Report scans show these strange blocks, any ideas?

[Sherlock]

I often look at the scan results reports and always see the following 3 items that have been blocked. One I know what it is but have no idea what the others are.

The first that comes up that is blocked is from my TPlink extender.........tplinkextender.net

Why is tplinkextender trying to call home and should I make an exception and allow?

Second, ........download.wifimaster.tech.........Who is this?

Thirdly.........uninstallmalwaretips.com..........Who is this? When I try to go to this site to investigate (safely of course all shields up) MB always blocks an says 'malicious site'.

So where would I find this....uninstallmalwaretips.com.....on my clean Win10 Acer.

Interestingly I do not have these issues on my Macs

Any guidance and help would be most appreciated,

Thanks

Edited March 18, 2018 by Sherlock
Updated info...

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Farbar Recovery Scan Tool (FRST)
  1. Download FRST and save it to your desktop
     Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
     • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
• MB-Check
  1. Download MB-Check and save to your desktop
  2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
  3. This will produce one log file on your desktop: mb-check-results.zip
     • This file will include the FRST logs generated from the previous set of instructions
     • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[Sherlock]

I have an update of sorts.

 

UPDATE. I checked Whois and came up with the following.

First is tplink shows as

Domain Information

Domain:

tplinkextender.net

 

Registrar:

Internet Domain Service BS Corp

 

Registration Date:

2013-01-03

 

Second is 'uninstallmalwaretips.com' 

shows as.........

 

Domain Information

Domain:

uninstallmalwaretips.com

 

Registrar:

GoDaddy.com, LLC

 

Registration Date:

2017-01-14

 

Expiration Date:

2018-01-14

Third is download.wifimaster.tech

 

Domain Information

Domain:

wifimaster.tech

 

Registrar:

Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)

 

Registration Date:

2017-02-16

 

Expiration Date:

2019-02-16

 

Updated Date:

2018-02-13

 

Status:

ok

 

Name Servers:

dns15.hichina.com
dns16.hichina.com

 

I am still none the wiser.

Cheers

[exile360]

Greetings,

Please create and post the logs referred to in the above automatic reply in the section below where it says technical issues so that we may take a look and get a better idea of what's going on with your system.

Thanks

[Sherlock]

Hi, As soon as I get a free moment I will reply with info. At present I am in middle of building my new house so not much down time. Thanks for your patience.

[Sherlock]

OK, I have followed instructions as advised.

I have also found the following.....

om.forgeofempires.com, pcmalwaresecurity.com, bitballoon.com, wholesofbox.bitballoon, removeallvirus.com, trck.addiliate.com, wifimaster.tech,

Thanks

FRST.txt

Addition.txt

mb-check-results.zip

[vbarytskyy]

Hello @Sherlock

Based on what I am seeing in your logs, all the notifications are coming from an add-on/extension you have installed. Epic Privacy Browser.

It is probably reaching out to those sites and we are picking that up. 

[exile360]

I'm also checking with Research to see if maybe Malwarebytes should be detecting that browser extension as PUP (Potentially Unwanted Program).

[screen317]

Sherlock,

 

Can you please delete this folder, reboot, and see if the problem persists?

C:\Users\Michael\AppData\Local\Epic Privacy Browser

 

Thank you,

 

[Sherlock]

Hi Chris,

Did as you asked and did complete uninstall. I then rebooted then ran full scan and nothing showed up. Great result. Next I downloaded Epic latest version and installed it. Ran it by going to a bona fide site  then closed application. Ran MB full scan and it was clean with none of the items I reported. Rebooted and repeated, no issues.

So with all your help 'exile360', 'vbarytsky', and 'screen317' you seem to have got to the bottom of the issue. Many thanks for your time, Cheers

Should I need to do anything else let me know.