Dalz Posted January 14, 2015 ID:929296 Share Posted January 14, 2015 Hello, I have recently started getting a regular pop-up from Malwarebytes: Malicious website blockedwww.kikbonus.comport 50096outboundc:\program files (x86)\norton security\engine\22.1.0.9\ns.exe Initially the process was listed as Norton's Identity Safe executable. I uninstalled it when I upgraded to the newest Norton, hoping that would end this activity, but I'm still getting it. Only now it's referencing the new NS executable and not the one I uninstalled. I've run complete scans in Norton, Malwarebytes, and Superantispyware but none have found or resolved the problem. As an aside, I use the Kik text app on my phone and recently received a message that seemed to be from Kik, directing me to this very website... Seems a little too coincidental. Any help figuring this out would be greatly appreciated. (Previously posted here - thanks to TwinHeadedEagle for his help there.) Link to post Share on other sites More sharing options...
David H. Lipman Posted January 14, 2015 ID:929301 Share Posted January 14, 2015 Please review; Important: Please Read Before Reporting A False Positive Link to post Share on other sites More sharing options...
MysteryFCM Posted January 14, 2015 ID:929519 Share Posted January 14, 2015 Please post the actual IP being blocked. Link to post Share on other sites More sharing options...
Dalz Posted January 15, 2015 Author ID:929551 Share Posted January 15, 2015 Oops, sorry about that. I'm actually not sure this is a false positive, but was referred here after receiving some help in the malware removal thread and not finding any issues... The IP being reported is local: 192.162.102.151. I've attached a screen shot of the actual pop-up. Link to post Share on other sites More sharing options...
MysteryFCM Posted January 16, 2015 ID:929805 Share Posted January 16, 2015 It's not an F/P I'm afraid. Just to clarify, the reason it's the Norton process showing is because Norton is intercepting the request at the same time as MBAM. Link to post Share on other sites More sharing options...
Dalz Posted January 16, 2015 Author ID:930037 Share Posted January 16, 2015 Thank you. Should I take this back to the help forum? Nothing was found on our first go (which was why it was suggested I post here), but I'd really like to get this fixed... Link to post Share on other sites More sharing options...
Staff Spud Posted January 17, 2015 Staff ID:930203 Share Posted January 17, 2015 If you think you are infected please follow: https://forums.malwarebytes.org/index.php?/topic/9573-im-infected-what-do-i-do-now/ Link to post Share on other sites More sharing options...
Recommended Posts