Malwarebytes Windows Firewall Control

[kenmo]

Since installing Malwarebytes Firewall Control on my I7-4770 Windows 10 Home Premium 64 bit, I do not get any photos display when I login to my Twitter account.
I can login to Twitter fine. However no photos or images display. I suspect it must be the website that hosts photos for Twitter.

If I turn off Windows Firewall photos display. Again WFC is NOT stopping me from logging in. It just doesn't allow any images to be displayed. After logging in. I turn WFC back on. And everything is fine until the next time I login to twitter.

On Malwarebytes WFC I am using settings profiles Medium, Display notifications, rules Outbound (block). I do not have this issue with Facebook, flickr, zenfolio, instagram or any other website frequent.

Port 80 & 443 are open.

Prior to installing WFC I did not have this issue. I also installed WFC to a 2nd computer I5-2500, Windows 10 Home Premium 64 bit. And I am having the same issue. Twitter worked fine prior to install. After install I can login but photos do not display.

Any ideas?

Thanks...

[Cornucopia]

It's not a bug, but a featured policy for MBAM/WFC. Check your HOSTS file. It will, when first enabled, or when a change is made, write the blacklist redirects to the file (usu. as =0.0.0.0). If you don't make any further changes, you can after-the-fact go into it and manually edit out the ones that bother you. Or, using the MBAM admin panel just whitelist what was blacklisted and it should update. Have experienced this exact issue with Skype due to over-aggressive ad-blocking, and this fixed it.
Btw, YMMV, as I'm using the Enterprise version of MBAM/WFC.

Scott

[kenmo]

Thanks kindly for your reply.

As I said. I can login fine to Twitter. But even my photos, digital paintings and 3D renders I uploaded do not show. From a command prompt I can ping www.twitter.com and it replies. I'm guessing it is blocking the cloud service that hosts member's photos and images.

Sorry but I don't know what you mean by YMMVin this comment"Btw, YMMV, as I'm using the Enterprise version of MBAM/WFC."

My host file on both computers is unchanged since installing Malabytes WFC on both Windows 10 computers. However I did check for an entry usu. as =0.0.0.0 and there is none.

I've not installed it yet on my 3rd computer - Windows 7. And on my Linux file server I'm using UFW/GUFW which I find much more simpler and easier then Windows Firewall. But my 3D modeling software and Adobe CC only runs on Windows and does not run on Linux.

I suspect when I got a WFC notification about some ip trying to make an outbound connection, I must have blocked it. I did use IPVOID website to verify ip numbers as well as the various links IPVOID has to abuse lists, blocked lists to query if the ip number is listed.

[drjtech]

YMMV stands for Your Mileage May Vary. This means that your performance or configuration may differ depending on other factors, such as the specific version of MBAM/WFC you are running.

[october262]

Thanks kindly for your reply.

As I said. I can login fine to Twitter. But even my photos, digital paintings and 3D renders I uploaded do not show. From a command prompt I can ping www.twitter.com and it replies. I'm guessing it is blocking the cloud service that hosts member's photos and images.

Sorry but I don't know what you mean by YMMVin this comment"Btw, YMMV, as I'm using the Enterprise version of MBAM/WFC."

My host file on both computers is unchanged since installing Malabytes WFC on both Windows 10 computers. However I did check for an entry usu. as =0.0.0.0 and there is none.

I've not installed it yet on my 3rd computer - Windows 7. And on my Linux file server I'm using UFW/GUFW which I find much more simpler and easier then Windows Firewall. But my 3D modeling software and Adobe CC only runs on Windows and does not run on Linux.

I suspect when I got a WFC notification about some ip trying to make an outbound connection, I must have blocked it. I did use IPVOID website to verify ip numbers as well as the various links IPVOID has to abuse lists, blocked lists to query if the ip number is listed.

do you have any Add-ons such as NO Script installed ??

[kenmo]

No add-ons. Just the WFC v6.0.2.0

[kenmo]

YMMV stands for Your Mileage May Vary. This means that your performance or configuration may differ depending on other factors, such as the specific version of MBAM/WFC you are running.

LOL... I guess at my age I'm not up on all the hip lingo like I used to be.. thanks...

[october262]

try resetting Malwarebytes Firewall Control back to default settings and see if that helps - https://www.binisoft.org/pdf/guides/Malwarebytes-WFC-User-Guide.pdf

[kenmo]

Using my Windows 7 computer which is only using the Windows firewall and twitter works fine, I went to my twitter account. Right clicking on render of a 3D model I created it displayed a url. The website that is hosting that image is pbs.twimg.com

From my Windows 7 computer I can ping pbs.twimg.com and nslookup returns an ip of 72.21.91.70

I can also ping it from my Ubuntu computer. But both of my Windows 10 computers fail. This is one of the ip numbers that was constantly querying my svchost.exe and I added a rule into my firewalls for it.


However, sometime when I ping pbs.twimg.com it returns ip - 151.101.248.159 and other times 72.21.91.70.

If someone who has a twitter account could verify what ip and website hosts their images, I would be very grateful.


Cheers and thanks

[kenmo]

Today I got an alert from Malwarebytes Windows Control Firewall that "Backgroundtransferhost.exe" was trying to connect via port 80 to 72.21.91.29

Poking around I found this at Abuseipdb.com

https://www.abuseipdb.com/check/72.21.91.29

I've also gotten alerts the svchost.exe and photos.exe have tried to connect to the same ip.

Anyone else notice this?

[kenmo]

Appears the subnet belongs to MCI Communications Verison

https://dnslytics.com/ip/72.21.91.0

[aedipuss]

72.21.91.29 appears to be a DNS (domain name server) - anytime a program wants to access a url it has to go to a DNS to look up the ip.


[Attachment 48669 - Click to enlarge]

[kenmo]

Thanks for the info. Appreciate it. But I'm not having any DNS issues. I can connect to urls fine. Using OpenDNS on my router..

[kenmo]

Ok...I've removed 72.21.91.x from my blocked ip list in my firewall and Twitter now works fine....

Many thanks...

[drjtech]

YMMV stands for Your Mileage May Vary. This means that your performance or configuration may differ depending on other factors, such as the specific version of MBAM/WFC you are running.

LOL... I guess at my age I'm not up on all the hip lingo like I used to be.. thanks...

Actually, this is from 1981 when the EPA required that the phrase be included when advertising estimated mileage. I remember it from the car commercials on TV.

[kenmo]

YMMV stands for Your Mileage May Vary. This means that your performance or configuration may differ depending on other factors, such as the specific version of MBAM/WFC you are running.

LOL... I guess at my age I'm not up on all the hip lingo like I used to be.. thanks...

Actually, this is from 1981 when the EPA required that the phrase be included when advertising estimated mileage. I remember it from the car commercials on TV.

Wow...and I'm a car buff. Spend most of my time in the summer with my antique car and at car shows...