Why Does Malwarebytes Block Good Web Sites?

[Dave U. Random]

I now find that it is blocking MyWayNews.

What in the heck is wrong with this program? Which idiot placed so
many good sites into it's block list?

I have the paid version, and it is updated.

This feature is so ridiculous that I had to uncheck Website Blocking
on my wife's machine. She wouldn't put up with it another day after
it blocked a children's clothes site.

Ridiculous!

[John Mason Jr]

On 6/27/2010 1:30 PM, Dave U. Random wrote:
> I now find that it is blocking MyWayNews.
>
> What in the heck is wrong with this program? Which idiot placed so
> many good sites into it's block list?
>
> I have the paid version, and it is updated.
>
> This feature is so ridiculous that I had to uncheck Website Blocking
> on my wife's machine. She wouldn't put up with it another day after
> it blocked a children's clothes site.
>
> Ridiculous!
>


Well there is a forum where you can post any false positives you find.
Here is a link to the pinned post about ip blocking false positives.

http://forums.malwarebytes.org/index...howtopic=21076

At the end of the post it does say that you can add an IP to the ignore
list, it also includes info about why good sites get blocked.

At hpHosts you can find more info, it shows a classification of EMD

http://hosts-file.net/default.asp?s=myway.com

EMD - sites engaged in malware distribution

This classification is assigned to website's engaged in the
distribution of malware (e.g. adware, spyware, trojans and viruses etc).

Sites with this classification typically either contain files (e.g.
cracks, keygens, adware, spyware, trojans, viruses et al) or lead to
such via (for example) "fake scanners" or other social engineering and
misleading tactics.


John

[Dave U. Random]

In article <i084sv$1ff$1@news.eternal-september.org>
John Mason Jr <notvalid@cox.net.invalid> wrote:
>
> On 6/27/2010 1:30 PM, Dave U. Random wrote:
> > I now find that it is blocking MyWayNews.
> >
> > What in the heck is wrong with this program? Which idiot placed so
> > many good sites into it's block list?
> >
> > I have the paid version, and it is updated.
> >
> > This feature is so ridiculous that I had to uncheck Website Blocking
> > on my wife's machine. She wouldn't put up with it another day after
> > it blocked a children's clothes site.
> >
> > Ridiculous!
> >
>
>
> Well there is a forum where you can post any false positives you find.
> Here is a link to the pinned post about ip blocking false positives.
>
> http://forums.malwarebytes.org/index...howtopic=21076
>
> At the end of the post it does say that you can add an IP to the ignore
> list, it also includes info about why good sites get blocked.


I do not have any such IP thingy in my version 1.46.

The ignore list is a pain. You have to run a full scan to be able to
set a program into the ignore list.


> At hpHosts you can find more info, it shows a classification of EMD
>
> http://hosts-file.net/default.asp?s=myway.com
>
> EMD - sites engaged in malware distribution


MyWayNews has an EMD rating? That's nonsense. It's a simple news
site.
I use the MVPS host file, and mywaynews is not in their host file.

> This classification is assigned to website's engaged in the
> distribution of malware (e.g. adware, spyware, trojans and viruses etc).
>
> Sites with this classification typically either contain files (e.g.
> cracks, keygens, adware, spyware, trojans, viruses et al) or lead to
> such via (for example) "fake scanners" or other social engineering and
> misleading tactics.
>

Again, the children clothes site and MyWayNews are egregious examples
of Malwarebytes own ignorance of what is in their blocking file.
Which fool made it up? This problem and a few others with
Malwarebytes are quickly turning me off on this program. As for that
hosts-file.net, I don't think they have much of a handle on it
either. Maybe Malwarebytes should re-examine the construction of this
Web blocking feature.

> John

[Dustin Cook]

Dave U. Random <anonymous@anonymitaet-im-inter.net> wrote in
news:33632576be3f65e6e117cd2ccad96249@anonymitaet-im-inter.net:

> In article <i084sv$1ff$1@news.eternal-september.org>
> John Mason Jr <notvalid@cox.net.invalid> wrote:
>>
>> On 6/27/2010 1:30 PM, Dave U. Random wrote:
>> > I now find that it is blocking MyWayNews.
>> >
>> > What in the heck is wrong with this program? Which idiot placed so
>> > many good sites into it's block list?
>> >
>> > I have the paid version, and it is updated.
>> >
>> > This feature is so ridiculous that I had to uncheck Website Blocking
>> > on my wife's machine. She wouldn't put up with it another day after
>> > it blocked a children's clothes site.
>> >
>> > Ridiculous!
>> >
>>
>>
>> Well there is a forum where you can post any false positives you find.
>> Here is a link to the pinned post about ip blocking false positives.
>>
>> http://forums.malwarebytes.org/index...howtopic=21076
>>
>> At the end of the post it does say that you can add an IP to the
ignore
>> list, it also includes info about why good sites get blocked.
>
>
> I do not have any such IP thingy in my version 1.46.

Right click the icon in your tray.



--
The bear went over the mountain to see what he could see. Hey! The other
side of the mountain was all that he could see! So he went back over the
mountain to see what he could see. Hey! The other side of the mountain
was all that he could see! - Green Jelly The Bear Song

[Dave U. Random]

In article <Xns9DA4CD04A31EBHHI2948AJD832@69.16.185.247>
Dustin Cook <bughunter.dustin@gmail.com> wrote:
>


> >> At the end of the post it does say that you can add an IP to the
> ignore
> >> list, it also includes info about why good sites get blocked.
> >
> >
> > I do not have any such IP thingy in my version 1.46.

>
> Right click the icon in your tray.
>

Grayed out. But it says nothing about being an IP ignore dingy. It
merely says, "Add To Ignore List". It never occurred to me it meant
IPs instead of programs. How to I get this menu choice functional?

As far as adding to the ignore list goes, the HELP file says:

"To add items to this list, simply run a scan and click Show Results.
The detection list will appear. Right click on any item you would
like ignored and click Add to Ignore List."

Nowhere does it say about anything about IP addresses. Nowhere do I
find any info about the grayed out choice on the right click menu.

Mind you, I ain't arguing with you, I'm just trying to understand
this darn proggy. It seems very clumsy to me.

[Dustin Cook]

Dave U. Random <anonymous@anonymitaet-im-inter.net> wrote in
news:685d83318d217a69c5272c7a407871ce@anonymitaet-im-inter.net:

> In article <Xns9DA4CD04A31EBHHI2948AJD832@69.16.185.247>
> Dustin Cook <bughunter.dustin@gmail.com> wrote:
>>
>
>
>> >> At the end of the post it does say that you can add an IP to the
>> ignore
>> >> list, it also includes info about why good sites get blocked.
>> >
>> >
>> > I do not have any such IP thingy in my version 1.46.
>
>>
>> Right click the icon in your tray.
>>
>
> Grayed out. But it says nothing about being an IP ignore dingy. It
> merely says, "Add To Ignore List". It never occurred to me it meant
> IPs instead of programs. How to I get this menu choice functional?

Hmm.. Ahh.. Hold up, you have to re-enable the IP blocking module first,
then it should ungrey itself and you can add whatever IPS you don't want
it blocking to the don't block list.

> As far as adding to the ignore list goes, the HELP file says:
>
> "To add items to this list, simply run a scan and click Show Results.
> The detection list will appear. Right click on any item you would
> like ignored and click Add to Ignore List."

That's for programs, and I agree, probably not the easiest user friendly
way to do it.

> Mind you, I ain't arguing with you, I'm just trying to understand
> this darn proggy. It seems very clumsy to me.

No problem. Hopefully I can help you.


--
The bear went over the mountain to see what he could see. Hey! The other
side of the mountain was all that he could see! So he went back over the
mountain to see what he could see. Hey! The other side of the mountain
was all that he could see! - Green Jelly The Bear Song

[poutnik]

In article <33632576be3f65e6e117cd2ccad96249@anonymitaet-im-inter.net>,
anonymous@anonymitaet-im-inter.net says...
>
>
> Again, the children clothes site and MyWayNews are egregious examples
> of Malwarebytes own ignorance of what is in their blocking file.

My experience from MBAM forum is
they are close to MS approach:

"We do know the best, what users really want and need"

--
Poutnik
The best depends on how the best is defined.

[Pedro Hardhat]

Dave U. Random <anonymous@anonymitaet-im-inter.net> wrote in
news:e881b15f15c268682a5f12f857880734@anonymitaet-im-inter.net:

> I now find that it is blocking MyWayNews.
>
> What in the heck is wrong with this program? Which idiot placed so
> many good sites into it's block list?
>
> I have the paid version, and it is updated.
>
> This feature is so ridiculous that I had to uncheck Website Blocking
> on my wife's machine. She wouldn't put up with it another day after
> it blocked a children's clothes site.
>
> Ridiculous!
>
>

That would be because the domain is owned by IAC and because the IP range
hosts the unpopular IAC domains smileycentral, funwebproducts, iwon and
zwinky.

[Dave U. Random]

In article <gXhWn.1043$vD2.807@news-server.bigpond.net.au>
Pedro Hardhat <choc@icecream.com> wrote:
>
> Dave U. Random <anonymous@anonymitaet-im-inter.net> wrote in
> news:e881b15f15c268682a5f12f857880734@anonymitaet-im-inter.net:
>
> > I now find that it is blocking MyWayNews.
> >
> > What in the heck is wrong with this program? Which idiot placed so
> > many good sites into it's block list?
> >
> > I have the paid version, and it is updated.
> >
> > This feature is so ridiculous that I had to uncheck Website Blocking
> > on my wife's machine. She wouldn't put up with it another day after
> > it blocked a children's clothes site.
> >
> > Ridiculous!
> >
> >
>
> That would be because the domain is owned by IAC and because the IP range
> hosts the unpopular IAC domains smileycentral, funwebproducts, iwon and
> zwinky.

That does explain it. But I think blocking entire domains because of
a few sites is really overkill and entirely unproductive. This MBAM
is really a rather crudely done program. It needs a major rethink.

[David H. Lipman]

From: "Dave U. Random" <anonymous@anonymitaet-im-inter.net>


>> That would be because the domain is owned by IAC and because the IP range
>> hosts the unpopular IAC domains smileycentral, funwebproducts, iwon and
>> zwinky.

| That does explain it. But I think blocking entire domains because of
| a few sites is really overkill and entirely unproductive. This MBAM
| is really a rather crudely done program. It needs a major rethink.

What did Steven say when you posted this in the Malwarebytes' forums ?




--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp