AlexLeadingEdge Posted June 2, 2021 ID:1460927 Share Posted June 2, 2021 The website is: www.soyang.net (173.255.213.202:80) Interestingly it is blocked on some machines but not on others. Soyang is a supplier for one of our clients. The block page claims the website "may contain a trojan". Can you please confirm this, and if nothing is found, please whitelist. Link to post Share on other sites More sharing options...
Staff JPopovic Posted June 2, 2021 Staff ID:1460957 Share Posted June 2, 2021 Hello, The website is infected. <script>var _0xcc15=["\x73\x63\x72\x69\x70\x74","\x63\x72\x65\x61\x74\x65\ Malicious script should be removed in order for the domain to be unblocked. Thank you. Link to post Share on other sites More sharing options...
AlexLeadingEdge Posted June 2, 2021 Author ID:1461108 Share Posted June 2, 2021 Hi JPopovic, This is worrying. Not only that there is a malicious script in this website, but also that we have several machines running the latest version of Malwarebytes that isn't blocking the website as infected. Is there a reason why two installs of Malwarebytes would have different results? Link to post Share on other sites More sharing options...
Porthos Posted June 2, 2021 ID:1461121 Share Posted June 2, 2021 29 minutes ago, AlexLeadingEdge said: Is there a reason why two installs of Malwarebytes would have different results? Different database? Exclusion set on some? Grasping at straws. You are using nebula? Link to post Share on other sites More sharing options...
AlexLeadingEdge Posted June 2, 2021 Author ID:1461125 Share Posted June 2, 2021 Just now, Porthos said: Different database? Exclusion set on some? Grasping at straws. You are using nebula? Hi Porthos, We are using OneView for all our clients. No exclusions set for this URL. The components are exactly the same. One difference is that one is a workstation and the other is a server (respectively): Agent Information (Working - Website blocked) Endpoint Protection: 1.2.0.876 Endpoint Protection Protection Update: 1.0.41253 Protection service version: 4.3.2.106 Component package version: 1.0.1251 Asset Manager: 1.2.0.331 Brute Force Protection: 1.2.0.31 Agent Information (Not Working - Website not blocked) Brute Force Protection: 1.2.0.31 Asset Manager: 1.2.0.331 Endpoint Protection: 1.2.0.876 Endpoint Protection Protection Update: 1.0.41253 Protection service version: 4.3.2.106 Component package version: 1.0.1251 Endpoint Detection and Response: 1.2.0.305 Link to post Share on other sites More sharing options...
Administrators jtodd234 Posted June 3, 2021 Administrators ID:1461177 Share Posted June 3, 2021 Hi AlexLeadingEdge, Thanks for reaching out. I am sorry to hear that you are having a different experience with two Malwarebytes installations. We would like to further investigate to understand what is happening. Do you mind PM'ing me a good email address and I will get you a support ticket to get some further information from these machines. If you are able to collect the following in advance it would help expediate the process once the ticket is open as you can then submit the files that are generated. https://support.malwarebytes.com/hc/en-us/articles/360038522294-Collect-Malwarebytes-Endpoint-Agent-diagnostic-logs Thank you in advance. 1 Link to post Share on other sites More sharing options...
AlexLeadingEdge Posted June 3, 2021 Author ID:1461191 Share Posted June 3, 2021 51 minutes ago, jtodd234 said: Hi AlexLeadingEdge, Thanks for reaching out. I am sorry to hear that you are having a different experience with two Malwarebytes installations. We would like to further investigate to understand what is happening. Do you mind PM'ing me a good email address and I will get you a support ticket to get some further information from these machines. If you are able to collect the following in advance it would help expediate the process once the ticket is open as you can then submit the files that are generated. https://support.malwarebytes.com/hc/en-us/articles/360038522294-Collect-Malwarebytes-Endpoint-Agent-diagnostic-logs Thank you in advance. Hi jtodd234, I already have Ticket 3478426 open :) I will gather the logs now and submit to the ticket mentioned :) 1 Link to post Share on other sites More sharing options...
Administrators jtodd234 Posted June 3, 2021 Administrators ID:1461192 Share Posted June 3, 2021 AlexLeadingEdge, Thank you so much that will be great. I will make sure we take a look ASAP once those logs come in. If you need anything in the interim please do not hesitate to let us know. Link to post Share on other sites More sharing options...
AlexLeadingEdge Posted June 3, 2021 Author ID:1461210 Share Posted June 3, 2021 I have emailed the diagnostic files, please confirm you got both, Gmail doesn't seem happy to be sending them, something inside the zip files is on Gmail's banned list or contains something that is triggering the Gmail antivirus. Link to post Share on other sites More sharing options...
Administrators jtodd234 Posted June 3, 2021 Administrators ID:1461309 Share Posted June 3, 2021 Hi, Yes both files were received. My colleague will continue to work with you via the support ticket. Let us know if you have any additional questions in the interim. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now