MalwareBytes (MWB) has chosen to block ALL GoDaddy sites that use forwarding or frameset forwarding. They are also blocking other registrars forwarding.

While MWB is great for blocking malicious IP Addresses in such a way as to allow site that display banner ads to still work (like 411.com) when a banner ad is from a known malicious IP, their decision to block all GoDaddy domains that are forwarded makes their software unuseable for us.

According to MalwareBytes, this decision is final.

to quote MalWareBytes:

"I do understand the frustration, and can assure you, the decision to block this IP was not taken lightly. However, whilst the IP itself may not be the actual "host" of the target content (in most cases, we do also block the target aswell), it is a middle man, and as such, is subject to the same standards we hold every other hosting company to. If they want to allow the malicious behaviour to go through their network, then we'll simply block it."

To quote me:

"If you can block only the offending ads/content on other domains/sites, why have you chosen to block all of GoDaddy?"

From MalwareBytes:

"The difference is, when a malicious Ad gets reported to the search engines, they generally remove it, these sites have been reported to the hosting companies many times and they don't respond."

SO, It seems that MalwareBytes position is that any registrar that has --- .000001% --- domain names (MalwareBytes quoted 200 as the number for ALL of GoDaddy) they will block the entire registrar.

Unless I am missing something, this makes MalwareBytes IP Protection severly BAD.

Does anyone have another product that can accomplish blocking the bad banner ads without killing entire registrars sites?????

This is the ClamWin forum, and I believe Malwarebytes has one of their own. You may get better results there. It's a good product, and I use it myself. The ISP blocking is a user preference decision--you can turn it on/off just like ClamWin's PUA detection. Most AVs now have some sort of ISP block list, and they can be very helpful with all the bad stuff on websites now.

Internet Explorer has some ISP blocking if you allow it. Spyware Blaster also has a list that is changed once a month or so. There is even a block list for Clam from Malware Patrol at https://www.malware.com.br/index.shtml on the web. I think ClamWin can use it when checking email in Outlook. If ClamWin had real-time scanning, it might be more helpful. As it is, it will spot one of the "bad" ISPs on the list if it is in something it unpacks, and it can spot something in the IE5 folder junk (in which case you might want to do a good scan in case you received some malware while at the ISP).

Regards,

Yes, MalwareBytes has a forum.

However, I am a ClamWin user and have many clients that run (ran, soon) MalwareBytes on my recommendation and/or requirement to block banner and pop-up ads on sites such as 411.com.

I expect there is a large community here of users such as myself that provide support to large installed userbases.

Many of them may even have ClamWin installed as Anti-Virus and MalwareBytes installed for its (currently) unique IP Blocking ability.

When this problem began, I was able to find nothing on the net about the issue and spent hours testing, verifiying and on the phone with senior technical staff at both companies.

My post is here to, hopefully, save other users of ClamWin and Calm command line scanner the difficulties and time.

Jesse