[Malwarebytes blocking GOG Galaxy game downloads]

20 minutes ago, MatthewB111 said:

Hi guys!

Malwarebytes started blocking communications with GOG CDN as seen in the Logs below.

It disabled game downloads for GOG Galaxy users.

Steps to reproduce: Install GOGGalaxy (https://gogalaxy.com) and try to download a game via the client. 

I've checked on VirtusTotal and it seems that some AV Vendors treat the Game CDN gogcdn.net as phishing? It's a CDN for game downloads by gog.com. 

 

Please help. Appreciate your help. 

Logs below:

LogGOG.txt 827 B · 1 download

Hello,

Since the IP is clean now, I will remove the block.

Seems that there was a malicious script hosted -

https://www.virustotal.com/gui/file/e8af3476f0800500930ac809b2316f11bdcdaeb88f7309f523e4d0c2e5f58db7/detection

[svchost.exe RTP Connection blocked]

This is a legit detection, Malwarebytes has blocked an RDP attack.

[You blocked one of Chatra's domains]

NP, always a pleasure!

[Delist site aaidea.eu]

Hello,

We are not blocking this domain with MB4.

Can you please attach a screenshot?

[Malicious website blocked, Domain amastybootstrap.online from Firefox]

The website has been compromised.

We are strongly recommending you to not enter your CC details on that webpage.

[malwarebytes premium saying that GMOD.EXE is a trojan]

Hello,

The IP has been cleaned up, so I will remove the block.

[my website is a false positive - urgent]

Please clean up your website first -

http://files.ryancamarda.com/uploads/1/3/0/7/130775921/7e8eca1ae9f530d.pdf

 

[You blocked one of Chatra's domains]

Thanks Julia, the block has been removed yesterday.

[You blocked one of Chatra's domains]

2 minutes ago, Julia_Chatra said:

Done, we deleted the file. 

I have just checked and it is still live.

[You blocked one of Chatra's domains]

Hello Julia,

Can you please remove the malicious file from your server so I can lift the block -

http://uc.chatra-usercontent.com/48a76695-5c61-42ca-a402-14952a6d9bd5/

?

[Our website got blocked by malwarebytes.]

If you visit the link that I have provided, you will be redirected to malvertising networks upon trying to play the video.

Please remove the redirection so we can remove the block from our DB.

[Trojan Detected on Company Website]

This is a legit detection, please clean up the infected page -

ishafoundation.org/ta/Table/Isha-Yoga-Center/Page-2.isa

 

[Delist request]

Thanks, the block will be removed.

[Our website got blocked by malwarebytes.]

Hello,

The website is redirecting users to malvertising networks -

https://upstream.to/embed-n1qtjhyqqgzr.html

 

[False positives on dgap.org and subdomains]

Hello Andreas,

The block will be removed.

[Bank website is blocked "Compromised"]

This is not a fp, the IP is blocked for RDP attacks.

[Website blocked]

Thanks, the block will be reviewed.

[Is this real have Trojan or False ? Blocked by Malwarebytes premium]

Thanks, the block will be reviewed.

[My website is a false positive... help please!]

Hi Hugh,

I would advise your to perform an antivirus scan of your system and change all your passwords including the weebly account password.

After that, you should check the folder structure of your website and remove all files that have been unknown to you.

This is a good place to start -

http://hugh-dichmont.com/uploads/

 

[Bank website is blocked "Compromised"]

Thanks a lot for letting us know, we will definitely monitor this IP more closely.

[My website is a false positive... help please!]

Hi Hugh,

This is not a fp, your website is infected -

http://hugh-dichmont.com/uploads/1/3/0/6/130620197/pobaseva.pdf

 

[Bank website is blocked "Compromised"]

Are you not able to login to the Bank portal at all?

As the IP block is legit -

https://www.abuseipdb.com/check/195.228.112.193

[Blocked websites due to Trojan ?]

Thanks, the block will be removed as there is no threat noted at this point.

[Clean Site - Please remove from blocklist]

Hi Paul,

Since the website is clean now, the block will be removed.

[Fase positive phising website blocked]

Hello,

Since the website seems clean now, the block will be removed.