Norton removed MBG indexeddb.blob\2\00\5a

[bjm]

FWIW ~ just sharing

Filename: 5a
Threat name: Linux.MiraiFull Path: C:\Users\bjm\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\chrome-extension_ihcjicgdanjaechkgeegckofjjedodee_0.indexeddb.blob\2\00\5a

Edge 103.0.1264.71

 

Filename 5a.txt

Edited July 26, 2022 by bjm

[gonzo]

That file is a Browser Guard cache file.  It is not dangerous and is most definitely a Norton false positive.  If you create an exclusion in Norton for the file location you mentioned, Norton should leave it alone in the future.

[BOOSTEDI5]

Hello, my Norton was also alerting me about this today at 10:13am MST. It alerted 3x for 3 Different files! One after another. I never told Malwarebytes to install Browser guard and don't care to use it. Especially after this warning! I was using LinkedIn in Edge where Browser guard installed itself somehow without my permission. I noticed the Browser Guard extension before and left it enabled but was curious how it was installed since I always told Malwarebytes to not install the Browser Guard tool. I went ahead and disabled the extension for now but this seems nefarious. Why would Norton flag these as a these Trojan unless they were actually matching some sort of virii signature? This was a high warning that shows up as a remote exploit tool. I like Malwarebytes but this needs a better explanation.

Today at 10:13am. I'm guessing the OP was in EST zone? My file matched OP MD5 and SHA. Thanks 

norton-flagged-malwarebytes.txt

[BOOSTEDI5]

I'm inclined to believe what gonzo mentioned after restoring one of files and then running it through this online scan tool.

https://www.virustotal.com/gui/file/eed5983a5889a54d272dba8d2a640a204f3d3f43b430aa277a3d4ba9b0049462?nocache=1

As can be seen in this link only Norton flagged the File Thumbprint - SHA: eed5983a5889a54d272dba8d2a640a204f3d3f43b430aa277a3d4ba9b0049462as as potentially malicious Linux.Mirai. 

FYI for anyone else that likes to double check things. 

[gonzo]

Malwarebytes is a favorite target by many antivirus vendors to uninstall.  If you are around the forums for any length of time, you become used to it.  Do a search for the word "exclusion" and you will see how common this scenario is.

Another giveaway about false positives is that a single source flagged it as a threat (as you noted).  Thank you for providing further information on the subject!

[BOOSTEDI5]

22 hours ago, gonzo said:

Malwarebytes is a favorite target by many antivirus vendors to uninstall.  If you are around the forums for any length of time, you become used to it.  Do a search for the word "exclusion" and you will see how common this scenario is.

Another giveaway about false positives is that a single source flagged it as a threat (as you noted).  Thank you for providing further information on the subject!

That's interesting and never thought about it like that. The reason I was pretty sketched out about it is because Norton flagged this as Linux Mirai. The Mirai botnet was a huge thing back in 2016-2017 or whenever those guys took over all the IOT devices creating the huge botnet to do DDOS attacks and the like.