epicunitscan.net issue

[TheGeekyNobody]

Today Malwarebytes kept saying it was blocking epicunitscan.net. I'm not really sure what is causing this as the only site I have been on today are my college's website, youtube, and deviantart. It keeps popping up persistantly. I also have not downloaded anything today so I did not think there should be any files causing this but I did run a scan and it came up clean. The topics I found on this subject said this was fixed on a previous update, but my MB is completly up to date so I'm not really sure what the issue is.

 

If you need me to provide screenshots of the alert I can do so.

Edited May 6, 2018 by TheGeekyNobody

[VonGoober]

I too am getting constant pop-ups from Malwarebytes saying it is blocking a riskware site when I start Chrome. Except it is saying it is blocking "epicunitscan.info". I seem to remember this happening last year and was a false positive, so this thread probably needs to be there.

 

Edited May 6, 2018 by VonGoober
Added I think this needs to be reported under "false positives" instead of malware removal.

[splater46]

Same here. Very annoying

[Smudge]

Also have the same issue

[drb48]

Same issue.

[Dylanrockin]

Same here, below are my files in question:

 

One thing I noticed is that Malwarebytes, when scanning in any possible scan, never picked up or detected anything, which is odd... could it be a false positive, since people are saying that this happened last year.

 

FRST.txt

Addition.txt

MalwareByteslog.txt

[TheGeekyNobody]

Seems a lot of people are having this issue so I do think it is a falst positive too 

Last year that was the issue, but I was under the impression it had been fixed. I guess the problem came back up. I'd like to know if anyone using a browser other than chrome are having this issue

[TheGeekyNobody]

How do i move this to the false positive thread?

[miekiemoes]

Hi,

This isn't a false positive:

https://virustotalcloud.appspot.com/nui/index.html#/url/068c30d05f502f8bc3c433ea3484f99adef77e7aad0c1700eec5510400d9d717/detection

but we are temporary removing detection in order to figure out what exactly is causing these detections. We suspect a certain extension being responsible for this that has this domain hardcoded in their extension still, while it's not resolving for a year anymore. 

 

Edited to add, it would be great if you can post a FRST log if you had this detection, so we can compare logs and the chrome extensions installed, to see if we can find the culprit.

Edited May 8, 2018 by miekiemoes

[TheGeekyNobody]

Apologies for my ignorance, but where do i need to go to get the frst log?

[AdvancedSetup]

Please provide the following logs and we'll verify what is actually going on with your system or Malwarebytes program.

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link - do not click Get Started
  
  
   
• Click the Gather Logs button
  
  
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply.

 

 

Edited May 10, 2018 by AdvancedSetup

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks