favegame.net outbound blocked messages

[Ghostryderflyby]

I keep getting notifications from Malwarebytes, that is is blocking outbound requests from favegame.net. Searching online, favegame appears to be a gaming website, which I have never used. I don't have any programs/games installed that use it to my knowledge, and I have no favegame listed under installed programs under control panel. Doing a registry search (via regedit) for favegame, I didn't come up with any entries either. A process search also shows no favegame processes. So I'm trying to figure out why I keep getting these favegame.net outbound requests blocked by malwarebytes, when I can't find any related programs or processes to favegame.net.

Looking at the log file for the protection event, it is showing the offending file as being located in my Norton protection engine folder, and named ncolow.exe. Is this just an issue of malwarebytes not playing nice with my Norton 360?

[kevinf80]

Hello Ghostryderflyby and welcome to Malwarebytes, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Next, Open Malwarebytes, select > Reports > then checkmark (tick) most recent "Website Block" entry > then select "View Report" > "Export" > Text File (*.txt) name and save that file to Desktop or somewhere of your choice, attach to your reply... Do that for last three blocks.... Thanks, Kevin...

[Ghostryderflyby]

Kevin,

Thanks much for the response and suggestions. After running the tool and seeing what all it lists, I'm not comfortable with posting the FRST logs on an open forum. Being a security conscious fellow, it just seems there is an awful lot of info in there that could be exploited. Everything I see looking at the logs, indicates pretty much everything is white listed. Could you give me an idea what I'm looking for, and I can try to find and resolve it? I've done a find search on both logs for favgame, and I'm still coming up empty. Here are the protection event logs from Malwarebytes.

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 12/20/17
Protection Event Time: 8:41 PM
Log File: d87292fc-e600-11e7-824f-c860003072d1.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3532
License: Premium

-System Information-
OS: Windows 10 (Build 16299.125)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Unspecified
Domain: www.favgame.net
IP Address: 64.210.130.66
Port: [62746]
Type: Outbound
File: C:\Program Files (x86)\Norton Security with Backup\Engine\22.11.2.7\ncolow.exe

(end)

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 12/20/17
Protection Event Time: 8:41 PM
Log File: d875ee7a-e600-11e7-bc1f-c860003072d1.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3532
License: Premium

-System Information-
OS: Windows 10 (Build 16299.125)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Unspecified
Domain: www.favgame.net
IP Address: 64.210.130.66
Port: [62746]
Type: Outbound
File: C:\Program Files (x86)\Norton Security with Backup\Engine\22.11.2.7\ncolow.exe

(end)

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 12/20/17
Protection Event Time: 8:41 PM
Log File: d8797126-e600-11e7-8e59-c860003072d1.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3532
License: Premium

-System Information-
OS: Windows 10 (Build 16299.125)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Unspecified
Domain: www.favgame.net
IP Address: 64.210.130.66
Port: [62747]
Type: Outbound
File: C:\Program Files (x86)\Norton Security with Backup\Engine\22.11.2.7\ncolow.exe

(end)

[Ghostryderflyby]

Doing a lot more digging, I finally found this thread on Norton's forums. It looks like this probably is an issue of Norton and Malwarebytes not playing nice? https://community.norton.com/en/forums/norton-blocked-my-mailwarebites-antimailwareprogram

[kevinf80]

In your opening reply you quote "favegame.net" being blocked was the issue you were concerned about.  https://www.reviewopedia.com/favgame-net-reviews

Now you quote "ncolow.exe" is the problem, if that latest quote is the problem add it as an exclusion for now, also open a thread at the following link and list ncolow.exe as a possible false postive....

https://forums.malwarebytes.com/forum/42-file-detections/

Regarding your first quote I would need to have a look at logs created by FRST. There are hundreds of logs posted here at Malwarebytes and other Malware removal forums without anything untoward happening. If you do not feel comfortable posting such logs then we cannot progress...

Thank you,

Kevin......

[kevinf80]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks