69.197.188.122, localhost.world is NOT false

[distill]

This thread https://forums.malwarebytes.org/index.php?/topic/174405-mb-constant-stopping-69197188122-localhostworld/is locked so I couldn't write there, but this is a reply to that one.

 

I don't think that is a false positive. I had a problem where my Google requests on Chrome for example were directed to a weird, old version of Google. Clearly a fishing site of some sort. No idea where I got that trojan from. What happens is Internet Options / Connections / LAN settings / [x] Use automatic configuration script is injected with

 

http://localhost.world/localhost.local

 

And this downloads a script with all Google requests being forwarded to PROXY 69.197.188.122:8484.

 

I did run Malwarebytes and it did NOT found this problem. Where a simple solution is to just remove that offending configuration script link. I do not know if there are additional problems caused by the same trojan.

[MysteryFCM]

We're not blocking the hostname, gTLD nor the IP.