MBAM excited by Google Images?

[Double]

This must be common to every user of MBAM, because it happens to me occasionally. I have experienced IP blocks when browsing through Google Images, and I cannot figure out the why or source of it. The tooltip can appear in a couple different instances; search results, image upload search results, or after opening up a preview. Even more confusing, I am still on the Google's Images website when the tooltip appears, no potentially malicious websites of any sort have been accessed yet.

 

I use a Google Chrome extension called ScriptSafe (very similar addon to NoScript for Firefox), which allows me to disable/enable certain Javascript. I've allowed Javascript all across the Google domain, but every other outside source is blocked. Regardless, I can still receive an MBAM tooltip regarding an 'IP block' of a malicious website, even though the javascript from the foreign domain is blocked entirely. I'm running Avast antivirus alongside MBAM, using Google Chrome.

 

Here is a log from yesterday. I've replaced (potentially) sensitive areas with x's:

2013/10/18 02:42:44 -0600 FONTAINE Double MESSAGE Executing scheduled update:  Daily

2013/10/18 02:42:55 -0600 FONTAINE Double MESSAGE Scheduled update executed successfully:  database updated from version v2013.10.17.03 to version v2013.10.18.04

2013/10/18 02:42:55 -0600 FONTAINE Double MESSAGE Starting database refresh

2013/10/18 02:42:55 -0600 FONTAINE Double MESSAGE Stopping IP protection

2013/10/18 02:42:55 -0600 FONTAINE Double MESSAGE IP Protection stopped successfully

2013/10/18 02:42:58 -0600 FONTAINE Double MESSAGE Database refreshed successfully

2013/10/18 02:42:58 -0600 FONTAINE Double MESSAGE Starting IP protection

2013/10/18 02:43:01 -0600 FONTAINE Double MESSAGE IP Protection started successfully

2013/10/18 12:12:34 -0600 FONTAINE Double IP-BLOCK xx.xx.xx.xx (Type: outgoing, Port: xxxxx, Process: chrome.exe)

2013/10/18 12:12:35 -0600 FONTAINE Double IP-BLOCK xx.xx.xx.xx (Type: outgoing, Port: xxxxx, Process: avastsvc.exe)

2013/10/18 12:12:35 -0600 FONTAINE Double IP-BLOCK xx.xx.xx.xx (Type: outgoing, Port: xxxxx, Process: avastsvc.exe)

2013/10/18 12:12:35 -0600 FONTAINE Double IP-BLOCK xx.xx.xx.xx (Type: outgoing, Port: xxxxx, Process: avastsvc.exe)

2013/10/18 12:12:35 -0600 FONTAINE Double IP-BLOCK xx.xx.xx.xx (Type: outgoing, Port: xxxxx, Process: avastsvc.exe)

2013/10/18 12:12:35 -0600 FONTAINE Double IP-BLOCK xx.xx.xx.xx (Type: outgoing, Port: xxxxx, Process: avastsvc.exe)

2013/10/18 12:12:35 -0600 FONTAINE Double IP-BLOCK xx.xx.xx.xx (Type: outgoing, Port: xxxxx, Process: avastsvc.exe)

 

If you need more information, please let me know.

[Double]

I forgot to mention I'm running MBAM Pro

[AdvancedSetup]

What you've removed from the log is the important part. The rest of the log doesn't mean too much without it.

If you think you may have an issue I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.

Thanks

[Double]

What you've removed from the log is the important part. The rest of the log doesn't mean too much without it.

If you think you may have an issue I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.

Thanks

I've since reinstalled my system, but if I come across the tooltip again I will post the log. Is it better to attach or copy/paste? Is any data in the log sensitive?

[AdvancedSetup]

The only thing of potential issue for some is their name.  Some people when they setup their new computer use their real name.  Then when you're on the Internet you're always giving that information to every site you visit.  I recommend just using generic account names myself.