happivize Posted September 12 ID:1660590 Share Posted September 12 Hi a customer has reported two separate errors with malwarebytes browser guard for happivize.com 1) trojan 2) phishing virustotal.com and sucuri.com site checks show no malicious software, and we haven't had anything weird going on either. Can you check and remove please? Link to post Share on other sites More sharing options...
Porthos Posted September 12 ID:1660592 Share Posted September 12 Not just BG. Log for staff review. -Website Data- Category: Trojan Domain: happivize.com IP Address: 172.67.140.190 Port: 443 Type: Outbound File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 12 Staff ID:1660606 Share Posted September 12 37 minutes ago, happivize said: Hi a customer has reported two separate errors with malwarebytes browser guard for happivize.com 1) trojan 2) phishing virustotal.com and sucuri.com site checks show no malicious software, and we haven't had anything weird going on either. Can you check and remove please? Hello- Potential Gootloader threat here, have servers checked, contact host: VirusTotal - Domain - happivize.com Link to post Share on other sites More sharing options...
happivize Posted September 12 Author ID:1660632 Share Posted September 12 Hi, thank you I shared this with my web admin at my hosting company bigscoots.com and he said: Quote I've re-scanned the site with VirusTotal directly, and it reports clean: https://www.virustotal.com/gui/url/74d91b30e207e9f74cb306856223acacc4d7f623f4ce2614e53d81cfce232798?nocache=1 I've also scanned with other malware analysis tools, and they all report clean, even clicking around, trying to access wp-admin also. https://app.any.run/tasks/60c5972b-a287-45a8-8fe8-0599be9c5731/ I've run a full WordFence scan and that showed clean. Is there anything else we can do or any tool specifically that we can run so that you are okay with it? I also did a malwarebytes of my own windows computer and it came up clean. Please advise. Link to post Share on other sites More sharing options...
happivize Posted September 16 Author ID:1661317 Share Posted September 16 Hi, is there any progress on this? My webadmin also had this to say relative to the gootloader flag on the virustotal.com relations tab: Hi Aimee, I think it's showing the domain with a red number beside it because it flagged that particular signature at a time in the past, but on the domain itself there are currently no detections. https://www.virustotal.com/gui/domain/happivize.com/relations https://www.virustotal.com/gui/file/6ab8c652eaac3627f0e3420aa3d7a29de229e6f905d7180af589d3f47a3ecaa4/detection https://app.any.run/tasks/79ab54d3-f4a1-4c0c-8d67-905ef2388da3 A heavy anti-evasion test at Hybrid Analysis shows it's clean from malware though - https://www.hybrid-analysis.com/sample/2d397eb0dfdbd95f225bdd9eaed1031b8150c924a5b14e5462a23619cf1f8012 Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now