CarlyKai Posted April 12, 2017 ID:1116894 Share Posted April 12, 2017 I've been getting the notice that sync-eu.exe.bid is blocked several times a day, for the past few days. I'm not trying to reach that site. The popup notice refers to Chrome, IP 136.243.131.32, port 51252. I updated MalwareBytes and did a Threat scan yesterday and no threats were found. But I'm still getting the "domain blocked" notices. I don't have any Chrome extensions enabled. I haven't tried Firefox or Internet Explorer to see if I get the same domain blocked notice. Yesterday, I updated C-Cleaner and cleared out Chrome's history. Microsoft Security Essentials is automatically updated every morning. I also ran the MSE Full deep scan; it didn't find any viruses. FWIW, MalwareBytes Premium didn't automatically update itself from 3-1-2017 through 4-10-17. When I discovered that, I manually updated MalwareBytes two days in a row, and reported the updating problem. Today, it looks like the database did update itself automatically; it's now v2017.04.12.01. Another FWIW, the "choose files" link below does not open up Explorer so that I could attach today's log. Here's the text I'm copying from the most recent log's .txt file: Malwarebytes Anti-Malware www.malwarebytes.org Detection, 4/12/2017 10:06 AM, SYSTEM, HP_H9-1270T, Protection, Malicious Website Protection, Domain, 136.243.131.32, sync-eu.exe.bid, 51252, Outbound, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe, Detection, 4/12/2017 10:06 AM, SYSTEM, HP_H9-1270T, Protection, Malicious Website Protection, Domain, 136.243.131.32, sync-eu.exe.bid, 51252, Outbound, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe, Detection, 4/12/2017 10:06 AM, SYSTEM, HP_H9-1270T, Protection, Malicious Website Protection, Domain, 136.243.131.32, sync-eu.exe.bid, 51270, Outbound, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe, (end) How do I remove this apparent threat, or if it's not a real threat, get MalwareBytes to stop giving me the notices? Thx. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted April 12, 2017 Staff ID:1116899 Share Posted April 12, 2017 The block you are receiving is because of the domain listed in the log: sync-eu.exe[.]bid, we are currently blocking *.bid. You can add it to your exclusions if you choose to do so, via settings\Exclusions\Add exclusion\Exclude a website\ Enter domain or IP to be excluded. Link to post Share on other sites More sharing options...
CarlyKai Posted April 12, 2017 Author ID:1116925 Share Posted April 12, 2017 Thank you for the quick reply. That's good that you're blocking all .bid domains, and I'm not attempting to visit such a domain. But is there an infection in my PC that is initiating the attempt to access sync-eu.exe.bid in the first place, or are .bid servers broadcasting access attempts to any and all IP addresses? Is there anything else I can or should do other than just let MalwareBytes continue blocking .bid domains? Link to post Share on other sites More sharing options...
RGL Posted April 28, 2017 ID:1120540 Share Posted April 28, 2017 I had the same issue with sync-eu.exe.bid, usually after visiting Yahoo Mail. I read on another forum one of the best solutions is to download and install Adblock Plus which is available for just about every web browser out there. https://adblockplus.org/ After is is installed, choose Filter Preferences from the AdBlock menu, and on the Filter Subscriptions tab, uncheck the box that says "Allow some non-intrusive advertising". I haven't had any issues since. And on the plus side, most web pages load a lot faster now. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted April 28, 2017 Staff ID:1120607 Share Posted April 28, 2017 Please have a look here: Link to post Share on other sites More sharing options...
Recommended Posts