Anti Exploit turned off at website

[TheArfen]

I stumbled upon this website.

http://www.suryadewa.com/

going through the site a new tab opened in firefox.

Malwarebytes anti exploit Turned Off (presumably by a script running on the site)

then i got a message that Flash player was out of date and i should update it.

obviously i got out of there and emptied all my temp folders and checked my app data folders,

luckily i have found nothing that should not be there.

full scan with mbam and herd protect found nothing.

i just thought you should all know about it (mbam a~e~) getting turned off.

[TheArfen]

11 minutes ago, TheArfen said:

I stumbled upon this website.

http://www.suryadewa.com/

going through the site a new tab opened in firefox.

Malwarebytes anti exploit Turned Off (presumably by a script running on the site)

then i got a message that Flash player was out of date and i should update it.

obviously i got out of there and emptied all my temp folders and checked my app data folders,

luckily i have found nothing that should not be there.

full scan with mbam and herd protect found nothing.

i just thought you should all know about it (mbam a~e~) getting turned off.

perhaps it should be added to the malicious website list.

 

[TheArfen]

perhaps it should be added to the malicious website list.

[John L. Galt]

Wait.  You went to the site, and you witnessed it turning MBAE protection off?

Please verify this for me.

[TheArfen]

49 minutes ago, John L. Galt said:

Wait.  You went to the site, and you witnessed it turning MBAE protection off?

Please verify this for me.

Yes it certainly did.

it happened as i was flicking through the pages.

pop ups were occurring then suddenly bang, Off it went.

then the fake adobe flash update came up.

[TheArfen]

I keep mbae icon on my task bar as i do with mbam and my anti virus system.

for an instant visual of what is going on.

it went off as soon as the fake flash update came up.

[John L. Galt]

@pbust - thought you might like to take a closer look at this situation.

[TheArfen]

I just made a system back up.

i will go back there and try to recreate the situation and

i will post a screen shot.

[TheArfen]

Here you go.

eventually it get completely shut down,

the icon goes from the taskbar and the services were shut down.

[John L. Galt]

Good deal.  I've tagged Malwarebytes staffer Pedro to take a direct look at this.

[TheArfen]

not the exact one, but the one i first got claimed it was adobe flash player.

[John L. Galt]

Hmmm - I didn't pay attention, but it looks like it is redirecting you from the original link you posted to other sites where this is taking place. 

[pbust]

Thanks for the heads-up. We'll investigate.

 

 

[TheArfen]

OK derps,

its been sometime now,

it's refusing to start at computer start up.

i can not find what is shutting it down.

or preventing it from starting.

i am using win~ 7 64 bit on a samsung S3511

if you have not found the answer and regardless of many hours of searching the hard drive,

i can not find it.

i have spent almost 120 hours looking through the registry,

i can not find it.

i am gonna reset this computer with a clean install after a hard drive clean.

i wanna buy some useless stuff on EBay.

 

 

.

[pbust]

Please post your MBAE and FRST logs.

 

Thanks!

 

[Patrick143]

I am having this issue with mae free edition as well. Running windows 7 pro and firefox. No viruses, no recent registry changes. This happens at a couple of different websites. Last time was today at CNet.

In trying to solve this issue, I noticed that when turning off the browser and restarting it, the mae icon and startup message did not appear in systray taskbar. Opened mae, and it said it was running, but I don't think it really was. At least, it was not functioning. Clearing the cache, dumping all cookies, and restarting the computer does the trick. Until all three are performed, the icon does not appear in systray on firefox (or chrome) startup, even though mae says it's running.

[Patrick143]

Update: today was a little different. Dumping the cache and cookies in firefox allowed the systray icon and login message to display. However, my computer could not access the mb update server until I restarted.

[Patrick143]

And now we're back to having to do all three. Well, two actually as I can clear the cache and dump cookies in one step on Firefox. Today it happened while looking at 'This Week's Top Matches' in OK Cupid from my email account. So, as I'm getting this issue at different sites, it's pretty much got to be a Firefox issue, yes?

[pbust]

Hi Patrick, can you try a fresh re-install to see if it makes a difference? Also please post your FRST logs to see if something might be conflicting with MBAE.

https://forums.malwarebytes.org/topic/171634-mbae-fresh-re-install-steps/

 

 

[Patrick143]

I've done a fresh install and we'll see if that does the trick. I've never run frst, and as far as I know, it's not on my machine. Adding it now would do no good for past problems.