sawine Posted September 28, 2022 ID:1535778 Share Posted September 28, 2022 Hello, I was running updates on my system and something tried to open chrome to a domain that doesn't seem to be even registered. I'm not sure how it was able to resolve to an IP address? This domain isn't entered inside my hosts file either... I was updating multiple things... I think it happened after I updated Adobe Creative Cloud... I'm not 100% certain, it also happened after I just rebooted. If anyone could help me shed some light on this, I'm a little paranoid to what this could be... it seems really suspicious. If that's not the right forum section to ask, I'm sorry, if you could please let me know where I should post it. Thanks Here are the details of the incident: Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 9/28/22 Protection Event Time: 1:58 PM Log File: 1b3226f2-3f57-11ed-bd01-0a002700001f.json -Software Information- Version: 4.5.14.210 Components Version: 1.0.1767 Update Package Version: 1.0.60468 License: Premium -System Information- OS: Windows 10 (Build 19044.1889) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Program Files (x86)\Google\Chrome\Application\chrome.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Trojan Domain: unicorns-r-www.us.com IP Address: 45.56.79.23 Port: 80 Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Link to post Share on other sites More sharing options...
Porthos Posted September 28, 2022 ID:1535779 Share Posted September 28, 2022 3 minutes ago, sawine said: If that's not the right forum section to ask, I'm sorry, if you could please let me know where I should post it. Moved for you. Please do the following so that we can get started and see what's going on. The Farbar Recovery Scan Tool is a free Windows utility designed to create troubleshooting logs for your computer. These logs help our Support team to identify and resolve issues with your computer. There are two versions of the Farbar Recovery Scan Tool available for download: 32-bit and 64-bit. To find which operating system is installed on your computer, refer to Microsoft's article: 32-bit and 64-bit Windows: Frequently asked questions Download and launch Farbar Recovery Scan Tool Download the Farbar Recovery Scan Tool Do not click on any Ads. Locate the file you downloaded on your computer. Downloaded files are often saved to the Downloads folder. Double-click the downloaded file to run the Farbar Recovery Scan Tool. A Windows protected your PC notification may appear. This notification is from the Windows Defender SmartScreen Filter which prevents unfamiliar apps from running on your PC. Disable smart screen ONLY if it interferes with software we may have to use: What is SmartScreen and how can it help protect me? a. Click More info. b. Click Run anyway. When the User Account Control window appears, click Yes. To accept the Disclaimer of warranty, click Yes. Ensure only the boxes listed below are checked Registry Services Drivers Processes Internet One month Addition.txt Disable any Antivirus software you have installed ONLY if it stops software we may use from working. Please remember to re-enable any Antivirus software when we are finished running scans Click Scan. The scan may take a few minutes to complete. When the scan completes, Farbar Recovery Scan Tool shows two messages: Scan completed. FRST.txt is saved in the same directory FRST is located. Addition.txt is saved in the same directory FRST is located. Click OK to close each message window Please attach both of those logs on your next reply, DO NOT copy/paste the contents of the logs directly Thanks Link to post Share on other sites More sharing options...
sawine Posted September 28, 2022 Author ID:1535780 Share Posted September 28, 2022 I just noticed if I try to ping this domain, it will do this And also I get the malwarebyte block warning popping up. Link to post Share on other sites More sharing options...
sawine Posted September 28, 2022 Author ID:1535781 Share Posted September 28, 2022 Here are the reports from FarBar Addition.txt FRST.txt Link to post Share on other sites More sharing options...
sawine Posted September 29, 2022 Author ID:1535811 Share Posted September 29, 2022 I found out this alert is coming from hashes.com I had the tab open on my browser. When I open my browser with this website open on it, I get the same alert.... It doesn't explain why I can ping it on my PC.... Link to post Share on other sites More sharing options...
sawine Posted September 29, 2022 Author ID:1535813 Share Posted September 29, 2022 My mistake, it is not hashes.com It is my browser extention called Papaly for bookmarks Link to post Share on other sites More sharing options...
sawine Posted September 29, 2022 Author ID:1535815 Share Posted September 29, 2022 I got rid of the extension (https://chrome.google.com/webstore/detail/bookmark-manager-speed-di/pdcohkhhjbifkmpakaiopnllnddofbbn) But when I ping unicorns-r-www.us.com the route is still saved somewhere in my PC.... Link to post Share on other sites More sharing options...
sawine Posted September 29, 2022 Author ID:1535816 Share Posted September 29, 2022 ...Actually if I ping any domain that doesn't exist .us.com I get the same behavior.... So... maybe false positive after all? Link to post Share on other sites More sharing options...
sawine Posted September 29, 2022 Author ID:1535817 Share Posted September 29, 2022 ...And I assume the reason why it pings an internal IP is because Malwarebytes is doing its internal check? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 29, 2022 Root Admin ID:1535824 Share Posted September 29, 2022 Since you've made change changes to the computer, please restart the computer. Then run the Farbar program again with Admin rights and click on the Scan button and attach back both new logs FRST.TXT ADDITION.TXT Thanks @sawine Link to post Share on other sites More sharing options...
sawine Posted September 29, 2022 Author ID:1535829 Share Posted September 29, 2022 Hello, Did you read my latest replies? You can close this thread. My computer is not infected. Anyone who pings a .us.com domain that doesn't exist will ping this IP. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 29, 2022 Root Admin ID:1535830 Share Posted September 29, 2022 Since this issue is resolved the topic will now be closed to prevent others from posting here. If you need assistance please start your own new topic and someone will be happy to assist you. Thanks Link to post Share on other sites More sharing options...
Recommended Posts