www.dcmembers.com 104.31.86.119

[chuckdee]

• IP address: 104.31.86.119
• Hostname/URL: hxxp://www.dcmembers.com

Member site for DonationCoder.com.  Hosts free software- many are AutoHotKey which you seem to get a lot of false positives for.

Protection Log

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 7/30/19
Protection Event Time: 2:06 PM
Log File: c14cbdec-b2f4-11e9-8448-74d435e5dae7.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.586
Update Package Version: 1.0.11760
License: Premium

-System Information-
OS: Windows 10 (Build 17134.285)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Trojan
Domain: www.dcmembers.com
IP Address: 104.31.86.119
Port: [12847]
Type: Outbound

(end)

 

[MysteryFCM]

Can you remove the following file please;

dcmembers.com/jgpaiva/wp-content/uploads/sites/9/CS/Touch/Touch.exe

 

[chuckdee]

Why?  It's just an AHK exe to touch a file and change the modification date.

You can see the thread that tells what it does here: https://www.donationcoder.com/forum/index.php?topic=4382.0

The source for the ahk is here: http://www.dcmembers.com/jgpaiva/wp-content/uploads/sites/9/CS/Touch/Touch.ahk

It is not a Trojan, and your identification of it as such is a false positive.  It's a compiled AHK for convenience only.

 

Thoughts?

[chuckdee]

I can't see how to edit my response; I pasted the wrong page for his information page.  That should be at https://www.donationcoder.com/forum/index.php?topic=5540

[MysteryFCM]

It is indeed an F/P, the block will be removed on the next update. Sorry for the confusion.