Peacekeeper
Message 8 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

I know they changed some things netguard way should work I was trying to check this via help but it fails to load . Th incoming events block it automatically and you can trust it or open port no block in incoming detection area.

newjack
Former Member
Message 9 of 9

Re: Firewall log shows block of incoming IP address; MWB shows same IP & time, but OUTGOING block??

Jump to solution

OK thanks Tony, Wanted to basically know about blocking.I have the usual few from China and Russia every so often.

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community