sync-eu.exe.bid

[CJA87]

I have seen a couple of threads on this topic.....but, have not seen a way to get rid of it.  My MB database is up to date, I've scanned my entire drive - nothing. 

"Malicious Website Protection, Domain, 136.243.15.176, sync-eu.exe.bid, 62557, Outbound, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

MB always blocks this which, is good.  But, how do I get rid of the actual cause?

[Zynthesist]

Hello, 

Please have a look at this post:

The block is on the .bid gTLD

[CJA87]

Thanks for the quick reply....  I understand the block is on the xxx.xxx.xxx.bid domain.  Okay.  But what is causing this anomaly to call home...to reach out to 136.243.15.176?  If I can find the root - then I can delete it.  After which, MB wouldn't have to block anything.  

I have looked around on how to delete this annoying "feature" - but, when I look through my registries, etc - just don't see it.  There must be a way to eradicate this.

[AdvancedSetup]

Hello @CJA87 and :welcome;

Let me get some logs please to see what's going on.

Run the scan from the topic here Available Assistance for Possibly Infected Computers and post back the logs once ready as an attachment.

Thanks

Ron

 

 

[CJA87]

Okay...I downloaded FarBar Recovery and ran a scan.  Attached are the two output files

FRST.txt

Addition.txt

[AdvancedSetup]

Please visit this web page and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.